一句話：鐵鎧守護神可以用 App Store 訂閱或保固方案授權碼啟用。AI 服務由鐵鎧維運閘道提供；你的 SSH 憑證只留在你的裝置，不會傳給我們。
中文資料儲存在哪裡
- SSH 帳號 / 密碼 / 私鑰，以及 App 連線用的雲端平台權杖：只儲存在你裝置的系統安全儲存區（iOS 鑰匙圈 Keychain / Android Keystore），不會離開你的裝置，也不會傳給我們。
- 伺服器設定、審計記錄：存在你的裝置本機。例外：使用保固方案授權碼時，閘道會記錄這組授權碼綁定的伺服器（網域、IP，或雲端平台與 GitHub 連線的類型），用來執行「一組授權碼對應一台伺服器」的規則，見下一項。
- 授權碼、裝置識別碼、session 憑證：存在你裝置的系統安全儲存區，鐵鎧維運閘道也會保存：閘道記錄你的授權碼（連同方案、到期日、點數與用量）、這份授權綁定的裝置識別碼、保固方案授權碼綁定的伺服器網域或 IP（第一次使用 AI 時記下），以及發給你裝置的 session 憑證，用來驗證使用權限。裝置識別碼是 App 第一次啟動時隨機產生的代碼，不是手機的序號或廣告識別碼。
資料傳到哪裡
- 鐵鎧維運閘道（我們的伺服器）：為了提供 AI 維運功能，你的提問與伺服器命令輸出會由裝置傳送到鐵鎧維運閘道，再由閘道轉送到 Anthropic 的 Claude。閘道僅在當下處理這些內容以完成請求，不長期儲存對話內容；我們只保留用量統計（請求次數、token 數量），用來計算點數與維持服務品質。授權碼與裝置識別碼用於驗證使用權限。
- App Store 購買（訂閱與點數包）：付款由 Apple 處理，我們拿不到你的付款資訊。購買或恢復購買時，App 會把 Apple 簽章的交易紀錄（交易編號、商品、購買與到期時間、App Store 地區）送到閘道驗證；閘道據此記錄你的方案、到期日、點數餘額，以及使用這份訂閱的裝置識別碼（用來限制同時使用的裝置數）。Apple 也會把續訂、到期、退款等狀態直接通知閘道。
- 伺服器監控（選用功能）：你建立的監控目標（網站網址，或雲端平台與它的 API 權杖）、推播用的裝置權杖、你填寫的 Telegram 聊天 ID 會存在閘道，用來 24 小時檢測並在異常時通知你。雲端平台權杖加密保存，不會回傳給任何人；刪除監控項就會一併刪除。監控偵測到異常時，閘道會把該監控項的網址與預期關鍵字（或雲端平台名稱與監控範圍），連同這次探測的結果與技術細節（例如狀態碼、錯誤訊息），送給 Anthropic 的 Claude 產生處理建議，附在通知裡；平台權杖不會送出。
- Claude（Anthropic）：經由閘道送達，受 Anthropic 隱私政策約束。
- 你的伺服器：SSH 連線由你的裝置直接連到你指定的伺服器，不經過我們或任何第三方。
我們不做的事
- 不收集裝置的位置、聯絡人、相簿等個人資料。
- 不含第三方廣告 SDK，不販售你的資料。
- 不為廣告或追蹤目的分析你的對話內容。
你的控制權
你可隨時在 App 內解除啟用、刪除伺服器設定與監控項、清除審計記錄；訂閱可隨時在 App Store 的帳號設定中取消。
刪除 App 會移除 App 內的本機檔案（例如審計記錄），但存放在 iOS 鑰匙圈（Keychain）的資料在刪除 App 後仍可能留在裝置上，包括伺服器設定與 SSH 憑證、授權碼、session 憑證與裝置識別碼；之後在同一台裝置重新安裝時可能會被讀回。若要一併清除，請在刪除 App 前先在 App 內刪除伺服器設定並解除啟用（解除啟用後，鑰匙圈仍會保留裝置識別碼與語言等偏好設定）。
閘道上的資料不會因為刪除 App 而刪除，包括：授權、訂閱、點數、用量、綁定的裝置識別碼與 session 記錄，以及伺服器監控的監控項（含加密保存的雲端平台權杖）、告警紀錄、Telegram 聊天 ID 與推播用的裝置權杖。刪除 App 或在 App 內解除啟用，都不會停止監控：監控項會繼續在閘道上執行，偵測到異常時照常發送 Telegram 通知，直到你在 App 內刪除監控項，或授權到期、被撤銷為止；推播用的裝置權杖則在 Apple 回報失效後由閘道移除。不再需要監控時，請在刪除 App 前先在 App 內刪除監控項、清除 Telegram 聊天 ID 並關閉推播。如需刪除閘道上的資料，請依下方「聯絡我們」與鐵鎧資訊管理商行聯繫，我們會在確認身分後刪除。
聯絡我們
使用問題、訂閱與點數、資料刪除申請，都可以直接聯絡我們：
- 鐵鎧資訊管理商行
- 電話：0933-325-582
English
Where data is stored
- SSH credentials (account / password / private key) and the cloud platform tokens the app uses to connect: stored only in your device's secure storage (iOS Keychain / Android Keystore). They never leave your device and are never sent to us.
- Server profiles and audit logs: stored locally on your device. Exception: with a warranty license key, the gateway records the server the key is bound to (its domain or IP, or the type of cloud platform or GitHub connection) to enforce one server per key; see the next item.
- License key, device identifier and session token: stored in your device's secure storage, and also kept on the TieKai operations gateway: the gateway records your license key (with its plan, expiry date, points and usage), the device identifiers bound to the license, the server domain or IP a warranty key is bound to (recorded the first time you use AI), and the session tokens issued to your devices, to verify entitlement. The device identifier is a random code the app generates on first launch; it is not your phone's serial number or advertising identifier.
Where data is sent
- TieKai operations gateway (our server): to provide the AI maintenance feature, your prompts and server command output are sent from your device to the TieKai gateway, which relays them to Anthropic's Claude. The gateway processes this content transiently to fulfill the request and does not retain conversation content; we keep only usage metrics (request and token counts) to calculate points and maintain service quality. Your license key and device identifier verify entitlement.
- App Store purchases (subscriptions and point packs): payment is handled by Apple and we never receive your payment details. When you buy or restore, the app sends Apple's signed transaction record (transaction ID, product, purchase and expiry dates, App Store storefront) to the gateway for verification. The gateway records your plan, expiry date, point balance, and the device identifiers using the subscription (to limit simultaneous devices). Apple also notifies the gateway directly about renewals, expirations and refunds.
- Server monitoring (optional): the monitors you create (a website URL, or a cloud platform and its API token), your push notification device token, and any Telegram chat ID you enter are stored on the gateway to run checks around the clock and alert you. Cloud platform tokens are stored encrypted and never returned to anyone; deleting a monitor deletes them. When a monitor detects a problem, the gateway sends that monitor's URL and expected keyword (or the cloud platform name and monitored scope), together with the probe result and technical details such as status codes and error messages, to Anthropic's Claude to generate a suggested fix that is included in the alert. Platform tokens are never sent.
- Claude (Anthropic): reached via the gateway, governed by the Anthropic Privacy Policy.
- Your servers: SSH connections go directly from your device to the servers you specify, with no intermediary.
What we do not do
- No collection of location, contacts, or photos.
- No third-party advertising SDKs; we do not sell your data.
- We do not analyze your conversation content for advertising or tracking.
Your control
You can deactivate, delete server profiles and monitors, and clear audit logs anytime in the app; subscriptions can be cancelled anytime in your App Store account settings.
Deleting the app removes its local files (such as audit logs), but data kept in the iOS Keychain may remain on the device after the app is deleted, including server profiles and SSH credentials, your license key, session token and device identifier; it may be read again if you reinstall the app on the same device. To clear it, delete your server profiles and deactivate in the app before deleting the app (after deactivating, the Keychain still keeps the device identifier and preferences such as language).
Data on our gateway is not deleted when you delete the app. This includes your license, subscription, points, usage, bound device identifiers and sessions, as well as your server monitoring data: monitors (including encrypted cloud platform tokens), alert history, Telegram chat ID and push notification device tokens. Deleting the app, or deactivating in the app, does not stop monitoring: your monitors keep running on the gateway and Telegram alerts are still sent when a problem is detected, until you delete the monitors in the app or your license expires or is revoked. Push notification device tokens are removed by the gateway once Apple reports them as no longer valid. If you no longer need monitoring, delete your monitors, clear the Telegram chat ID and turn off push notifications in the app before deleting it. To delete data on our gateway, contact Tiekai Information Management (see "Contact us" below); we will delete it after verifying your identity.
Contact us
For help with the app, subscriptions and points, or data deletion requests, contact us directly:
- Tiekai Information Management
- Phone: +886 933-325-582