隐私政策

车载点歌台 · 更新于 2026 年 10 月 28 日

车载点歌台(下称「本 App」)是一个车上的点歌工具:司机的 iPhone 放歌,朋友扫码在网页上点歌。本 App 由个人开发者开发(下称「开发者」)。本 App、点歌台服务器程序和这个网站都没有广告,不做追踪,也不用任何统计、分析或崩溃上报工具。

你的数据存在哪台服务器上

除了直接从 QQ 音乐的服务器放歌、加载封面(见第三方),本 App 只连你设置的那台点歌台服务器。数据存在哪台服务器上,就由谁保管。用邀请码开的车,在 App 的「设置 → 我的车」里能看到它建在哪个地址上。

你的车数据在哪谁保管
用开发者发的邀请码开的车开发者的服务器 39.108.51.5(阿里云,中国大陆)开发者。下面「开发者服务器上存什么」说的就是这种车
用朋友发的邀请码开的车那位朋友自己的服务器那位朋友。服务器程序存的东西和下面一样,日志、备份怎么管由他决定。开发者收不到这些数据
你自己搭的服务器你自己的云服务器你自己。开发者收不到这些数据

自己搭服务器时,安装和以后更新都要从开发者的服务器下载程序。这时开发者的服务器会看到你那台服务器的 IP 地址,只在内存里用来限制下载次数,不写日志。装好以后,你的服务器不会再联系开发者的服务器。安装时还要从别的网站下载运行环境 Node.js 和申请证书用的 certbot,那些网站也会看到你那台服务器的 IP 地址,见第三方。

存在你手机上的

这些里面,只有三样会发给这辆车所在的服务器:播放器链接里的密钥,每个请求都带着,用来证明你是司机;音质设置,取播放链接时带上,服务器用完不存;开车时的请求编号,见下面的「邀请记录」。钥匙串里那个标记和「队列空时保持后台在线」开关不发出去。播放器密钥在服务器上怎么存:用邀请码开的车,服务器上只存它的哈希;服务器主人自己的那辆车(比如你自己搭的服务器上的车)不一样,密钥原样存在服务器上,每次启动还会打进日志(见服务器日志)。

App 用着的时候,还会发给这辆车的服务器:在放哪首(服务器把正在放的那首存进这辆车的文件,放完移进播放历史,见下表);放到哪、暂停没有(这两样服务器只放在内存里,给同车的人显示进度,不写进文件);播放出错的信息(写进日志,见服务器日志);你在 App 里改的车名和车的规矩、导入歌单时贴的链接或歌名,以及调整队列、删歌。车开在开发者的服务器上时,这台服务器就是开发者的。

朋友用的点歌网页

开发者服务器上存什么、存多久

下表是用开发者的邀请码开的车在开发者服务器上存的东西。车本身不会自动删除,不删就一直留着。

数据用途什么时候删除
车名、车的规矩、建车时间、用的哪个邀请码;一个随机的设备编号显示车名,按车的规矩办;设备编号在取播放链接时报给 QQ 音乐(一辆车一个,和手机无关)删除这辆车时
点歌密钥(点歌二维码里的那个);播放器密钥只存哈希认出这辆车的司机和朋友删除这辆车时。之后两把密钥的哈希和这辆车的编号再留 30 天,只用来让旧链接显示「这辆车已经被删掉了」、认出没删干净的文件,以及保证新开的车不会用上同样的编号和密钥
播放队列和正在放的那首。每首歌存歌名、歌手、点歌人的昵称和点歌网页的随机编号、点歌时间排队,显示谁点的歌,让朋友撤回自己点的歌。发给同车的人时,随机编号换成打乱过的点歌人编号放完的歌移进播放历史;删除这辆车时全部删除
这辆车自己的一个随机密钥把点歌人的随机编号打乱成点歌人编号删除这辆车时
播放历史:最近放过的 50 首,内容和队列一样,再加上播放时间点歌页显示最近 10 首;没人点歌时不重复放刚放过的超过 50 首时最早的被挤掉,没有时间上限;删除这辆车时全部删除
每个打开过点歌页的人随机分到的动画角色名(填没填昵称都分),和他点歌网页的随机编号、最近一次打开点歌页或点歌的时间存在一起没填昵称时当作他的名字;同一部手机再扫码,名字不变12 小时没动静以后,下次有人打开点歌页或点歌时让出来(一辆车最多记 200 个,多了先让出最久没来的);删除这辆车时。朋友自己填的昵称跟着点的歌存在队列和播放历史里,不会在 12 小时后删除
导入的兜底歌单:歌单名、歌名、歌手,导入人的昵称和随机编号没人点歌时随机放清除导入、导入新的歌单,或者删除这辆车时
最近有人用这辆车的时间、司机最近用的时间、播放器链接第一次用上的时间司机最近用的时间决定什么时候续期、什么时候自动删除 QQ 音乐登录凭证(以前版本的服务器存的车看最近有人用的时间,见下);最近有人用的时间还让服务器的主人看出哪辆车很久没人用了;播放器链接第一次用上的时间用在 App 开车时没收到回复、重试的时候:用过的车不再重发播放器链接删除这辆车时
司机的 QQ 音乐登录凭证(cookie,里面有 QQ 号和大约两个月有效的续期令牌)。司机扫码登录以后才有用司机自己的账号向 QQ 音乐取播放链接、读歌单、续期登录司机退出 QQ 音乐登录或删除这辆车时马上删除。服务器每小时检查一次:司机连续 60 天没用过这辆车,或者 QQ 授权已经过期,就自动删除
邀请记录:邀请码只存哈希和前 3 个字符,还有开发者写的备注、能用几次、到期时间、用它开了哪几辆车(车的随机编号);App 开车时带的一次性请求编号和开出来的车管理邀请码;开车的回复没收到、App 重试时认出是同一次请求编号 24 小时后删除;整条在邀请码过期或作废 7 天以后删除

「司机用过」只算带播放器链接的请求,来自 App 或网页播放器都算。朋友在点歌页一直在用,不算。例外是以前版本的服务器存的车:那时候只记了最近有人用这辆车的时间(朋友用也算),没单独记司机的,这样的车按这个时间算 60 天。一个时间都没记着的车(文件坏了、没了的):服务器正在运行这辆车时,60 天从这次启动算起;没在运行它时(比如服务器的主人关掉了用邀请码开车),只等 QQ 授权过期。

这些文件万一读坏了(比如磁盘出错),有几种服务器会把坏的那份改个名留着查原因,30 天后自动删除:一辆车的队列和播放历史那份、导入的歌单(服务器运行这辆车、读它们的时候);QQ 音乐登录凭证(服务器有没有在运行这辆车都一样);邀请记录(服务器开着用邀请码开车的时候)。别的不改名:存车名和规矩的那份坏了,这辆车就开不起来,文件原样留着,不会自动删除;删掉的车的记录(密钥的哈希和车的编号)那份坏了,旧链接就显示不了「这辆车已经被删掉了」,服务器开着用邀请码开车时,下次再删一辆车会把这份整个重写(坏的内容就没了),没开时原样留着。

QQ 音乐登录凭证

谁能接触到

服务器日志

第三方

删除你的数据

用邀请码开的车

点歌的朋友

自己搭的服务器

儿童

本 App 不面向 13 岁以下儿童,也不会有意收集儿童的个人信息。

政策变更

这份政策有变化时,会更新这一页,并改上面的日期。

联系

对本政策有疑问,或者想删除数据,请联系:540393671@qq.com

Privacy Policy (English)

Car Jukebox (点歌台) is a jukebox for car rides: the driver's iPhone plays music while passengers request songs from a web page. It is made by an individual developer. The app, the jukebox server software and this website have no ads, no tracking, and no analytics or crash-reporting tools.

Who holds your data. Apart from loading audio and cover art directly from QQ Music (see Third parties), the app only talks to the jukebox server you set up. Whoever runs that server holds the data. Settings → 我的车 shows the server a car was created on.

In the last two cases nothing reaches the developer. Installing or updating your own server downloads the software from the developer's server. That server sees your server's IP address, keeps it in memory only for rate limiting, and does not log it. The installer also downloads Node.js and certbot from other sites, which see that IP address too (see Third parties).

On your phone.

Of these, only three things go to the car's server: the player key with every request, the quality setting with each play-link request (not stored), and the one-time request ID (see invite records below). The Keychain flag and the keep-alive switch stay on the phone. For a car created with an invite, the server stores just a hash of the player key; for the server owner's own car (such as yours on a server you set up), it keeps the key itself and prints it in the log at every start. While in use, the app also sends the car's server what is playing (saved as the car's current song, then in its play history), how far along it is and whether it is paused (these two are kept in memory only), playback errors (logged), and any car name, rules, playlist imports and queue changes you make. For cars created with the developer's invite, that server is the developer's.

Passenger web page.

Stored on the developer's server, per car. Cars are never deleted automatically.

Invite records keep a hash and the first 3 characters of the code, the developer's note, use count, expiry, the IDs of the cars it created, and for 24 hours the app's one-time request ID. A record is removed 7 days after the invite expires or is revoked. Some damaged data files are renamed and kept for 30 days, then deleted: a car's queue and history file and its imported playlist (when the server loads the car), its QQ login credential (whether or not the server runs the car), and the invite records (while invites are on). Others are not renamed: a damaged file with the car's name and rules stops that car from loading and is left as it is; a damaged record of deleted cars stops old links from saying the car was deleted, and while invites are on, the next car deletion rewrites it in full (the damaged content is lost); otherwise it is left as it is. Deleting the credential from the server does not revoke it at Tencent. To revoke it, use QQ → 安全中心 → 授权管理.

Who can access it. People in other cars cannot. People in the same car see the car name, queue, nicknames and requester IDs, never each other's random IDs. The developer, as server administrator, can read every file. Data sits on Alibaba Cloud disks; if disk snapshots are enabled, deleted data remains in them until they expire.

Server logs. There is no access log. The run log contains:

For cars created with an invite, the server does not write credentials, keys, QQ numbers or QQ nicknames to the log. App-reported playback errors are logged as sent; if one happens to contain a QQ number or credential, common forms (cookie and API fields, o0-prefixed QQ numbers) are masked first, but unrecognized forms are not. The server owner's own car differs: its player and join links, keys included, are printed at every start, and the owner's own QQ nickname is logged on QR login. Logs live in the systemd journal with the system's default settings and no set retention period; the oldest entries are dropped when it reaches its size limit. If rsyslog is installed (usual on Ubuntu), the same lines also go to /var/log/syslog, which the system rotates. Per-IP rate-limit counters stay in memory only, stop counting after at most 12 hours and are cleared hourly.

Third parties.

Deleting your data.

Children. The app is not directed to children under 13.

Changes. If this policy changes, this page and the date at the top will be updated.

Contact. 540393671@qq.com