Privacy Policy
InChina Privacy Policy
Last Updated: 2026-09-12 Version: 2.1.0
This Privacy Policy explains what personal data InChina collects, how we use it, with whom we share it, where we store and process it, and the rights you have over it. It applies to the InChina mobile applications (iOS and Android), our marketing website at inchinatravel.com, and any related services (collectively, the "Service").
By using the Service, you acknowledge that you have read and understood this Privacy Policy.
1. Data Controller
The data controller responsible for your personal data is:
Guizhou Tipshark Technology Co., Ltd (贵州蒂普鲨克科技有限公司) Unified Social Credit Code: 91520115MAEQUL875P Address: Guanshan Lake District, Guiyang, Guizhou, China Privacy contact / Data Protection Officer (DPO): support@inchinatravel.com
2. What We Collect
2.1 Information You Provide
| Category | Examples | Purpose |
|---|---|---|
| Account credentials | Username, password (stored as a BCrypt hash; never plaintext), email address | Authentication, password recovery, security notifications |
| Social sign-in details | If you sign in with Apple or Google: the provider's user identifier, the email address they release to us (which may be an Apple private relay address), and the display name Google returns | Creating and matching your account |
| Profile | Nickname and avatar (optional, editable) | Display name within the app |
| User-submitted travel preferences | Trip dates, destinations, travel style, interests, budget level, free-text notes about the trip | Generating personalized itineraries |
| Conversations with the planner | The messages you send when you describe a trip in your own words, and the reply history in that conversation | Producing and refining the itinerary you asked for |
| User-submitted feedback | Bug reports, suggestions sent via the Feedback page | Improving the Service |
| Service enquiry details | Contact method you choose for a quote (in-app message, email address, Discord or WhatsApp handle), service dates, party size, notes you add to the request | Responding to your request for in-person guide or driver services; records of quotes for price-accuracy review |
| Booking confirmation details | Your real name and phone number, an optional messaging handle, and any note you add | Passing to the Provider so the guide can find you on the day; printed on your booking confirmation |
| Links you paste | TikTok or YouTube links you ask the app to analyse | Extracting places from the video so they can be added to a plan |
Notes and messages are sent to the AI providers listed in Section 4 exactly as you wrote them. We do not strip names, phone numbers, or other details out of them first. Please do not put anything in a free-text field that you would not want a third-party AI provider to process.
2.2 Information Collected Automatically
| Category | Examples | Purpose |
|---|---|---|
| Device identifiers | Device ID (generated by the app, not an advertising identifier), device name, user agent | Account binding, multi-device session management, one-off trial credit grants |
| Network metadata | IP address (at sign-in time and in server logs), approximate network type | Security (rate limiting, anti-abuse), regional routing |
| Region and time zone | The IANA time zone string from your device (e.g. Asia/Shanghai), and the region code of your device's locale, which the app sends with every request | Working out day boundaries for your itinerary, and deriving a country-level location for our own usage statistics. We do not derive a finer-grained location from these |
| Session data | Session creation time, last-used time, expiry time | Maintaining sign-in across app launches |
| Usage data | Saved cards, generated itineraries, AI prompt content and results, screen and feature events tied to your account and device id | Service functionality; product analytics |
| Purchase records | Apple transaction identifiers, product purchased, credits granted, refunds reported by Apple | Delivering what you bought and reversing it if Apple refunds it |
| Diagnostic data | Crash reports, error events, and performance and hang diagnostics collected by iOS and forwarded to our crash reporting provider | Reliability monitoring and bug fixing |
Our product analytics are keyed to your account and device id. They are not anonymous, and we describe them as usage data rather than anonymous statistics.
2.3 Information Collected with Your Consent (Device Permissions)
The following are collected only after you grant the corresponding system permission, and only while you actively use the feature that needs it. You can deny any of these and continue using the rest of the app; you can revoke them at any time in your device settings.
| Category | When | Purpose |
|---|---|---|
| Push notification token | Only if you enable push notifications (iOS only; the Android app does not send push notifications) | Delivering notifications you opted into |
| Microphone audio | Only while you use voice translation or Live Interpret | Capturing speech to transcribe and translate. Audio is streamed to our translation service for transcription; raw recordings are not written to disk or kept after the translation is returned |
| Speech recognition | Only while you use voice translation or Live Interpret | Converting speech to text so it can be translated |
| Camera images | Only while you use photo / "scan & translate" | Reading text from menus, signs, and documents. The photo is downscaled and uploaded to our servers and on to an AI provider for the higher-quality translation option |
| Photo library images you select | Only when you pick an image to translate | Translating text in an image you choose. The same upload applies |
| Saving images to your photo library | Only when you save a translated image | Writing the result back to your library. We do not read your library |
| Precise location (GPS) | Only while you use the Map, route planning, nearby search, weather, or the in-trip companion | Showing your position, planning routes from where you are, and fetching local weather. Your coordinates are sent to our mapping and weather providers (Section 4). We do not log a continuous location history and we do not collect location in the background |
| Calendar (write access) | Only when you add flights, trains, or hotels from an itinerary to your calendar | Creating those events. On iOS we ask for write-only access where the OS supports it. The Android app also holds a calendar read permission for the same feature |
2.3b Information About Service Providers and Guides
When you book an in-person guide or driver service, we hold details about the people who will deliver it: the agency's legal name and licence number, and the guide's name, gender, guide licence number and contact number. We show these to you on your booking confirmation so that on the day you can check the person who turns up is the person who was assigned. We use them for that, and to keep our own record of who delivered which booking. We do not use them for anything else, and we do not sell them or pass them on.
Changes our staff make to these records are written to an internal audit log. Contact details are masked in that log; the licence number is kept, because it is what identifies which record was changed.
2.3c Payment Information
When you pay the online part of an in-person booking, we hold a record of that payment: the amount, the currency, the time, which payment app you told us you used, the reference number shown on your booking, and any note you added when you told us you had paid. If we refund you, we hold the same details for the refund.
We do not receive, and do not store, your card number, wallet identifier, or the account you hold with Alipay or WeChat. Those apps handle the payment itself and tell us only that a payment of a given amount arrived against a given reference.
We use these records to check that a payment has arrived and hold your dates, to settle with the Provider after the service, to issue refunds, and to keep the accounting and tax records the law requires of us. Our staff can see them in an internal workbench; changes they make are written to the audit log described in Section 2.3b.
2.4 Information We Do Not Collect
We do not collect any of the following:
- Apple IDFA / advertising identifier, or any cross-app tracking identifier. We do not use advertising tracking and we do not ask for tracking permission.
- Biometric data, facial recognition, voiceprints. Microphone audio is used only to transcribe and translate what is said. We do not build a voiceprint and we do not run facial recognition.
- Passport, visa, or other identity documents. We do not ask for them and you should not send them to us through the app. The booking confirmation flow asks for a name and phone number, and nothing else about your identity.
- Payment card and wallet details. In-app purchases are handled by Apple. The online part of an in-person booking is paid inside Alipay or WeChat, to our business account; those apps handle your card, and what reaches us is the amount, the time and a reference number. The balance is paid to the Provider on the service day through its own business channel. We never see your card or wallet details, and we do not store them.
- Background or continuous location. Location is read only while you are using a feature that needs it.
- Contacts. We ask for no contacts permission on either platform.
2.5 A Note on the Map and Translation Features
The Map, route planning, and Translation features rely on the device permissions in Section 2.3. For each, the system shows a permission prompt the first time, the app explains in context why it is needed, and you can deny it or later revoke it and keep using every other part of the Service.
Two of these reach third parties directly from your device rather than through our servers: the mapping SDK and the weather provider both receive your coordinates from the app itself. Section 4 says which companies those are.
Translation has two paths. The free option runs on your device using the operating system's own translation and text-recognition frameworks, and that text does not leave the device. The higher-quality option sends the text, image, or transcribed speech to the AI provider in Section 4.
2.6 Information About People Who Are Not Our Users
The Live Interpret feature translates a two-way conversation. To do that it captures whatever the microphone picks up, including the other person's speech, and streams it to our translation service and on to the speech-recognition provider in Section 4. That person is usually not an InChina user and has not agreed to anything.
What happens to that audio: it is held in memory only, split into sentences, transcribed, and discarded. It is not written to disk and not stored in our database. We keep no recording of either side of the conversation.
If you use Live Interpret, tell the other person that their speech is being sent to a translation service before you start. If they object, do not use it.
2.7 Sensitive Details You Choose to Tell Us
The free-text boxes in the in-person service flow invite you to mention things like dietary needs, mobility, and children travelling with you. Some of that is health information, and under the GDPR it falls into a special category with stronger protection.
We ask for it for one reason: the guide needs to know to plan the day. If you fill it in, we pass it to the Provider along with the rest of your request, and we keep it as part of the enquiry record.
These boxes are optional. You can leave them empty, or describe only what you are comfortable sharing, and tell the guide the rest in person. Where we process this information we do so on the basis of your explicit consent, given by choosing to type it in, and you can withdraw that consent by asking us to remove it.
3. How We Use Your Information
We use the information described above for the following purposes:
- Service provision: authenticating you, displaying your saved content, generating itineraries and translations you request, passing your enquiry to a Provider;
- Security: detecting and preventing abuse (failed-login lockout, rate limiting, referral anti-abuse checks);
- Communication: sending account-related emails (verification, password reset, security notifications) and service emails (quotes, booking confirmations, cancellations). We do not send marketing emails to users;
- Improvement: analysing usage data to improve features and AI output quality;
- Payments: taking the online part of a booking, checking it has arrived, refunding it where the cancellation policy says so, and settling with the Provider after the service;
- Business records: keeping a record of the quotes we gave and the bookings that resulted, which we also use to check how accurate our price estimates were;
- Legal compliance: meeting our obligations under applicable law and responding to lawful requests from public authorities.
We do not sell your personal data, and we do not use your data for behavioural advertising or profiling outside the Service.
4. Third-Party Service Providers
Running the Service depends on the providers below. Each is bound by terms requiring it to handle data only for the purpose it is given. The Location column is where the service that receives the data is operated, which is what matters for cross-border transfers (Section 5).
4.1 AI models
Your itinerary prompts, the notes you write, your planner conversation, and text or images you ask to translate are sent to these providers to produce the result.
| Provider | Location | What it does | What reaches it |
|---|---|---|---|
| DeepSeek | Mainland China | Primary itinerary generation model | Trip preferences, your free-text notes as written, selected cards, dates, party size, budget |
| Alibaba Cloud Model Studio (DashScope / Qwen) | Mainland China (Beijing endpoint) | Text and image translation, speech recognition for Live Interpret, video understanding, route-map generation | Text to translate, the uploaded photo, streamed conversation audio, video frames, itinerary stops |
| Alibaba Cloud Model Studio (international) | Singapore | The conversational planner ("describe your trip") | Your description and the full conversation history |
| Zhipu AI (GLM) | Mainland China | Fallback itinerary model | As DeepSeek, when the primary model is unavailable |
| MiniMax | Mainland China | Fallback itinerary model | As DeepSeek, when the primary model is unavailable |
| Tavily | Not verified by us | Web search used by the itinerary agent | Search terms the model composes from your request |
Which fallback model handles a given request depends on availability at that moment. We do not send your account identity or email address to any of them.
4.2 Maps, travel data, and weather
| Provider | Location | What it does | What reaches it |
|---|---|---|---|
| AMap (Gaode) | Mainland China | Map rendering, nearby places, reverse geocoding, routing, place verification | Your precise coordinates (sent from the app directly), place keywords, city names, start and end points |
| QWeather | China | Weather for your location and for itinerary cities | Your precise coordinates, sent from the app directly |
| China Railway 12306 (via an open-source connector) | Mainland China | Train times, fares, and calling points | City names, dates, train numbers |
| VariFlight | Mainland China | Flight status | Flight numbers and dates |
| DiDi | Mainland China | Hand-off to the ride-hailing app | Pick-up and drop-off coordinates and place names, passed in the link when you tap to open DiDi |
| Frankfurter | Not verified by us | Currency conversion rates | Currency codes only; no personal data |
4.3 Content and media
| Provider | Location | What it does | What reaches it |
|---|---|---|---|
| TikHub | Not verified | Metadata for TikTok and YouTube links | The video identifier derived from the link you paste |
| TikTok CDN | Global edge | Fetching video files for analysis | Outbound requests only; no personal data |
A third-party token provider (bgutil-ytdlp-pot-provider) | Runs on our own servers | Obtaining a token needed to fetch YouTube media | Video identifiers |
4.4 Infrastructure and delivery
| Provider | Location | What it does | What reaches it |
|---|---|---|---|
| Alibaba Cloud ECS / RDS / Redis | Singapore | Hosting, database, cache | All Service data at rest |
| Alibaba Cloud OSS | Singapore | Object storage: images, video, route maps, database backups | Media files and backups |
| Alibaba Cloud CDN / ESA | Edge nodes worldwide | Delivering the API and media | All API and media traffic, including visitor IP addresses at the edge |
| Alibaba Cloud DirectMail | China-site endpoint | Sending email | Your email address and the body of the message, which for service email includes trip dates, the Provider's name, prices, and the cancellation policy in full |
4.5 Apple, Google, and diagnostics
| Provider | Location | What it does | What reaches it |
|---|---|---|---|
| Apple Push Notification service | Apple infrastructure | Delivering iOS notifications | Device push token, notification title and body (which may name your trip) |
| Apple App Store Server API | Apple infrastructure | Verifying in-app purchases and refunds | Transaction receipts and identifiers |
| Sign in with Apple | Apple infrastructure | Social sign-in | We verify Apple's token and read the user identifier and email claims from it |
| Google Sign-In | Google infrastructure | Social sign-in | Your device talks to Google directly to sign you in; we then read the user identifier, email, and name |
| Sentry | United States | Crash and error reporting, and iOS performance diagnostics | Crash stack traces, error events, breadcrumbs, and the diagnostic payloads iOS produces for hangs and high CPU. iOS only: the Android app does not currently send crash reports |
| On-device frameworks (Apple Translation, Apple Vision, Google ML Kit) | Your device | Free-tier translation and text recognition | Nothing leaves your device |
We do not share your personal data with any party other than these providers for any purpose other than operating the Service, except where required by law (for example, a binding court order).
5. Where Your Data Is Stored, and Where It Is Processed
These are two different questions and the answers are different. Earlier versions of this policy only answered the first one.
5.1 Storage
All personal data is stored on Alibaba Cloud infrastructure physically located in Singapore: the application servers, the database, the cache, and the object storage that holds media and backups. We chose Singapore for low-latency access for an international user base and for the protections of the Singapore Personal Data Protection Act.
5.2 Processing
Delivering the Service routinely sends parts of your data outside Singapore, to providers in mainland China and the United States, as set out in Section 4:
- To mainland China. Itinerary prompts and your free-text notes go to the AI models that generate the plan. Text, photos, and Live Interpret audio go to the translation and speech provider. Your coordinates go to the mapping and weather providers, sent from your device rather than from our servers. Train, flight, and ride-hailing lookups go to Chinese travel data providers.
- To the United States. Crash reports and iOS performance diagnostics go to our crash reporting provider, which runs in a US region.
- To providers whose operating location we have not confirmed. Search terms composed by the itinerary agent, currency lookups, and metadata lookups for video links you paste. Section 4 marks these as not verified rather than guessing.
- Through global edge nodes. API and media traffic passes through a content delivery network with points of presence worldwide, which sees the IP address of the request.
We use the Beijing endpoint of our translation provider rather than its Singapore endpoint. That is a deliberate engineering choice made for latency and model availability, not an accident.
Our operating company is in China, and our staff there access user data for support, operations, and troubleshooting.
5.3 Transfer mechanism
If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal data leaves your country for the destinations above.
For transfers to our own infrastructure and to our operating company, we rely on the European Commission's Standard Contractual Clauses, supported by role-based access control and audit logging. We are in the process of documenting the equivalent arrangements with each AI and travel-data provider listed in Section 4; that work is not complete. If the transfer basis for a specific provider matters to you, write to support@inchinatravel.com and we will tell you where it stands rather than assert something we have not finished.
If you would rather not have your content processed in mainland China, you can still use the app's on-device translation and browse content, but you should not use itinerary generation, cloud translation, Live Interpret, or the map.
6. How Long We Keep Your Data
| Data category | Retention |
|---|---|
| Active account data | For as long as your account exists |
| Account marked for deletion | Held 30 days so you can cancel. Then the account is deactivated, its Apple/Google sign-in identities are deleted, and its sessions are revoked. The account record itself and the records below are retained (Section 4.5 of the Terms explains how to ask us to redact the account record) |
| Itineraries, saved cards, planner conversations, credit transactions, messages, feedback | Kept while the account record exists. They are not deleted by an account deletion request |
| Service enquiries, quotes, and booking confirmations | Kept as a business record with no fixed end date. They are the record of what was quoted, what was agreed, and who delivered it, and we use them to check how accurate our estimates are |
| Payment and refund records for bookings | Kept as an accounting record for as long as tax law requires, which is longer than the account itself |
| Product analytics events | Kept indefinitely at present. They carry your account and device id, so they are not anonymous |
| Admin audit log | Kept indefinitely. Contact details in it are masked |
| Sign-in and password-change records | Kept for 180 days and archived in the same batch as the admin audit log. We record successful and failed sign-ins, account lockouts, sign-outs, and password changes, in order to investigate account takeover and identify credential-stuffing attempts. These records contain the username or email address you submit when signing in, your IP address, and the client type |
| Crash and performance reports | Held by our crash reporting provider under the retention set on our account there |
| Server and container logs | Held on our servers. There is no automatic deletion schedule in place today; we are introducing a fixed rotation limit and will state the period here once it is in force |
| Database and cache backups | Uploaded to object storage in Singapore. Local copies are removed after 7 days. The stored copies are not yet on an automatic deletion schedule; the same work covers this |
| Email verification codes | Usable for 24 hours |
| Password reset codes | Usable for 15 minutes |
Where the law requires us to keep something longer (tax records, security incident records), we keep it for that period.
7. Your Rights
You have the following rights over your personal data. Some can be exercised in the app; the rest by emailing support@inchinatravel.com from the address on your account.
| Right | How to exercise |
|---|---|
| Access: obtain a copy of your data | Profile → Export Data gives you your account details and active sessions as JSON. For everything else we hold, email us and we will compile it |
| Portability: receive your data in a structured, machine-readable format | Email us. The in-app export does not yet cover itineraries, saved cards, or enquiries, so we produce the full set by hand |
| Correction: fix inaccurate data | Profile → Edit, or email us |
| Deletion: erase your account and data | Profile → Delete Account starts the 30-day process in Section 6. To have the personal details on the account record redacted as well, email us and ask |
| Restriction of processing: limit how we process your data | Email the DPO |
| Objection: object to processing based on legitimate interests | Email the DPO |
| Withdraw consent: for processing based on consent (push notifications, device permissions, the optional details in Section 2.7) | Turn off the permission in your device settings, the push toggle in Settings, or email us to remove details you have already given |
| Lodge a complaint with your local supervisory authority | EEA users may contact the data protection authority in their country |
Additional Rights for California Residents (CCPA / CPRA)
If you are a California resident, you have additional rights:
- Right to know what categories of personal information we have collected, the purposes, and the categories of third parties with whom we have shared it. Sections 2 and 4 set this out.
- Right to delete: see "Deletion" above.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing: we do not sell or "share" (as CPRA defines it for cross-context behavioural advertising) personal information.
- Right to non-discrimination: exercising any of these rights will not result in degraded service.
To exercise CCPA rights, email support@inchinatravel.com from the account-registered address.
We Will Not Discriminate
We will not refuse service, charge different prices, or provide a different level of service because you exercise any of the above rights.
8. Children's Privacy
The Service is not intended for and is not directed to children under 16 years of age. We do not knowingly collect personal data from anyone under 16.
We do not ask for your date of birth, so we cannot verify age at sign-up. If we become aware that a person under 16 has provided us with personal data, we will close the account and redact the personal details held against it without undue delay. If you believe a child under 16 has registered, contact us at support@inchinatravel.com.
9. Cookies and Tracking
In the apps
The iOS and Android apps do not use HTTP cookies and do not embed third-party advertising trackers. Sign-in tokens are held in the platform's secure store: the Apple Keychain on iOS, encrypted shared preferences on Android. Some preferences are kept in local app storage on your device.
Crash and diagnostic reporting on iOS starts with the app and cannot currently be turned off in the app's settings. An earlier version of this policy said it could; that was wrong.
On the website
inchinatravel.com uses first-party, anonymous page-view counting. There are no third-party analytics services, no advertising trackers, and no third-party scripts of any kind.
The site does store small amounts of data in your browser:
- a cookie recording your language choice, set when you switch language;
- local storage entries for your theme choice, whether you have dismissed the cookie banner and the announcement bar, and a beta-tester flag;
- a temporary session storage identifier used to avoid double-counting a page view within a visit.
For each page view we record the page, referrer, and a country-level location. The country is derived from your IP address and from your browser's timezone and language. We do not store your raw IP address.
The cookie banner tells you the site uses essential cookies and anonymous analytics. Note that dismissing it does not currently switch the page-view counting off; the counting runs either way, and is limited to what is described above.
10. Security
We implement technical and organizational measures to protect your data, including:
- Passwords are hashed with BCrypt at cost factor 12; we never store plaintext passwords;
- Tokens are held in the platform secure store on your device (Apple Keychain on iOS, encrypted shared preferences on Android);
- Refresh tokens are stored on our servers as SHA-256 hashes;
- In-transit encryption: all client-server communication uses HTTPS / TLS 1.2+;
- Account protection: failed-login lockout (5 attempts, then a 15-minute lock), rate limiting on sensitive endpoints, and abuse detection on email and IP;
- Access control: least-privilege, role-based access for our team.
Staff access is logged. Every change our staff make through the admin console is recorded, and so is reading your data: opening your account record, listing or opening your itineraries, viewing your activity summary, and exporting your data each write an entry naming the staff account, the record touched, and the time. Direct database access by an engineer during an incident is outside that log and is controlled by server access restrictions instead.
No system can guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant supervisory authority where the law requires it.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we publish the revised text in the app under Profile → Legal and on inchinatravel.com, and we change the version number and date at the top of this document.
For a material change, meaning a new category of data, a new provider that receives your data, or a change to your rights, we will also post a notice in the app's message centre.
There is no click-through re-acceptance step. Continuing to use the Service on or after the effective date means you accept the revised policy. If you do not accept it, stop using the Service; you can delete your account as described in Section 6.
12. Contact Us
For any privacy-related question, request, or complaint, please contact:
Data Protection Officer Guizhou Tipshark Technology Co., Ltd Email: support@inchinatravel.com Address: Guanshan Lake District, Guiyang, Guizhou, China
We will respond to verifiable requests within 30 days, or sooner where required by applicable law.
© 2026 Guizhou Tipshark Technology Co., Ltd. All rights reserved.