Privacy Policy
InChina Privacy Policy
Last Updated: 2026-06-15 Version: 1.1.0
This Privacy Policy explains what personal data InChina collects, how we use it, with whom we share it, where we store it, and the rights you have over it. It applies to the InChina mobile application and any related services (collectively, the "Service").
By using the Service, you acknowledge that you have read and understood this Privacy Policy.
1. Data Controller
The data controller responsible for your personal data is:
Guizhou Tipshark Technology Co., Ltd (贵州蒂普鲨克科技有限公司) Unified Social Credit Code: 91520115MAEQUL875P Address: Guanshan Lake District, Guiyang, Guizhou, China Privacy contact / Data Protection Officer (DPO): support@inchinatravel.com
2. What We Collect
2.1 Information You Provide
| Category | Examples | Purpose |
|---|---|---|
| Account credentials | Username, password (stored as BCrypt hash; never plaintext), email address | Authentication, password recovery, security notifications |
| Profile | Nickname (optional, editable) | Display name within the app |
| User-submitted travel preferences | Trip dates, destinations, travel style, interests | Generating personalized itineraries |
| User-submitted feedback | Bug reports, suggestions sent via the Feedback page | Improving the Service |
2.2 Information Collected Automatically
| Category | Examples | Purpose |
|---|---|---|
| Device identifiers | Device ID (anonymous), device name, user agent | Account binding, multi-device session management |
| Network metadata | IP address (at sign-in time), approximate network type | Security (rate limiting, anti-abuse), regional CDN routing |
| Time zone | IANA time zone string from your device (e.g., Asia/Shanghai, America/Los_Angeles) | Daily quota reset at your local midnight |
| Session data | Session creation time, last-used time, expiry time | Maintaining sign-in across app launches |
| Usage data | Saved cards, generated itineraries, AI prompt content and results | Service functionality; aggregated, anonymized data may be used for model improvement |
| Diagnostic data | App crash reports, performance metrics (via Sentry) | Reliability monitoring and bug fixing |
2.3 Information Collected with Your Consent (Device Permissions)
The following are collected only after you grant the corresponding iOS permission, and only while you actively use the feature that needs it. You can deny any of these and continue using the rest of the app; you can revoke them at any time in iOS Settings.
| Category | When | Purpose |
|---|---|---|
| Push notification token | Only if you enable push notifications in Settings | Delivering notifications you opted into |
| Microphone audio | Only while you use voice translation or Live Interpret | Capturing speech to transcribe and translate in real time. Audio is streamed for transcription and translation; we do not retain raw recordings after the translation is returned |
| Speech recognition | Only while you use voice translation or Live Interpret | Converting your speech to text so it can be translated |
| Camera images | Only while you use photo / "scan & translate" | Reading text from menus, signs, and documents so it can be translated in place |
| Photo library images you select | Only when you pick an image to translate or attach | Translating text in an image you choose |
| Precise location (GPS) | Only while you use the Map or route-planning features | Showing your position on the map and planning routes from where you are to your next stop. We do not log a continuous location history |
2.4 Information We DO NOT Collect
We do not collect any of the following:
- Contacts and calendar — no permission requested for these
- Background or continuous location — location is read only in-session while you use Map / route planning (see Section 2.3); we do not track you in the background
- Voiceprints or biometric identification — microphone audio is used only to transcribe and translate what you say; we do not build a voiceprint, and we do not perform facial recognition
- Apple IDFA / advertising identifier — we do not use advertising tracking
- Social media accounts — no third-party social sign-in
- Payment information — there are no in-app purchases; in-app AI credits are earned within the app, not bought
2.5 A Note on the Map and Translation Features
The Map / route-planning and Translation features rely on the device permissions described in Section 2.3 (location, microphone, speech recognition, camera, photo library). For each, iOS shows a system permission prompt the first time, the app explains in context why it is needed, and you can deny or later revoke it and keep using every other part of the Service. Translation processing involves a third-party AI provider — see Section 4.
3. How We Use Your Information
We use the information described above for the following purposes:
- Service provision — authenticating you, displaying your saved content, generating itineraries you request;
- Security — detecting and preventing abuse (failed-login lockout, rate limiting, suspicious-activity alerts);
- Communication — sending account-related emails (verification, password reset, security notifications). We do not send marketing emails;
- Improvement — analyzing aggregated, anonymized usage data to improve features and AI model output quality;
- Legal compliance — meeting our obligations under applicable law and responding to lawful requests from public authorities.
We do not sell your personal data, and we do not use your data for behavioral advertising or profiling outside the Service.
4. Third-Party Service Providers
We use the following third-party providers to operate the Service. Each provider is bound by data processing terms requiring it to handle your data only on our instructions:
| Provider | Purpose | Data shared |
|---|---|---|
| Alibaba Cloud (Singapore) | Hosting (ECS, RDS, Redis) | All Service data is stored within Alibaba Cloud's Singapore region |
| Alibaba Cloud Model Studio (DashScope / Qwen) | AI itinerary generation; high-quality translation of text, images, and speech | The content you submit for the relevant feature: trip preferences and prompts for itineraries; the text, selected images, or transcribed speech you ask to translate. This content is sent to generate the result and is not used by the provider to train its models on our instructions |
| Alibaba DirectMail | Sending transactional emails | Email address only |
| Sentry | Crash reporting and performance monitoring | App version, device model, iOS version, crash stack trace; user identifiers may be included for crash correlation (configurable) |
| QWeather | Weather information for itinerary cities | City name only (no user-identifying data) |
On-device translation (Apple). When you choose Apple's built-in translation, processing happens on your device using Apple's frameworks; that text is not sent to our servers or to the AI provider above. Higher-quality translation uses the cloud provider listed above.
We do not share your personal data with any party other than these processors for any purpose other than operating the Service, except where required by law (e.g., binding court order).
5. Where We Store Your Data
All personal data is stored on Alibaba Cloud servers physically located in Singapore. We chose Singapore as our primary data region because:
- It provides low-latency access for our primarily international user base;
- It is recognized as having a robust data-protection regime under the Singapore Personal Data Protection Act (PDPA);
- It serves as a neutral midpoint between users traveling from various regions and our operations team in China.
International Data Transfers
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data will be transferred from your country to Singapore. We rely on the European Commission's Standard Contractual Clauses (SCCs) as the lawful transfer mechanism. A copy of the SCCs is available on request to support@inchinatravel.com.
Our operating company is located in China. To the extent our China-based team accesses your data for operational purposes (such as customer support or troubleshooting), that access constitutes an onward transfer from Singapore to China. We apply equivalent safeguards (technical and organizational measures, role-based access control, audit logs) to such access.
6. How Long We Keep Your Data
| Data category | Retention |
|---|---|
| Active account data | For as long as your account exists |
| Account marked for deletion | 30 days (during which you may cancel deletion), then permanently erased |
| Crash reports (Sentry) | 90 days (default Sentry retention) |
| Server access logs | 30 days |
| Email verification / password-reset tokens | Up to 24 hours (one-time use) |
| Anonymized, aggregated analytics | May be retained indefinitely (no personal data) |
After permanent deletion, residual data may persist in encrypted backups for up to a further 30 days before being cycled out.
7. Your Rights
You have the following rights with respect to your personal data. Many can be exercised directly within the app; others may be requested by emailing support@inchinatravel.com (please include the email address associated with your account).
| Right | How to exercise |
|---|---|
| Access — obtain a copy of your data | Profile → Export Data (JSON download) |
| Correction — fix inaccurate data | Profile → Edit |
| Deletion — erase your account and data | Profile → Delete Account (30-day delayed delete) |
| Portability — receive your data in a structured, machine-readable format | Profile → Export Data |
| Restriction of processing — limit how we process your data | Email DPO |
| Objection — object to processing for legitimate-interest grounds | Email DPO |
| Withdraw consent — for processing based on consent (e.g., push notifications) | Settings → Push toggle |
| Lodge a complaint with your local supervisory authority | EEA users may contact the data protection authority in their country |
Additional Rights for California Residents (CCPA / CPRA)
If you are a California resident, you have additional rights:
- Right to know what categories of personal information we have collected, the purposes, and the categories of third parties with whom we have shared it. We have set this out above in Sections 2 and 4.
- Right to delete — see "Deletion" above.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing — we do not sell or "share" (as defined under CPRA for cross-context behavioral advertising) personal information.
- Right to non-discrimination — exercising any of the above rights will not result in degraded service.
To exercise CCPA rights, email support@inchinatravel.com from the account-registered address.
We Will Not Discriminate
We will not refuse service, charge different prices, or provide a different level of service because you exercise any of the above rights.
8. Children's Privacy
The Service is not intended for and is not directed to children under 16 years of age. We do not knowingly collect personal data from anyone under 16.
If we become aware that a person under 16 has provided us with personal data, we will delete the account and all associated data within 24 hours of becoming aware. If you believe a child under 16 has registered, please contact us at support@inchinatravel.com.
9. Cookies and Tracking
The Service is a native iOS mobile application and does not use HTTP cookies. We do not embed third-party advertising trackers. The diagnostic SDK (Sentry) can be disabled in App Settings, in which case no crash reports will be sent from your device.
10. Security
We implement industry-standard technical and organizational measures to protect your data, including:
- Passwords are hashed using BCrypt with cost factor 12; we never store plaintext passwords;
- Tokens in your device's Apple Keychain (hardware-backed when available);
- Refresh tokens are stored on our servers as SHA-256 hashes;
- In-transit encryption — all client-server communication uses HTTPS / TLS 1.2+;
- At-rest encryption — database storage in Alibaba Cloud is encrypted at rest;
- Account protection — failed-login lockout (5 attempts → 15-minute lock), rate limiting on sensitive endpoints, email and IP-based abuse detection;
- Access control — least-privilege role-based access for our team; full audit logging of any human access to user data.
No system can guarantee absolute security; in the unlikely event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority where required by law.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes:
- We will display an in-app banner notifying you of the change;
- You will be asked to review and acknowledge the updated policy before continuing to use the Service;
- The version number at the top of this document will be incremented.
Non-material changes (typographical fixes, formatting) take effect on the date marked at the top of this document.
12. Contact Us
For any privacy-related question, request, or complaint, please contact:
Data Protection Officer Guizhou Tipshark Technology Co., Ltd Email: support@inchinatravel.com Address: Guanshan Lake District, Guiyang, Guizhou, China
We will respond to verifiable requests within 30 days, or sooner where required by applicable law.
© 2026 Guizhou Tipshark Technology Co., Ltd. All rights reserved.