ChinaBuddyPrivacy Notice
Effective date: 2026-10-23
1. Who is responsible
ChinaBuddy Dev Team, based in Shanghai, China, operates ChinaBuddy and is responsible for the personal information described in this notice. Our team is based in Shanghai, China. For privacy questions or requests, contact support@service.chinabuddy.ai.
This notice covers our website, iOS and Android apps, and travel assistant. Our Terms of Use explain service rules, purchases, recommendations and affiliate income.
2. Information we process
- Accounts and sign-in: email addresses, connected sign-in identifiers, relevant profile details, sessions, IP addresses and browser or device information. Passkeys provide public-key credentials; we do not receive your fingerprint, face image or device PIN. Google or Apple sign-in does not give us access to your inbox.
- Your journey: messages, uploaded photos, places you provide or select, travel dates, preferences, plans, memories, reminders, assistant responses and saved materials. Guest travel content is also stored on our servers. Only share information you are entitled to provide. Avoid passwords, payment codes, full identity documents and unnecessary health or companion details.
- Purchases and contact: order references, payment status, amounts, refunds and messages you send to support. Payment providers collect payment credentials through their checkout; our application does not collect full card numbers or card security codes. If you join a product waitlist, we keep your email, selected language and sign-up time.
- Optional notifications: if you enable trip notifications, we process a device push token, an installation reference, language, platform and the account/session binding needed to deliver reminders. Notification previews contain a general reminder rather than your private trip details.
- Technical and usage information: request times, network and device information, approximate country, errors, service performance and limited feature and transaction events. Booking links may also involve the referral information described below.
3. How we use information
We use information to provide travel assistance, maintain accounts and trips across visits and devices, remember useful trip details, process purchases, respond to requests, send requested product updates, prevent abuse, troubleshoot failures and understand service quality. Limited referral information may support commission attribution and reconciliation.
Where a legal basis is required, requested account and travel functions are processed to perform our service contract; required financial and compliance records to meet legal obligations; and proportionate security, administration and permitted service measurement for our legitimate interests. Processing that requires consent relies on consent, with additional conditions where sensitive information is involved. Required information is necessary for the relevant feature.
4. AI processing and trip memory
To answer you, we send relevant conversation history, trip context and, when needed, the photo you submit to our AI provider. Account email is not a default field in the model's travel context, but personal information you include in a message or photo may be processed with that request. Conversations and trip records are stored so you can continue your journey.
Buddy may save reusable trip details as memories. In My trips, you can review, correct or forget them. Forgetting removes the saved memory and its revisions and limits future recall from old context. It does not delete the original conversation or information already included in other saved material. Deleting the trip has a broader effect, described below.
Automatic memory tools restrict health information, login credentials and full identity numbers. This does not mean those details are removed from messages or photos you send, or that every manual entry is automatically filtered.
ChinaBuddy does not currently use customer content to train or fine-tune its own models. Before introducing that use, we will explain the content involved, purposes, retention and choices, and obtain consent where required. Trip memory and product analytics are separate from model training.
Our AI provider's processing is separate from ChinaBuddy's own training practices. We currently use the DeepSeek API. Its applicable terms and agreements govern provider retention, safety review and any model-improvement use. We do not promise provider zero retention or a prohibition on training without a corresponding agreement. See DeepSeek's Privacy Policy.
5. Service providers and disclosures
We use the following providers according to the features enabled and used:
| Provider or feature | Information and purpose |
|---|---|
| Cloudflare | Website and API delivery, private storage, security, image processing and knowledge retrieval. This can include network information and content stored or processed for the service. |
| DeepSeek API | Relevant messages, trip context and photos needed to generate a response. |
| Cloudflare Email Sending or Resend | The configured email provider receives the recipient address and verification email, not travel conversations. |
| Google Analytics | Limited product events, analytics identifiers, device/network information and verified transaction amounts, when analytics is enabled. |
| Firebase Crashlytics | Optional app crash diagnostics, including device/app information, sanitised errors and crash stacks; no chat or photo content is attached by our diagnostic code. |
| Apple Push Notification service or Firebase Cloud Messaging | Device push tokens and limited delivery data for optional trip reminders. |
| Apple App Store or Google Play | App purchase and refund verification, product and transaction references. The store handles payment credentials. |
| Google or Apple sign-in | Authentication information needed to sign in or explicitly link an account, if you choose that method. |
| Amap, DiDi or Geoapify | Relevant place names, coordinates and route conditions for supported location, map or transport features. Loading a map may also send browser and network information to its provider. |
| Wendao/Ctrip or Viator | Relevant destination, date, party and product search conditions for supported travel searches. An ordinary search does not require the full conversation. |
| Stripe or Creem | Checkout and payment information for the selected payment channel, and references needed to verify purchases, refunds and disputes. |
We do not make your trips public or provide conversations or photos to booking partners for advertising or commission attribution. Authorised personnel may access necessary information for support, safety or service operations. We may disclose relevant information to meet lawful requirements, protect people or the service, or establish or defend legal claims.
6. Booking links and affiliate attribution
Some booking links may generate a commission, as explained in our Terms. Links may include publisher or campaign identifiers and relevant product or search information. We do not put your chat text, photos, account email or payment credentials in affiliate-tracking identifiers.
Following a link sends a request from your browser to the supplier. That site may use cookies or similar technologies under its own privacy notice and choices. ChinaBuddy does not control its processing or automatically set your choices there.
An active partner programme may make limited referral or settlement reports available to us, such as a referral reference, transaction status, value and commission. These are used for attribution, reconciliation and required records, not to obtain your full travel conversation.
7. Product analytics and device storage
When enabled, Google Analytics helps us understand feature use, service quality and purchase conversion. Events may include pseudonymous analytics identifiers, times, device information, page categories, public guide paths, approved campaign/source categories, public product identifiers, opaque transaction references, errors and verified purchase amounts. Pseudonymous information is not necessarily anonymous.
We may associate limited browser or app analytics identifiers with a purchase for up to 90 days so that verified purchases and refunds can be measured after you leave the page or app. We do not send account identifiers or email addresses to Google Analytics. This temporary association is kept in a server-side cache, and expires automatically.
We do not send chat text, photos, detailed itineraries, precise locations or account email addresses to Google Analytics. We disable Google Signals and advertising personalisation and do not use session recording. Technical diagnostics, security records and financial records serve separate operational purposes.
In the app, Firebase Analytics uses app instance and session identifiers, and screen categories replace private page paths. Privacy → Privacy & diagnostics lets you independently turn usage analytics and crash reporting on or off. Disabling collection does not erase events already received by a provider. Advertising identifiers and personalised advertising are disabled in our app configuration.
Essential cookies and browser storage support sign-in, guest access, security, language and display preferences. Your browser may also hold drafts, reading positions and materials saved for offline use. Google Analytics may store analytics identifiers in browser cookies. Blocking or clearing site storage can affect sign-in, guest access and device copies; browser settings and extensions may also restrict analytics.
The app stores sign-in credentials in the operating system’s secure storage and private device copies in its sandbox. It requests camera or photo access when you choose the corresponding feature. You can manage permissions in your device settings, clear downloaded materials in the app, and turn trip notifications off. A system permission decision does not itself create a paid purchase or enable analytics.
8. Retention and deletion
| Information | How long it remains available |
|---|---|
| Guest access and unclaimed trips | Guest credentials expire 30 days after the guest session is created. Access stops at expiry and background cleanup deletes the associated travel content. This is not extended by continued guest activity. Trips transferred to a signed-in account are not subject to that guest deadline. |
| Signed-in account and trip records | Kept to provide ongoing service until you delete a trip or request account/data deletion, subject to necessary legal, security and financial records. A trip ending or a paid pack expiring does not itself delete its history. |
| Server photos | Access expires no later than 24 hours after first upload. Uploads not attached to a request expire after one hour. Expired files are deleted through background cleanup. Text extracted from a photo has the lifetime of the conversation, memory or saved item containing it. |
| Browser and app photo cache | Photos sent or viewed on that device may be cached for up to 30 days from initial caching, within a 50 MB limit; the app also limits its cache to 200 photos. Viewing does not renew the deadline. Natural server expiry does not clear this cache; explicit photo/trip deletion clears corresponding copies when the device syncs. |
| Photo metadata | Retained for up to 30 days after server expiry or removal to support deletion synchronisation; this does not extend access to the server image. |
| Temporary trip exports | Download access expires after one hour and background cleanup removes the file. Exports include photo metadata, not original photo files. |
| Other device copies | Unsent draft recovery lasts up to seven days. Deliberately saved offline materials have no fixed automatic expiry; you can remove them, and the browser or operating system may evict them. Signing out or changing identity clears the app's private device copies where device storage is accessible. |
| Analytics identifiers and events | Our analytics cookies are configured to last up to 180 days without renewal on each visit. Browser restrictions may shorten cookie availability. |
| Push registrations and delivery state | Device registration expires after 35 days without renewal. Turning off notifications or revoking its session disables delivery and clears the token; expired registrations are removed in background cleanup. Delivery state is kept while the corresponding reminder remains valid to prevent duplicate sends, then cleaned after a seven-day retention window. |
| Other necessary records | Purchase, cost, fraud-prevention, support, waitlist, operational and deletion records follow their separate purposes and applicable obligations. |
Guest cleanup may retain limited pseudonymous usage and security references to prevent abuse and trial resets. A 30-day guest deadline is not a promise that every financial, security or diagnostic record disappears after 30 days.
Deleting a trip blocks further access and removes its conversations, messages, memories, plans, reminders and related records. Associated files and task storage are cleaned in the background, with retries where needed. Necessary account, purchase, cost and deletion records may remain. Trip deletion does not delete your account or issue a refund.
Forgetting a memory, deleting a photo and signing out have narrower effects than deleting a trip. We cannot remotely erase files you downloaded or shared, or immediately erase a device that stays offline. Expired cached data is removed when the app next accesses or cleans its storage; browser or app storage can also be cleared directly. Provider-held information and backups follow their applicable retention and deletion arrangements.
9. International processing and security
Our team works from Shanghai, China, and authorised personnel in China may access necessary information for operations or support. DeepSeek processes information in China, and Cloudflare and other providers may process information in other countries.
We use encrypted network connections, access controls and private storage to protect information. No system guarantees absolute security. Please avoid sending information that is unnecessary for your travel request.
10. Your choices and rights
In My trips, you can manage memories, export trip data and delete a trip. A trip export is not a full account data export. For account deletion, access or correction requests, waitlist removal or other privacy questions, contact support@service.chinabuddy.ai. There is currently no full account-deletion button.
We may need proportionate information to verify that a request relates to you. Do not send passwords, one-time sign-in codes or full identity documents to support. We respond within applicable legal time limits and explain any lawful exceptions or records we must retain.
Depending on applicable law, you may have rights to access, correct, delete or receive a portable copy of information, restrict or object to processing, withdraw consent where it is the basis for processing, or complain to a relevant data protection authority. Accepting our Terms is not blanket consent to every data use.
11. Children and changes
ChinaBuddy is intended for people aged 18 or over. Adults planning family travel should avoid unnecessary identifying information about children. Contact us if a child's information has been provided without appropriate authority.
We update the effective date when our practices change, provide notice of material changes and obtain consent where required before beginning affected processing.