我们尽量少保留关于你的数据。此页列出你在使用 EvoMap 时可能写入设备的每一个 Cookie、localStorage 和 sessionStorage 项目，说明用途、有效期以及处理它的合法基础。你可以随时通过任何页面页脚的「Cookie 偏好」链接复核或更改你的选择。
1.严格必要类#
这些项目是网站正常运行所必需的。无论你在 Cookie 横幅中如何选择都会写入；拒绝它们会让登录、安全、防滥用或第一方性能分析失效。本节还包括错误监控：崩溃与失败报告会发送给第三方处理者 Sentry，它还会收到普通页面加载耗时的抽样数据。它同样不受横幅选择控制；下表中以 Sentry 命名的几行列明了它会收到什么。
| 名称 | 类型 | 用途 | 有效期 | 合法基础 |
|---|---|---|---|---|
| evomap_sid | Cookie | Login session token | 30 days (Max-Age in src/lib/cookie.js) | GDPR Art. 6(1)(b) — contract performance |
| evomap_user | localStorage | User profile cache (reduces /me request frequency) | Persistent (cleared on logout) | Art. 6(1)(b) |
| evomap_auth_ts | localStorage | 401 grace-period timestamp (prevents short-network-blip logout) | Persistent | Art. 6(1)(b) |
| evomap_chunk_reload | sessionStorage | Auto-recovery from post-deploy chunk-load errors | Session (cleared on tab close) | Art. 6(1)(f) — legitimate interest (deployment stability) |
| evomap_chunk_reload_reported | sessionStorage | Marks the reload above as already reported, so one post-deploy recovery produces one diagnostic event instead of one per document | Session (cleared on tab close) | Art. 6(1)(f) — legitimate interest (deployment stability) |
| sentryReplaySession | sessionStorage (Sentry SDK) | Session Replay id. The SDK keeps a rolling recording of roughly the last 60 seconds in your browser's memory and it stays there: nothing is uploaded unless a JavaScript error happens, and then that buffered minute is sent so we can see what led up to the crash. An ordinary visit that never errors uploads no replay at all. Throughout, the SDK's masking defaults are left on: every text node and every form input is replaced with a placeholder and all media is blocked, so what we receive is layout and interaction timing, not what you typed or read | Session (cleared on tab close) | Art. 6(1)(f) — legitimate interest (diagnosing crashes) |
| sentry_performance_trace | Third-party transmission to Sentry (sentry.io) — not browser storage | Separately from the error reporting below, a sample of ordinary page loads and in-app navigations (20% in production) is timed and sent to Sentry so we can see when the site gets slower. A trace carries the page URL, timings and the same anon_id / session_id, not page content — no replay is recorded and nothing you typed is included | Per the Sentry project's retention setting; deletable on request | Art. 6(1)(f) — legitimate interest (service performance) |
| sentry_error_event | Third-party transmission to Sentry (sentry.io) — not browser storage | When a page crashes, or a critical path fails for a reason on our side (login, page load, an API call our server could not complete), we send Sentry the error type and stack trace, the page URL, your browser and OS, the preceding interaction breadcrumbs, and the identifiers evomap_anon_id / evomap_session_id plus your account id when you are signed in — the same identifiers our own analytics uses, so one report can be matched to one session. A failure caused by your own input, such as a wrong password or a rate limit, does not create a report of its own; it can still appear as one line of context inside a later report, because we record every failure as a breadcrumb before deciding which ones to send. Sentry's privacy policy: https://sentry.io/privacy/ | Per the Sentry project's retention setting; deletable on request | Art. 6(1)(f) — legitimate interest (service reliability and security) |
| evomap_ai_chat_quota | localStorage | Anti-abuse rate limit for the AI chat surface | Persistent | Art. 6(1)(f) — anti-abuse |
| evomap_storage_warned | sessionStorage | Storage-error telemetry dedupe (≤ 1 warn per 24h per tab) | 24h cooldown; cleared on tab close | Art. 6(1)(f) |
| evomap_consent | localStorage | Your cookie-preference decision (so we don't re-ask every visit) | 90 days | GDPR Art. 7 — consent record |
| evomap_consent_expired | localStorage | Single-shot marker so we know to re-prompt after TTL expiry | Short-lived (cleared on next banner mount) | Art. 7 |
| evomap_exp_evox_beta | Cookie (HttpOnly) | Keeps you on one version of the EvoX download page across visits and languages while we compare two layouts — first-party, anonymous, never shared with third parties | 90 days | Art. 6(1)(f) — first-party content variant (D-7 Plan X, extended) |
| evomap_anon_id | localStorage | Anonymous identifier for site performance improvement. It is not shared with advertising or analytics third parties, and it is never sold; the one processor that receives it is our error monitor (see the sentry_error_event row), so that a crash report can be matched to the session it came from | Persistent | Art. 6(1)(f) — first-party analytics (ICO / AEPD position) |
| evomap_im_ref | Cookie | First-party Impact.com affiliate click id (`im_ref`) for last-click conversion attribution — never shared with third parties from the browser; forwarded only on our own auth/billing requests. When an attributed conversion completes, our server submits the click id together with conversion identifiers and amounts to Impact.com's conversion reporting API, to settle the partner's commission. | 90 days | Art. 6(1)(f) — first-party attribution (affiliate conversion) |
| evomap_session_id | sessionStorage | First-party session identifier — rotates every 30 min of inactivity | 30 minutes idle; cleared on tab close | Art. 6(1)(f) |
| evomap_session_ts | sessionStorage | Last-activity timestamp paired with evomap_session_id (drives idle rotation) | 30 minutes idle; cleared on tab close | Art. 6(1)(f) |
| evomap_utm | sessionStorage | Marketing-campaign entry attribution — current session only | Session (cleared on tab close) | Art. 6(1)(f) |
| evomap_pending_credit_purchase | sessionStorage | Temporary checkout-return context for credit top-ups: selected credit amount, USD amount, and Hub order id. It never stores card numbers, payment tokens, or provider secrets. | Session; removed after the credit-purchase result return is processed | Art. 6(1)(f) — payment attribution and support diagnostics |
2.功能性#
保存你主动选择的偏好项目（语言、主题、AI 聊天历史）。
| 名称 | 类型 | 用途 | 有效期 | 合法基础 |
|---|---|---|---|---|
| evomap_locale | Cookie + localStorage | Your selected language | 1 year | Art. 6(1)(a) — user-initiated preference |
| evomap_theme | Cookie + localStorage | Your selected theme | 1 year | Art. 6(1)(a) |
| evomap_ai_chat | localStorage | AI chat history (local only — never uploaded) | Persistent | Art. 6(1)(b) — user-generated content |
| evomap_onboarding | localStorage | Onboarding-tour completion state | Persistent | Art. 6(1)(f) |
3.分析（第三方，可关闭）#
Google Analytics 4 Cookie。严格地区默认拒绝（欧盟 / EEA / 英国 / 瑞士、EU 微国家、英国王室属地、巴西、韩国、日本、土耳其、以色列，以及国家无法解析的访客）；其他地区默认允许且不显示横幅。严格地区访客通过 Cookie 横幅切换；其他地区访客可通过页脚的「Cookie 偏好」链接打开面板。我们还会将你注册时填写邮箱的不可逆哈希值存入我们自己的第一方数据库，用于转化漏斗分析；该哈希永不分享给 Google。
| 名称 | 类型 | 用途 | 有效期 | 合法基础 |
|---|---|---|---|---|
| _ga | Cookie (Google SDK, written on our domain) | Google Analytics 4 visitor identifier | 2 years | Art. 6(1)(a) — explicit consent (banner) |
| _ga_<id> | Cookie (Google SDK, written on our domain) | Google Analytics 4 property-scoped session | 2 years | Art. 6(1)(a) |
| _gid | Cookie (Google SDK, written on our domain) | Google Analytics 4 short-term visitor distinguisher | 24h | Art. 6(1)(a) |
| analytics_event_client_ip | Server-side database field (evomap_behavior_events.properties.client_ip — plaintext IP address) | The visitor IP address our edge resolved for the request that reported the event, stored so abuse and traffic-quality investigations can identify the originating network. Recorded only when the ingress can vouch for the address; internal and gateway addresses are never stored. Not forwarded to Google. | Retained for the analytics table's retention window; deletable on request | Art. 6(1)(f) — legitimate interest (fraud prevention and service security) |
| analytics_event_geo_country | Server-side database field (evomap_behavior_events.geo_country — ISO alpha-2) | Country our edge resolved for the request that reported the event, used for traffic-quality and funnel analysis by region. | Retained for the analytics table's retention window; deletable on request | Art. 6(1)(f) — legitimate interest (product analytics) |
| analytics_event_email_hash | Server-side database field (evomap_behavior_events.properties.email_sha256 — irreversible SHA-256 hash) | Irreversible hash of the email entered at registration intent / completion (register_button_click, register_create_account_result) for conversion-funnel analysis. Stored only in our first-party database; the plaintext email is never persisted to analytics and never forwarded to Google. | Retained until account deletion; deletable on request | Art. 6(1)(f) — legitimate interest (product analytics) |
4.广告（第三方，可关闭）#
Google Ads 转化追踪 Cookie（拆分为 Google Consent Mode v2 三个独立维度：ad_storage、ad_user_data、ad_personalization，可分别切换），以及 Meta Pixel Cookie（_fbp、_fbc）。默认策略同分析类。Meta 是独立的数据控制者，不在 Google Consent Mode 之内，因此在 ad_storage 维度上由它自己的开关控制：关闭「广告」会同时撤回 Meta 的同意。与上面的 Google Cookie 不同，_fbp 与 _fbc 的用途正是把你在本站的行为与你在 Meta 平台上的广告点击做跨站匹配。
| 名称 | 类型 | 用途 | 有效期 | 合法基础 |
|---|---|---|---|---|
| _gcl_aw | Cookie (Google Ads SDK) | Google Ads conversion attribution | 90 days | Art. 6(1)(a) |
| _gcl_au | Cookie (Google Ads SDK) | Google Ads conversion linking | 90 days | Art. 6(1)(a) |
| _gcl_dc | Cookie (Google Ads SDK) | Google Ads display network | 90 days | Art. 6(1)(a) |
| _fbp | Cookie (Meta Pixel) | Meta ads conversion attribution — browser identifier | 90 days | Art. 6(1)(a) |
| _fbc | Cookie (Meta Pixel) | Meta ads click attribution — set when arriving via an ad click | 90 days | Art. 6(1)(a) |
5.第三方账号连接器（Google Drive、Gmail）#
当你在 EvoX 控制台把 Google Drive 或 Gmail 账号连接到 EvoMap 账号时，我们会通过 Google 的 OAuth 授权页向你申请明确列出的权限，你在授权页上可以逐项看到并决定是否同意。连接只在你主动点击「连接」时发生，随时可以断开。
- 我们访问哪些数据：Google Drive —— 文件的元数据、内容与权限，只读（drive.readonly）；以及由本应用自己创建或打开的文件（drive.file），该权限也使 EvoX 能在你要求时于你的 Drive 中创建和复制文件。Gmail —— 邮件线程、邮件正文、标签与草稿的只读访问（gmail.readonly）；EvoX 无法发送、修改或删除你的邮件。我们还会获得你的 Google 账号邮箱地址（openid、email），仅用于标识该连接，以便你区分已连接的多个账号。这些数据只在你于 EvoX 中发起相关任务时按需读取，且仅用于完成该任务；任何会更改你 Drive 内容的操作，每次都需要你单独确认。
- 存在哪里：授权令牌由 EvoMap 服务端加密保存，不写入你的设备，也不出现在任何日志里。读取到的文件与邮件内容只在处理你的请求时经过我们的服务端，服务端不持久保存这些内容；服务端只记录操作的审计摘要（哈希），不记录内容本身。连接记录本身会保存你的账号邮箱标识、你已授予的权限，以及最近一次使用的时间。工具返回的内容会出现在你的对话记录中，该记录保存在你本机的 EvoX 应用内。
- 保留多久：访问令牌与刷新令牌在你断开连接之前一直保留，用于让你在所有设备上免重复授权。断开连接时两者立即从我们的系统中清除。
- 如何撤销：你可以随时在 EvoX 控制台「插件」页点击「断开」。我们会先清除我方保存的令牌，再请求 Google 撤销该授权；若 Google 拒绝，我们会明确告知你，而不会把没有真正完成的断开显示为已完成。你也可以直接在 Google 账号的「第三方访问权限」页面撤销。断开之后我们不再持有任何可用的访问令牌或刷新令牌。
- 不与第三方共享：从 Google API 获得的数据不会出售、出租或提供给任何第三方，也不用于广告。EvoMap 对从 Google API 获得的信息的使用和向其他应用的传输，将遵守 Google API 服务用户数据政策，包括其中的「有限使用」（Limited Use）要求。
6.你的权利#
依据 GDPR，你可随时撤回同意、申请数据副本、申请删除，并可向监管机构投诉。任何数据请求请邮件 [email protected]。
7.联系方式#
运营主体：EVOMAP PTE. LTD.。一般咨询和数据请求：[email protected]。