Who we are
Eating in China is provided by ZAOPIN LIMITED. Contact service@zaopincollect.com about privacy, access, correction or deletion of your information. This policy covers the Eating in China app and website.
Accounts and your library
If you sign in, we process your email address, Apple or Google account identifier, sign-in verification data and session tokens to authenticate you. We do not receive your Apple or Google password. We store the profile information you choose to provide, saved and tried items, trips and private experience notes to provide account features and synchronize your devices. Guest library data stays on your device until you choose to copy it to an account.
Comments and safety
When you choose to share a comment or reply, its text and selected public profile information may be shown to other users. We process reports, blocks and internal moderation records to protect the community. Private experience notes and private trip details are not published as comments. Please do not include sensitive personal information in public text.
Historical purchases
Published food-guide content is free. For historical purchases, Apple or Google processes payments and refunds. We retain purchase identifiers, verification results and purchase or refund notifications for support, compatibility and fraud prevention; they do not restrict access to free content. We do not receive your full payment card details. Deleting an Eating in China account does not delete the store's transaction records or automatically refund a purchase.
Website aggregate measurement
Our website measures page views, active foreground reading time, visits, searches and feature usage to improve the guide. Reports group these measurements by date, page, language, device category, broad traffic source and country where available. We do not attach account, visitor or session identifiers to these measurements. A timestamp stored in your browser tab counts activity windows separated by 30 minutes of inactivity; it is not sent to our server. Search terms are filtered to remove common sensitive patterns; do not enter personal information in search. Filtered search aggregates are retained for 30 days; other aggregates for 395 days. Random event receipts used only to prevent duplicate counting expire after 48 hours. To estimate daily unique browsers, our server transiently combines the request IP address and browser user-agent with a secret-derived daily key, and immediately updates a site-wide statistical sketch. It stores neither those inputs nor the resulting browser hash in measurement storage. The sketch has no page or account dimensions and cannot provide browsing histories; shared networks and changing devices can affect estimates. Daily sketches expire after 395 days. Network infrastructure separately processes IP addresses to deliver and protect requests; IP addresses are not stored in the aggregate tables.
Optional Google Analytics
Where Google Analytics 4 is configured, we apply a country-based analytics policy using a trusted network country signal. We ask for opt-in in the EEA, UK, Switzerland, and other countries not yet reviewed, including when the country is unknown. For our current non-advertising analytics configuration, Hong Kong and US visitors can have analytics enabled by default and can turn it off using the footer. An explicit refusal, Global Privacy Control or Do Not Track disables optional analytics regardless of country. Google processes usage and device information and may set analytics cookies. We disable advertising signals and do not send account IDs, private trip details, search text, full referral URLs or URL query strings to Google. You can withdraw consent using the website footer. This stops new optional analytics collection; it does not turn off our separate aggregate measurement. Google Analytics is not enabled while configuration is pending.
Optional app and legacy analytics
Optional app and legacy website analytics is off until you choose to enable it. If enabled, we collect a random installation or browser identifier, session identifier, screen and action events, item identifiers, language, platform, app version and timestamps. On the website, this also includes broad referral and campaign categories and clicks to app stores. We do not store full referral URLs or arbitrary campaign text. These records are not linked to your Eating in China account. We do not include search text, email, comment text or private trip details in analytics. You can turn analytics off at any time; this stops new collection and resets the local analytics identifier. Analytics reports use the most recent 90 UTC dates. Older raw events are excluded from reports immediately and removed by an hourly cleanup job; restricted backups expire separately.
App aggregate measurement
The app sends daily counters for screen views, foreground activity windows and time, public content and region interest, search-result counts and feature use to our service by default. Counters are grouped by day, app version, platform, language and screen. They contain no account, installation or session identifiers, event timestamps, search text, trip names, private notes, comments, photos or precise location. They cannot reconstruct an individual's browsing history. A random delivery receipt is used only to prevent duplicate batches and expires after 48 hours; it is not reused across batches. Aggregates are retained for 395 days. Temporary IP-based request limits protect the endpoint; IP addresses are not written to the aggregate storage. Network infrastructure separately processes addresses to deliver requests. Foreground time is not a guarantee of active reading; visit windows and screen counts are not unique people. We also count active installations once per UTC day and calendar month using period markers stored on the device. Each period has an independent random delivery receipt, retained server-side for 40 days to prevent retry duplicates. No stable installation identifier is sent for these counts, and period receipts are not attached to content events. Resetting app data, reinstalling or restoring a backup can affect these counts.
Optional Google Analytics in the app
Google Analytics for Firebase uses a regional measurement policy. Before a choice, limited measurement may run in supported regions with Analytics storage and all advertising consent types denied; other or unknown regions wait for opt-in. Limited measurement sends basic screen and foreground signals to Google and may involve technical network and device information; it is not a complete count of unique people. The current limited-measurement regions are Hong Kong and the United States. An explicit off choice stops both limited and full Google measurement. With permission, Google receives app-instance identifiers, device and app information, screen and feature events, public content identifiers, language and timestamps to report usage paths, retention and funnels. We do not send account IDs, search text, private trip details, comments or photos. Advertising identifiers, advertising signals and advertising personalization are disabled. You can turn Google measurement off at any time; new Google collection stops and the Analytics app-instance data is reset. Turning this off does not stop separate aggregate measurement. Older app versions may still offer the previous optional first-party analytics system; those records retain their existing 90-day reporting and cleanup policy.
Location and device storage
If you use the current-region feature, the app requests location permission to suggest a region. Precise coordinates are processed through your device and its operating-system geocoding service; they are not sent to our API or stored by us. You can choose a region manually instead. Downloaded guide content and preferences are stored on your device; you can manage downloads or remove local data through the app or device settings.
Service providers and security
Our services use Amazon Web Services for hosting, storage, content delivery, backups and transactional email. Apple and Google provide sign-in and purchase services when you choose them. Network providers receive information such as your IP address to deliver requests. We process limited technical and security records to operate and protect the service. Data may be processed outside your country, including Hong Kong and Singapore. We restrict database access, use encrypted network connections and limit staff access by role. We do not sell personal information, run advertising or use analytics for cross-app advertising tracking.
Retention and deletion
Account data is retained while needed to provide your account. You can delete your account from Me > Settings > Delete account, or request deletion by emailing service@zaopincollect.com. We verify ownership before deleting account data. Deletion removes the active account, profile, synchronized library, private experiences and associated comments and replies. To prevent deleted sessions from being reused, hashed session identifiers remain until their expiry plus 30 days and are removed by subsequent account-deletion housekeeping. Purchase verification and refund records are retained separately to support restoration and prevent reuse of invalid purchases; they currently have no automatic deletion deadline. Operational logs are configured for 14 days. Daily backups expire after 7 days and weekly backups after 28 days; older backup object versions expire separately after 7 days, and storage-provider deletion can take additional time. Retained records are not used to recreate a deleted account during ordinary use. Guest data and downloaded content remaining on your device can be removed locally. Contact us to request review of retained records or assistance.
Changes
We will update this policy when our data practices change. The document version is shown below. If your local law gives you additional data rights, contact us to exercise them.