Privacy Policy

Effective date: [Effective Date] · Last updated: [Last Updated Date]

This policy explains what personal data [Company Legal Name] Limited (“we”, “us”) collects when you use the [App Name] mobile app and related services (the “Service”), why we collect it, who we share it with, and the choices and rights you have.

In short: we collect only what we need to run a messaging app. We do not show ads, we do not track you across other apps or websites, and we do not sell or share your personal data for advertising.

1. Who we are (data user / controller)

[Company Legal Name] Limited is a company incorporated in Hong Kong, with its registered address at [Company Address]. We are the “data user” under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) and the “controller” under the EU and UK General Data Protection Regulation (“GDPR”).

Contact for privacy questions and requests: [support@yourdomain.com].

Data Protection Officer / privacy contact: [DPO Name or “Privacy Team”], [support@yourdomain.com].

EU representative (GDPR Art. 27): [EU Representative Name and Address, if appointed]. UK representative: [UK Representative Name and Address, if appointed].

2. Personal data we collect

Device permissions. The app asks for the camera (take photos and videos, scan friend QR codes), photo library (pick images and videos to send) and microphone (record voice messages and video sound). We access these only when you use the related feature. You can turn them off at any time in your device settings.

What we do not collect. We do not collect your precise location, your address book (unless you choose to share a contact), advertising identifiers, or browsing history. We do not use your data for tracking as defined by Apple’s App Tracking Transparency framework.

Is providing data required? A phone number or email address and a password are required to create an account. Without them we cannot provide the Service. Everything else (avatar, media, contacts, etc.) is optional and depends on how you use the app.

3. How we use personal data

• To provide the Service: accounts, messaging, media, groups, friends, red packets and notifications.
• To keep the Service safe: detect spam, fraud and abuse; review reports; enforce our Terms; and comply with law.
• To maintain and improve the Service: fix crashes, measure performance and plan capacity.
• To communicate with you: service notices, security alerts and replies to support requests. We do not send marketing messages unless you agree.

We do not use the content of your messages for advertising or to build advertising profiles. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

4. Legal bases (GDPR / UK GDPR)

• Performance of a contract (Art. 6(1)(b)): running your account, delivering messages and media, red packets, notifications.
• Legitimate interests (Art. 6(1)(f)): security, fraud and abuse prevention, moderation of reported content, crash reporting and service improvement. We balance these interests against your rights; you can object (see section 9).
• Legal obligation (Art. 6(1)(c)): keeping records required by law, responding to lawful requests.
• Consent (Art. 6(1)(a)): device permissions and any optional feature that asks for consent. You can withdraw consent at any time; this does not affect earlier processing.

5. Who we share data with

We do not sell personal data. We share it only with service providers who process it on our behalf under written contracts, with the people you choose to communicate with, and where the law requires.

Push notifications may contain a sender name and a message preview. You can turn off previews or notifications in the app or your device settings.

6. Where your data is stored and international transfers

Our servers and media storage are located in Singapore (Alibaba Cloud International). If you use the Service from Hong Kong, the EU/EEA, the UK or elsewhere, your personal data will be transferred to, stored and processed in Singapore, and in the other countries where our service providers operate (for example, the United States for push notifications).

• Hong Kong (PDPO): we transfer personal data outside Hong Kong only for the purposes in this policy, and we require our providers by contract to protect it to a standard comparable to the PDPO, taking into account the Privacy Commissioner’s guidance and recommended model contractual clauses.
• EU/EEA and UK (GDPR): Singapore and the other destination countries may not have an adequacy decision. Where required, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or the provider’s certification under the EU-U.S. Data Privacy Framework, plus additional safeguards such as encryption in transit. You can ask us for a copy of the relevant safeguards.

7. How long we keep data

Backups are overwritten on a rolling basis within [Backup Rotation Period, e.g. 35 days]. We may keep data longer where the law requires it or to establish, exercise or defend legal claims.

8. Deleting your account

You can delete your account at any time:

• In the app: Me > Settings > Delete account.
• By email: write to [support@yourdomain.com] from the email address or with the phone number linked to your account, with the subject “Delete my account”.

Details of what is deleted and when are on our Delete your account page.

9. Your rights

Everyone

Wherever you live, you can ask us to access, correct or delete your personal data, and you can delete your account in the app. Most profile data can be edited directly in the app.

Hong Kong (PDPO)

You have the right to request access to and correction of your personal data (data access and data correction requests). We may charge a fee that is not excessive for complying with a data access request, as permitted by the PDPO. Send requests to our privacy contact above.

EU/EEA and UK (GDPR)

You have the right to: access your data; rectification; erasure; restriction of processing; data portability; object to processing based on legitimate interests; withdraw consent at any time; and not be subject to solely automated decisions with legal or similarly significant effects. You also have the right to lodge a complaint with your local data protection authority (for example, in the EU, the supervisory authority where you live or work; in the UK, the Information Commissioner’s Office).

California (CCPA / CPRA)

• No sale or sharing. We do not sell personal information and we do not “share” it for cross-context behavioural advertising, and have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.
• Sensitive personal information. We use account log-in credentials and the contents of your messages only to provide the Service, as permitted by the CPRA, and not to infer characteristics about you.
• Your rights: to know what personal information we collect, use and disclose; to access it; to delete it; to correct it; and to limit the use of sensitive personal information (we already limit it as described above). We will not discriminate against you for exercising these rights.
• Categories collected (past 12 months): identifiers; customer records; commercial information (red packet records); internet or other electronic network activity (logs, diagnostics); audio, electronic and visual information (voice messages, photos, videos you send); sensitive personal information (log-in credentials, message contents). Sources, purposes and recipients are described in sections 2, 3 and 5.
• You or an authorised agent can submit a request to [support@yourdomain.com]. We will verify your identity by confirming control of the phone number or email address linked to your account.

How we respond

We respond within the time required by applicable law (for example, 40 days under the PDPO, one month under the GDPR, and 45 days under the CCPA, which may be extended where the law allows). We may need to verify your identity before acting on a request.

10. Security and breach notification

We use technical and organisational measures to protect personal data, including encryption in transit (TLS), hashed passwords, access controls and least-privilege access for staff, and logging. No system is perfectly secure.

If a personal data breach occurs, we will act to contain it and, where required, notify the relevant supervisory authority within 72 hours of becoming aware of it (GDPR Art. 33), notify the Hong Kong Privacy Commissioner for Personal Data as recommended, and inform affected users without undue delay when the breach is likely to result in a high risk to them.

11. Children

The Service is not intended for children under 13. In the EU/EEA and other places where local law requires parental consent below a higher age (up to 16), you must be at least that age, or have verifiable consent from a parent or guardian where the law allows it. We do not knowingly collect personal data from children under the applicable age. If we learn that we have, we will delete the account and the data. Parents or guardians who believe a child has given us personal data can contact us at [support@yourdomain.com]. See also our Child Safety Standards.

12. Red packets

Red packet amounts are records on our server ledger. The digital assets that back these records are held by Cobo, a licensed custodian. The app itself does not offer withdrawals. We process red packet records to operate the feature, prevent fraud and meet legal obligations, and we may share limited information with the custodian as described in section 5. See our Terms for details.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you in the app or by other means before they take effect. The “Last updated” date above shows when it last changed.

14. Contact

[Company Legal Name] Limited
[Company Address]
Email: [support@yourdomain.com]

中文摘要（简体）