Privacy Policy
This policy describes what the Explore China Like a Local iOS app collects, why, and what your choices are. The short version: the app works without an account, processes screenshots and menus on your device before anything is analysed, never collects passport numbers, payment credentials, or continuous background location, and deletes your personal data when you delete your account.
1. Who we are
Explore China Like a Local is a travel guide for international visitors in mainland China, operated by the same team behind 上岸计划 (https://changshoujiaolian.cn). For questions about this policy or your data, contact us at 1021891593@qq.com.
Regulatory note: hosting jurisdiction, cross-border transfer mechanisms, and the applicability of data-protection regimes (including PIPL where relevant) are under review with counsel. This policy will be updated when those decisions are final. Nothing in this policy is legal advice.
2. What we collect
| Category | Data | Where it lives | Kept until |
|---|---|---|---|
| Travel profile | Passport country, travel dates, cities, preferences, dietary and accessibility needs, walking level | On your device; on our servers only if you sign in | Account deletion |
| Identity | Apple user identifier, email address (only if you grant it at Sign in with Apple) | Our servers | Account deletion |
| Session | Access and refresh tokens | Device Keychain only | Short-lived, rotating |
| Saved items & trips | Place IDs, trip titles, dates, itinerary references | On your device; on our servers if you sign in and sync | Deletion |
| Travel wallet documents | Ticket images/PDFs, hotel details, booking references you add | Device only, encrypted with a per-device Keychain key — never uploaded | You control deletion |
| Screenshot / menu help | Photo you import for OCR; redacted text only sent for analysis | OCR and redaction happen on-device; redacted text retained 30 days server-side | 30 days (redacted text); local copy until you delete it |
| AI analyses | Prompt, redacted context, response | Our servers | 30 days |
| Location | Coarse location, only when you open the map or use GPS audio you start | Device, session only | End of session; never background-tracked |
| Diagnostics | Allow-listed usage events (no free text), crash stack traces, performance data — no user content | Analytics / crash backend | Events 12 months; crashes 90 days |
3. What we never collect
Passport numbers, ID numbers, payment credentials, bank card data, passwords for third-party apps (Alipay, WeChat, Meituan, 12306), precise continuous location history, contacts, or any photo you did not explicitly import.
4. How we use data
- App functionality: show verified entry guidance, places, prices, tutorials, itineraries, and offline packs; sync your saved items when signed in.
- Account: Sign in with Apple verifies your identity and restores your Travel Pass entitlement.
- Analytics and diagnostics: closed-vocabulary, allow-listed events only (screens viewed, flows completed). Free-text content — what you typed, OCR output, documents, itineraries — is structurally excluded and additionally filtered.
We do not sell personal data. We do not use data for advertising or cross-app tracking. The app contains no third-party advertising SDK.
5. Sharing
- AI provider: redacted prompt context only (DeepSeek; region of inference under review). Never raw screenshots, passport data, payment data, or full itinerary text.
- App Store (Apple): purchase receipts are validated server-side against the App Store Server API to confirm your Travel Pass.
- Map handoff: only when you tap “open in map” — the app hands a place name to the map app you choose.
6. Your choices
- Guest mode: browse places, tutorials, and local packs with no account.
- Location: WhenInUse only, requested at the point of use. The app works fully without granting it. Background location is never used.
- Analytics: an in-app toggle disables local telemetry collection.
- Account deletion: in the app under Me → Settings → Account → Delete account. This calls
DELETE /users/meand removes your account and personal data within 30 days. Signing out clears the local session immediately. - Access / export: contact us via the support page for a copy of your data.
7. Children
The app is rated 4+. It contains no public user-generated content, chat, comments, or follower features — only curated editorial stories. We do not knowingly collect data from children under 13 beyond what this policy describes for all users; parents may request deletion via the support page.
8. Security
TLS 1.2+ with HSTS on the API edge; AES-GCM encrypted travel wallet with per-device Keychain keys and completeUnlessOpen file protection; server-side redaction re-run on screenshot payloads; per-user AI quotas and request-size caps. No security measure is perfect — report suspected issues via the support page.
9. Retention summary
AI prompts and redacted screenshot text: 30 days. Crash reports: 90 days. Analytics events: 12 months. Account and synced personal data: until you delete your account (processed within 30 days). Wallet documents: device only, deleted when you delete them or the app.
10. Changes
We will update this page when hosting, AI-provider, or data-flow decisions are finalised with counsel, and note the revision date at the top. Material changes will also be announced in-app.