Privacy Policy

FriendLane China Privacy Policy

Effective date: 29 October 2026, upon publication. International edition.

Who we are

FriendLane China is operated by UNIKIRIN LIMITED. Contact contact@airuizhu.cn for support and privacy requests. This notice explains how we process information for the app, our support service and our moderation workspace.

Information we use

Account and security: if you choose SMS sign-in, your number is sent to Tencent Cloud and telecommunications providers to deliver a verification code. Our database stores a keyed identifier for the number, rather than its plain text. If you choose Sign in with Apple, we verify Apple's identity token and store a keyed Apple subject identifier. We do not request Apple's name or email scopes. If you choose Google Sign-In on Android, we receive and verify Google's ID token, then retain a keyed Google subject identifier for your account. A Google credential or token may also contain your email, name or profile-image URL in memory; we do not copy these into your community profile, store the raw token as an account record, or identify/merge accounts by email. We do not request access to Google Drive or Gmail. Different sign-in methods do not automatically merge accounts. We store session/code digests, timestamps, authentication-source records and keyed request-limit identifiers, including an IP-derived identifier, to authenticate and limit abuse. These identifiers remain personal information; hashing does not make them anonymous.

Profile: your display name, biography, interests, selected meeting city and optional area, avatar, self-reported country/region, birth date, gender and travel preferences support profiles and finding companions. A birth date is used to check adult eligibility and calculate displayed age; the full birth date is not shared with other members. Country/region and age are self-reported, not verified identity information.

Community: we store stories and selected photos, the places you associate with them, personal place cards, private or public place interests, follow relationships, connection and plan-interest requests, conversations, plans and revision agreements, place recommendations, reports and supporting evidence, blocks, content-screening results and appeals. We use these to provide the sharing you choose, place-based discovery, communication, moderation and account controls. We retain each participant's conversation read position for their own unread count; it is not a read receipt shown to the other participant. We also store notification event and recipient references, preferences, delivery state and read status to provide the in-app notification inbox. These account-linked product interactions support the service and your choices. If you turn on online visibility, we use a short-lived activity signal associated with your account, session and app installation to display that choice. If you enable iPhone system notifications, we also store the Apple push token, an app installation identifier, device platform, notification permission state and current account/session binding to send updates to the correct signed-in account. These installation identifiers and interactions are used for app functionality, not advertising tracking.

Support: private feedback contains your selected category, message, source page and app version, together with your account, status, staff reply and bounded audit information. It does not automatically attach a screenshot, location or conversation. Support staff can access feedback and moderation information needed for their duties. Feedback and private chat are not sent to the content-screening provider.

Consent records identify the notice versions and choices accepted at sign-in. Separate settings and request records reflect the sharing and optional features you choose while using the app. Publishing a new notice does not itself change your story audience, turn on online visibility or push, or authorize an AI request. We do not sell your profile information or use this release for targeted advertising. The app contains no advertising SDK or custom behavioural analytics SDK. Google, Apple, device service providers and infrastructure providers may process their own service data under their notices.

Your sharing and device choices

Android age access: we request an eligibility or age-range signal from Google Play only to decide access to our community for adults aged 18 or over. Where verification is needed, Google presents its own verification interface. FriendLane uses the returned signal in memory; we do not persist the raw signal, send it to our backend, use it for advertising, marketing or analytics, or use it to populate or change your profile age. To keep a known restriction in effect when you sign out or restart the app, we retain only a private on-device blocked flag indexed by a hash of your FriendLane member ID. This flag contains no age range, source tier or Play install ID, is excluded from app backups, and is not sent to our backend. It is cleared after a new explicit eligible-adult result or confirmed account deletion. If an applicable result is unknown, indicates an age below 18, or cannot establish eligibility, community access is restricted. Support remains accessible; an existing signed-in member can still sign out or request account deletion. Google Play handles its own processing under its applicable notices.

Companion discovery and Nearby profile sharing are separate settings and default to off. When enabled, eligible signed-in members may see the public parts of your profile. Nearby groups opted-in profiles at approximate, manually selected public-area anchors. Areas with fewer than three other eligible members are omitted; this is not an anonymity guarantee. The illustrated map does not show anyone's live or precise position. Changing your saved meeting city or area resets Nearby sharing to hidden. A private destination/date preference is not disclosed through member profiles while discovery is off.

Global lets eligible signed-in members of the international community discover places and the people who have chosen to share there. Its People view uses eligible members' public profiles and the interests and travel preferences they have chosen to share. General companion discovery, public place interests and public stories are separate choices. Turning off companion discovery does not automatically make an existing public place interest, public story or public personal place card private. Manage each item's sharing setting to change that audience. These features do not make your account part of the independent China-edition community.

You can follow a member from a place, story, plan or other profile context you are allowed to view. Following does not create an accepted connection, open ordinary private chat or reveal a private story. You can unfollow a member, review your own following and follower lists, remove a follower, or block a member. Removing a follower does not remove an existing friendship or prevent that person from viewing content you have separately made public at a place; use the relevant audience, connection or block controls for those choices.

Stories start as Only me. Friends shares a story and its photos with accepted connections. Friends & followers shares them with accepted connections and current followers, including people who follow you later while that audience remains selected. Public at this place is a separate, explicit choice: it makes the story and its photos discoverable at the selected confirmed place by other eligible signed-in international members, including people you do not know. It is not limited to your friends or followers. Existing stories keep their previous audience unless you change it. Access remains subject to current sharing choices, blocks, account eligibility and content review.

We group eligible public stories by their confirmed place to show story totals, distinct storytellers and links to those members' public profiles. A community place may appear in discovery after enough different members have shared eligible public stories there. Private, friends-only and follower-only stories do not populate these public place totals. A story contributes to a place's shared cover only if its author separately allows that use. You can also create a personal place card with your own title, summary and an eligible story photo, keeping the card private or explicitly making it public at that place. A new place suggestion stays private while awaiting confirmation; submitting a suggestion does not automatically publish its stories.

Public place-interest marks are another separate choice and can show your public profile at a place even when general companion discovery is off. The interest count and member list include eligible members who chose to share that interest, including you. Private marks remain visible only to their owner. Interest is not proof of a visit, and a story, place card or online indicator is not a verified check-in or live location.

Changing the audience, withdrawing or deleting content, removing a relationship or blocking a member changes future access where that control applies. Place counts and covers reflect current eligible public content. These controls cannot recall a copy someone already viewed or saved. Public plans continue to show a reduced summary; complete arrangements and version history are limited to authorized participants. Browsing does not send a request. Ordinary chat requires an accepted connection; accepting interest in a plan opens only that plan's conversation.

Show when I'm online starts off. If you enable it, the app sends an activity signal while it is in the foreground. We associate the signal with the current session and an app installation identifier so your devices can contribute to the same online choice. Authorized members receive an online indicator, without an exact last-active time or activity history. A signal stops counting after 90 seconds without a fresh update; turning the setting off removes your current signals, and an expired or revoked session no longer counts. The indicator does not use GPS or establish where you are physically located.

The in-app notification inbox can show connection requests, plan-interest activity, message updates and travel updates you have chosen to receive. You can enable reminders for an eligible friend or followed member and choose plans, destination changes or shared stories. Per-person reminders and the general friend-updates setting start off. You can mute a person or turn off a notification category. Following someone or opening an inbox entry does not accept a connection, confirm a plan or grant access to otherwise private content. We check current access when listing or opening an update; an update whose content is no longer available is shown generically. Following a person does not replay their old story notifications.

iPhone system notifications are optional and start off. If you choose Turn on notifications and allow the iOS permission, we use Apple Push Notification service (APNs) to deliver eligible updates. You can turn them off in the app or iOS Settings; the in-app inbox remains available without that permission. The server checks the current account/session, preferences and content access before sending. Turning off push in the app or signing out revokes the relevant server binding when the request reaches the service. Already queued or displayed notifications may remain, particularly while a device is offline. Notifications may be delayed, reordered or not delivered; do not rely on them for a time-critical or emergency alert.

Selected photos are provided through the system picker. This does not give us unrestricted photo-library access. Uploaded photos are re-encoded, with embedded EXIF metadata removed. Photos themselves can still reveal people, places or other personal information. Only upload material you have permission to share.

Use current city and Find my city are optional, explicitly requested foreground actions. On iPhone your device uses Apple location and reverse-geocoding services. On Android it uses the available system fused/network location provider and Android Geocoder after you allow foreground approximate location. These services suggest a city and, when available, a district. Android's underlying provider depends on your device and may process the lookup off-device. Confirmed city/area text is used for browsing or added to your editable story draft. FriendLane does not send the device coordinates to its backend, store a coordinate history, track you in the background or automatically publish your location. You may type a place instead and revoke location permission in your device Settings.

The English-conversation assessment remains retired; no assessment recordings or badges are added. In an authorized private conversation, you may choose to send one photo with an optional caption, or a voice message of 1–60 seconds. Microphone permission is requested only when you choose to record. You can stop, listen, record again or discard before tapping Send. Selecting a photo or recording a draft does not upload it. Recording and playback stop when the app leaves the foreground; nothing is sent automatically. Denying microphone access still allows text and photos.

Sent chat photos and voice recordings, their sender, conversation, type, size and duration or dimensions are stored on our Singapore service and available only through current conversation access checks. They are not public stories and are not automatically sent to Tencent Content Safety, DeepSeek, transcription or assessment providers. This feature does not provide end-to-end encryption. Unsent local files use app-private temporary storage, are excluded from app backups and are removed after sending, discarding, signing out or losing access; abandoned files are also cleaned on startup. Uploaded but unsent attachments expire after 24 hours and are removed by bounded cleanup. Sent attachments follow the conversation/account lifecycle, not the retired assessment's 30-day audio rule. Deleting an account removes related conversations and both participants' attachments from the active service; the recovery-copy rules below still apply. Blocking or removing access prevents future authorized reads but cannot recall copies someone already saved.

On Android, an app-generated installation identifier supports optional online visibility and notification bindings. Android system notifications are optional and start off. If you choose Turn on notifications and allow the system permission where required, we use Google Firebase Cloud Messaging (FCM) to deliver eligible updates. We store the FCM registration token with the app installation identifier, device platform, notification permission state and current account/session binding. You can turn notifications off in the app or Android Settings; the in-app inbox remains available. The server checks current account/session, preferences and content access before sending. Turning off push in the app or signing out revokes the relevant server binding when the request reaches the service. Already queued or displayed notifications may remain, particularly while a device is offline. Delivery may be delayed, reordered or fail; do not rely on it for time-critical or emergency alerts. Installation identifiers and notification interactions support app functionality and security, not advertising tracking.

Providers and international processing

Our main application and PostgreSQL database are hosted on Tencent Cloud in Singapore, using UNIKIRIN LIMITED's hosting account. Account, profile and community information, private conversations, selected photos, support messages and security records sent to our backend are processed there. Using the app from another country, including mainland China, therefore involves an international transfer. The sign-in screen presents a separate overseas-processing choice. Server location does not mean every provider processes information only in Singapore.

Google provides the Android Google authentication and credential service. The app requests a credential only after you choose Google sign-in and accept the displayed notices. We receive identity information needed to verify that sign-in; Google handles its own authentication/service processing under its applicable notices.

Google Firebase Cloud Messaging processes Firebase installation IDs, registration tokens, SDK configuration and service information, including Firebase user-agent information, app/package identifiers, IP addresses and service-usage information, to provide, maintain and improve Firebase services. FCM uses global infrastructure; its processing is not limited to Singapore. Our server sends FCM the registration token, opaque recipient-account and notification references, and an unread-notification count. The Android app displays a generic update prompt locally. We do not send names, private message text, photos, voice recordings, media links, destinations or travel dates in the FCM payload. The references are identifiers, not anonymous data. Opening an update requires the app to check the signed-in account and fetch currently authorized content. We do not enable Google Analytics or advertising tracking for this push service. Google handles FCM delivery and service records under its applicable notices; deleting a FriendLane account or binding does not recall data already processed by Google or notifications already displayed. See [Firebase privacy information](https://firebase.google.com/support/privacy).

Apple provides Sign in with Apple, token-verification infrastructure and the optional iPhone location/geocoding service. Apple sign-in through the Android browser is not available in the initial Google internal test. If enabled later, it opens a browser, then our server exchanges the authorization code and verifies a separate Services ID. Android receives a short-lived, one-use completion handle, not Apple access/refresh tokens. Pending browser-request proof is encrypted on the device, excluded from backup, and cleared when completed, cancelled, expired or signed out. We exchange and revoke fresh Apple authorization on Apple-account deletion; those authorization codes and returned revocation tokens are not retained as account records. Apple processes service information under its own applicable notices. For optional iPhone push, our server sends Apple the device token and app identifier, generic notification text, an unread count, and opaque account/notification references used to open the right update. The push payload does not include names, story or message text, photos, destinations or travel dates. Those references are still identifiers, not anonymous data. Opening an update requires the app to check the signed-in account and fetch currently authorized content. Apple handles APNs delivery and its service records under its applicable terms and privacy information; our account/content deletion cannot recall information already delivered to Apple or another device. See [Apple’s notification documentation](https://developer.apple.com/documentation/usernotifications/setting-up-a-remote-notification-server). Tencent Cloud and telecommunications providers deliver SMS when you choose phone authentication.

Tencent Cloud Content Safety, provided under the applicable domestic-site terms by Tencent Cloud Computing (Beijing) Co., Ltd. (腾讯云计算（北京）有限责任公司), screens profile text and avatars, stories and photos explicitly shared with friends, friends and followers, or publicly at a place, public personal place cards and their selected covers, public plans, and submitted place recommendations. Our Singapore backend sends relevant text and normalized image bytes to the Guangzhou service region in mainland China with an opaque case reference. It does not additionally send phone numbers, birthdays, GPS coordinates or device identifiers. Submitted text and images themselves may contain personal information. Private story/plan drafts, private personal place cards and private conversations are excluded. Text recognized inside images may also be sent to Tencent's text-screening service.

Screening can approve content, hold it for human review or require changes. Models and OCR may miss content or make mistakes; this is not a guarantee of safety or accuracy. Missing OCR results and failed screening do not automatically approve content. Owners can view their status, edit or appeal for human review. An approval does not widen the chosen audience. Place recommendations also need a separate human editorial decision.

Tencent's published FAQ states that screening-result details are retained for 30 days unless otherwise agreed. That statement does not establish the same period for original submissions, operational logs or backups. The applicable terms provide for retention as necessary to provide the service, with periods governed by product documentation and any separate agreement. They also permit content associated with erroneous or biased results to be used to improve the service. We do not promise zero provider retention or exclusion from all service improvement. Contact us for provider deletion/correction requests; we can raise these with Tencent using request identifiers and the relevant time range. Deleting content here does not retract a request already sent to a provider.

Optional AI photo explanations use the DeepSeek Open Platform, operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. The feature introduces visible scenery or architecture in English. Browsing a story, opening its photos, publishing a story or allowing readers to request explanations does not itself send an AI request. You first preview the selected photo, choose Allow this photo, then choose Ask DeepSeek for that request. An author may request an explanation of their own attached photo. Another reader must currently be allowed to view the story and must have the author’s separate reader permission for that audience. Widening a story’s audience does not carry its earlier AI permission into the new audience without an explicit choice.

For an allowed request, our Singapore server sends DeepSeek a normalized copy of that exact photo with optional city and place hints from the story. It does not additionally send your FriendLane account identifier, phone number, private chats or embedded EXIF/GPS metadata. The image and hints can themselves reveal personal information. We check access again before showing the result. Withdrawing permission after a request was sent can stop later access but cannot retract the provider request. Only choose this processing for material you have the necessary rights and permissions to submit. This feature does not analyze video or identify people.

FriendLane does not save a second photo or the generated explanation as part of this request, or automatically publish the result. The result stays on the explanation page; the original story and photo remain under their ordinary sharing and retention rules. Account-linked usage timestamps enforce request limits, including failed provider attempts. Generated explanations may be wrong or incomplete and are not verified identity, historical facts, current opening hours or travel advice.

DeepSeek’s processing, use and retention of API submissions are governed by the applicable API service terms and arrangements, separately from FriendLane’s storage. Its documentation describes disk context caching enabled by default. We do not promise immediate provider erasure, a fixed retention duration, processing only in Singapore, or exclusion from all model or service improvement. DeepSeek’s consumer privacy policy does not govern downstream end-user processing through this API integration. See the [DeepSeek Open Platform terms](https://cdn.deepseek.com/policies/en-US/deepseek-open-platform-terms-of-service.html) and [API cache documentation](https://api-docs.deepseek.com/guides/kv_cache/). Contact contact@airuizhu.cn for access, correction, deletion or other requests concerning a photo sent through this feature; we assess your request and seek provider assistance where needed. Deleting the story or your FriendLane account does not itself delete the provider’s records.

Retention and security

We retain account/profile data and content while needed to provide your account and the sharing you request. You can edit, withdraw or delete supported content, or delete your account. Stories, messages, plans, marks, feedback, reports and review records have no general age-based expiry in this release; they follow their deletion and account lifecycle. Withdrawn recommendation text/status history is kept until account deletion, while withdrawn media associations are removed and unreferenced uploads deleted. Legally required preservation, an unresolved safety complaint or a dispute may require a limited, restricted copy; contact us about a particular record.

A sign-in challenge is valid for five minutes; a normal session is valid for up to 30 days unless revoked earlier. These validity periods are not immediate-erasure promises. Our bounded cleanup makes Google/Apple/SMS challenges and Apple browser transactions eligible 24 hours after expiry, SMS abuse-limit events 24 hours after creation, and sessions seven days after expiry or revocation. Short-lived Apple and Google deletion-protection markers become eligible after ten minutes. Staff sessions expire within eight hours. Unattached photos expire after 24 hours; attached photos follow the owning content. Legacy assessment audio, if present, expires after 30 days and is inaccessible after expiry. New assessment recordings are not accepted. Expired request-limit records become eligible after their one-hour or 24-hour windows. Cleanup runs daily in bounded batches, so physical deletion follows a successful batch rather than occurring exactly at each cutoff.

Notification events and their associated inbox and delivery records become eligible for bounded cleanup after 90 days. Cleanup occurs in successful batches, not necessarily at the exact cutoff. A small story-and-recipient record may remain while the story exists to avoid sending the same story notification again when sharing changes. Follow relationships and reminder preferences remain until removed or changed through the relevant controls or account deletion. Presence signals stop being used after the short validity period described above and are eligible for cleanup independently of notification history.

Successful account deletion removes the account, profile, consent and session records, owned stories and media, personal place cards, marks, feedback and related records, plus connections, follow relationships, reminder preferences, presence settings and signals, push-installation bindings, notification records, requests, conversations and plan/collaboration records involving that account. It requires fresh verification of the same account and, for Apple accounts, authorization revocation. Failure is reported rather than presented as successful deletion. Signing out or uninstalling does not delete server data. Deleting your FriendLane account does not delete your Google or Apple account. A common place may remain for other members' stories, without preserving your deleted stories or personal card as public contributions. Copies already retained by other people cannot be recalled.

Traffic uses HTTPS. The database is not publicly exposed, provider credentials stay on the server, and staff access is restricted. Application/proxy access logging is disabled. Container operational logs rotate by size, at 10 MB with three files per service; this is not a fixed retention period for every cloud or operating-system log.

The initial recovery process uses encrypted backups on an external SSD attached to the operator's Mac, with the recovery key stored separately. Backups are manual and are not an always-on offsite service. The operator reviews recovery copies and removes copies no longer needed. A deletion request also triggers review of backup copies containing the affected data; copies that must temporarily remain for recovery are isolated from ordinary use and deletions must be reapplied before restored data is reopened. We do not claim immediate automatic erasure of offline backup copies. Ask us about the handling of a specific request.

Requests and contact

Use Me → Delete account for account deletion. Use the app's editing, visibility, withdrawal, block and report controls for other choices. You may email contact@airuizhu.cn to request access, a copy, correction, deletion, restriction, consent withdrawal or an explanation of our processing. Describe the request without sending passwords or verification codes. We may ask for proportionate information to establish that you control the account. We assess requests under applicable requirements and explain any restriction or additional time needed. You may also contact the relevant data-protection authority where that right applies.

The service is for adults aged 18 or over. If you believe a child has provided information, contact us. Material changes to purposes, providers, processing locations or sharing will be explained before changed processing begins, with additional choices where required.

Travel history and reviewed profile totals

You may choose and explicitly save the countries or regions you say you have visited. We store that checklist with your account on our existing Singapore backend; only you can read the list. Other members who are already allowed to view your full profile may see its distinct total, labelled as self-reported. You may edit or clear the list, or return it to not supplied. We do not infer visits from your nationality, location, photos, Stories or suggested itineraries.

The profile may also show lifetime totals from staff-reviewed city-activity fulfillment and no-show decisions. Check-in, proximity and private feedback do not automatically award fulfillment. Each activity counts at most once per member. A pending no-show appeal retains the last reviewed decision until it is changed; reversal removes that no-show without automatically awarding fulfillment. Staff may also reverse a positive decision. These totals are separate from any rolling booking restrictions. Case details, reasons and reviewer records are not shown to other members. Existing profile-access, blocking and account restrictions still apply; these figures are not a guarantee of a member's reliability or safety.

We use these account-linked records for profile functionality and attendance administration, not advertising or AI processing. The checklist remains until you change or remove it or delete your account; review records remain under the existing account and safety-record lifecycle. Account erasure removes your new travel-history, fulfillment and associated audit records through that lifecycle. Existing backup and provider-retention limits still apply. Contact contact@airuizhu.cn for correction or privacy requests. No new external recipient or continuous location tracking is introduced by this feature.

中文说明

本国际版由 UNIKIRIN LIMITED 运营，服务及隐私联系邮箱为 contact@airuizhu.cn。生效日期：2026年10月29日，以公开发布为生效条件。

我们处理登录与安全标识、资料和自行申报的国家／地区及出生日期、您选择提交的故事／照片／计划／消息／地点推荐、个人地点卡、公开或私密兴趣印记、关注关系、通知事件与收件箱状态、可选的短时在线信号、举报、反馈和同意记录；开启 iPhone 系统通知时还处理 Apple 推送令牌、应用安装标识、设备平台、通知权限状态及当前账户／会话绑定，以提供账户、地点发现、分享、交流、通知、安全与客服功能。出生日期不公开，显示年龄和国家／地区不代表经核实的身份。手机号仅在短信验证所需流程中传给腾讯及电信提供方，数据库保存带密钥标识；Apple 登录不请求姓名或邮箱。Android Google 登录会接收并验证 Google 身份令牌，仅把经验证的身份标识转为带密钥标识保存。凭据或令牌可能暂时包含邮箱、姓名和头像链接；不据此建立社区资料、不保存原始令牌、不按邮箱合并账户，不申请 Drive/Gmail 访问权限。不同登录方式不会自动合并账户。初期 Google 内测尚未开放 Android Apple 网页登录；日后启用时会使用浏览器及服务端验证，应用只接收短时一次性完成句柄，待完成证明在设备上加密且不进入备份。

Android 年龄访问：我们仅为判断是否可以向18岁及以上成年人开放社区，向 Google Play 请求资格或年龄段信号。需要验证时，由 Google 在其自己的界面完成。FriendLane 只在内存中使用返回信号，不持久保存原始信号、不发送至我们的后端，不用于广告、营销或分析，也不用于填充或修改资料年龄。为避免退出或重启应用后丢失已知限制，我们仅在设备私有空间保存一个以 FriendLane 会员编号哈希值索引的受限标记。该标记不含年龄段、来源级别或 Play 安装标识，不进入应用备份，也不发送至后端；取得新的明确成年且符合资格结果或确认账户删除后清除。适用结果未知、显示未满18岁或无法确认资格时，社区访问受到限制；仍可联系支持，已经登录的用户仍可退出或申请删除账户。Google Play 按其适用说明自行处理相关服务数据。

一般资料发现及 Nearby 是独立开关，默认关闭；地图仅表示手选粗略区域，不表示实时个人坐标。Global 可让合资格的国际版登录会员浏览共同地点和选择公开分享的人；一般资料发现关闭后，已公开的地点兴趣、故事或个人地点卡不会自动变私密，也不会使账户加入独立的中国版社区。关注不等于已接受连接，不开放普通私聊或私密故事；可取消关注、移除关注者或拉黑，但移除关注者不会自动取消已有好友关系或对其他公开内容的访问。

故事默认仅自己。您可分别选择 Friends（已接受连接）、Friends & followers（已接受连接及当前和后续关注者），或明确选择 Public at this place，使已确认地点的故事和照片供不认识的合资格国际版登录会员发现。旧故事不会自动公开。共同地点仅统计符合条件的公开故事和不同作者；合用封面另需作者选择。个人地点卡可私密保存或明确公开；新地点建议待确认时保持私密。公开地点兴趣印记是另一独立选择，可展示公开资料及兴趣人数，兴趣不证明到访；私密印记仅本人可见。更改分享、撤回、删除或拉黑会改变今后的可访问范围，但无法收回别人已保存的副本。

“Show when I'm online”默认关闭；开启后，前台活动信号与账户、会话及安装标识相关联，只显示在线指示，不显示精确最后活动时间或位置；90秒未更新即不再计为在线。应用内通知收件箱记录请求、消息及您选择接收的出行更新；每人提醒和好友更新默认关闭，可静音或关闭类别。打开通知不会自动接受请求、确认计划或扩大私密内容权限，失效内容以概括信息显示。iPhone 系统通知默认关闭，须您选择 Turn on notifications 并允许 iOS 通知权限后，才通过 Apple Push Notification service（APNs）投递符合条件的更新。可在应用或 iOS 设置关闭；不授权也可使用收件箱。我们的服务器向 Apple 发送设备令牌、应用标识、通用提示、未读数量及用于打开更新的不透明账户／通知编号，不发送姓名、故事或消息正文、照片、目的地或日期；这些编号仍属于标识，并非匿名数据。打开后重新核对当前账户及内容权限。关闭推送或退出后，撤销请求到达服务端即撤销相应绑定；设备离线时及已排队或展示的通知可能仍存在。Apple 按其适用条款处理投递及服务记录，不能保证及时送达或通过删号撤回 Apple 已收到的信息；不要将通知用于紧急提醒。安装标识、短时活动及通知读取状态用于应用功能，不用于广告追踪。普通聊天须对方接受，计划兴趣只开放相应计划会话；公开计划只有摘要，完整安排限获授权参与者。选择照片不开放整个相册，上传图片重编码并去除 EXIF，但画面本身仍可能含个人信息。

您主动选择一次定位后，iPhone 使用 Apple 服务；Android 在获得前台粗略位置许可后使用设备可用的系统定位提供方及 Android 地理编码，建议城市和区名，再由您确认。Android 实际提供方随设备而异，地理编码可能在设备外处理。FriendLane 后端不接收或保存设备坐标，不后台追踪，不自动发布位置。可手填地点或撤销系统权限。英语录音评估继续停用，不新增评估录音或徽章。国际版已获授权的私聊可以发送一张照片及可选说明，或1至60秒语音。仅在选择录音时申请麦克风权限；可以停止、试听、重录或取消，点击发送才上传。选择照片或录制草稿不会自动上传；进入后台时停止录音和播放，不自动发送。拒绝麦克风权限仍可使用文字与照片。

已发送的聊天照片、语音及发送者、会话、类型、大小、时长或尺寸存储在新加坡服务，仅按当前会话权限访问，不进入公开故事，不自动交给腾讯内容安全、DeepSeek、转写或评估提供方。本功能不提供端到端加密。未发送的本地文件存于应用私有临时空间且不进入应用备份；发送、丢弃、退出或失去权限后清理，启动时也清理遗留文件。已上传但未发送的附件24小时后到期，由限量清理任务删除。已发送附件随会话和账户生命周期保留，不采用已停用评估录音的30天规则；删号会从活跃服务删除相关会话及其中双方附件，恢复副本仍遵循下述规则。拉黑或撤销访问阻止后续授权读取，但不能收回他人已保存副本。

Android上，应用生成的安装标识用于可选在线显示和通知绑定。Android系统通知默认关闭；只有您选择开启，并在系统要求时允许通知权限，才使用Google Firebase Cloud Messaging（FCM）投递符合条件的更新。我们将FCM注册令牌与应用安装标识、设备平台、通知权限状态及当前账户／会话绑定一起保存。可在应用或Android设置中关闭通知，应用内收件箱仍可使用。发送前检查当前账户／会话、偏好和内容权限；在应用中关闭推送或退出后，撤销请求到达服务端即撤销相应绑定。已排队或显示的通知可能保留，尤其在设备离线时；投递可能延迟、乱序或失败，不应用于紧急或必须准时送达的提醒。这些标识和通知交互用于应用功能与安全，不用于广告追踪。

Google Firebase Cloud Messaging处理Firebase安装ID、注册令牌、SDK配置和服务信息（包括Firebase用户代理信息、应用／包标识、IP地址和服务使用信息）以提供、维护和改进Firebase服务。FCM使用全球基础设施，不限于在新加坡处理。我们的服务器只向FCM发送注册令牌、不透明的收件账户和通知编号及未读通知数量，Android应用在本地显示通用更新提示。FCM载荷不含姓名、私聊正文、照片、语音、媒体链接、目的地或出行日期；编号仍是标识，并非匿名数据。打开通知时重新核对登录账户并获取当前有权访问的内容。此推送服务不启用Google Analytics或广告追踪。Google依据其适用说明处理投递与服务记录；删除FriendLane账户或绑定不能撤回Google已处理的数据或已显示的通知。参阅[Firebase隐私信息](https://firebase.google.com/support/privacy)。

主服务器及数据库在新加坡，由运营者账户使用腾讯云托管。账户、内容、消息、照片、反馈和安全记录会传至该后端；注册前提供独立境外处理选择。内容审核另使用腾讯云计算（北京）有限责任公司国内站服务，相关文字和图片从新加坡传至中国大陆广州地域，图片识别出的文字也可能送文本检测。范围包括资料／头像、分享给好友或好友与关注者的故事及照片、公开地点故事、公开个人地点卡及所选封面、公开计划和提交的地点推荐，不包括私密故事／计划草稿、私密个人地点卡或私聊。请求不另附手机号、生日、坐标或设备标识，但内容本身仍可能含个人信息。审核可能误判或漏判，作者可修改、申诉；地点仍须人工编辑审核。

腾讯公开文档说明审核结果明细通常保留30天，不能据此认定原始图文、日志及备份也都是30天。其条款按服务必要期间及产品文档／另行约定保留数据，并允许错误或偏差结果涉及的内容用于改进服务；不承诺零保留或完全排除改进用途。可通过本邮箱请求我们协调腾讯删除／更正。已经发送的请求无法通过本应用撤回。可选 AI 照片讲解使用由 Hangzhou DeepSeek Artificial Intelligence Co., Ltd. 运营的 DeepSeek Open Platform，以英文介绍照片中的景物或建筑。浏览、打开、分享照片或开启作者许可本身不会发送 AI 请求。每次先预览指定照片，再选择 Allow this photo 及 Ask DeepSeek；作者可以请求讲解自己的故事附件，其他读者还须具有当前阅读权限及作者针对该受众的独立许可。扩大故事受众不会自动沿用旧 AI 许可。

获授权后，新加坡服务器把该张照片的规范化副本及故事中的可选城市／地点提示发送给 DeepSeek，不另附 FriendLane 账号编号、手机号、私聊或嵌入的 EXIF／GPS 元数据；图像和提示本身仍可能含个人信息。返回结果前再次核对权限，撤回可阻止之后访问，但不能收回已发送给提供方的请求。仅对有权提交的材料选择处理；本功能不分析视频或识别人。FriendLane 不因讲解请求另存照片或生成结果，不自动发布结果；结果停留在讲解页，原故事与照片仍按原规则保存。账号关联的请求时间用于限额，失败调用也计入。AI 可能错误或不完整，不是经核实的身份、历史、营业时间或出行建议。

DeepSeek 对 API 内容的处理、使用及保留按适用 API 服务条款和安排执行，独立于 FriendLane 的存储；其文档说明默认启用磁盘上下文缓存。我们不承诺提供方立即删除、固定保存期限、仅在新加坡处理或排除一切模型／服务改进用途。DeepSeek 消费者隐私政策不适用于本 API 下游用户信息处理。适用说明见上述 DeepSeek API 条款和缓存文档；访问、更正、删除等请求可联系本邮箱，我们评估并在需要时寻求提供方协助。删除故事或 FriendLane 账户本身不会删除提供方记录。

账户及内容依功能和删除流程保留；消息、计划、举报、反馈和审核记录没有统一按年龄自动到期规则。通知事件及关联收件箱、投递记录在90天后进入有界清理范围，实际删除取决于成功的批次；防止重复故事通知的小型故事／接收人记录可能随故事保留。关注关系及提醒偏好持续至移除、更改或删号；在线信号在短时有效期后停止使用并单独进入清理范围。登录挑战5分钟及普通会话30天是有效期，不是删除期限。Google/Apple/SMS 挑战及 Apple 网页事务在过期24小时后进入有界清理范围，短时防删除重放标记10分钟后进入清理范围。每日有界清理按上述英文正文列明的技术期限移除过期记录；未关联照片24小时过期，关联照片随内容删除。成功删号需要本人重新验证，清理账户、故事、个人地点卡、关注关系、提醒偏好、在线设置与信号、推送安装绑定、通知记录及关联社交记录；共同地点可继续供其他会员使用，但不保留您的已删除贡献；Apple 账户同时撤销授权。退出或卸载不等于删号，无法追回别人已经保存的副本。应用与代理访问日志关闭，容器日志按大小轮换；这不表示所有供应商日志都不保留数据。

初期恢复副本手动加密保存于运营者 Mac 外接 SSD，密钥分开保存，并非持续在线的异地备份服务。运营者检查并删除不再需要的副本；删除请求也包括审查相关备份，暂因恢复需要保留的副本隔离不用，恢复后重新落实删除。离线备份不能承诺即时自动擦除。访问、复制、更正、删除、限制处理、撤回选择及其他适用权利，请联系上述邮箱。身份确认只要求适度信息，不要发送密码或验证码。本服务仅面向18岁及以上成年人；重大数据处理变更将事先说明。发布新政策本身不会改变旧故事受众、开启在线或推送，也不会授权 AI 请求；各项功能仍按各自明确选择执行。

旅行记录与资料统计

您可以自行选择并明确保存去过的国家或地区。清单与账号关联，存于现有新加坡后端，仅本人可读取；原本就有权查看您完整资料的会员可看到去重后的总数，并标明为本人填写。您可编辑、清空或改为未填写。我们不根据国籍、位置、照片、故事或建议行程推断旅行经历。

资料也可显示由工作人员核定的城市活动履约和爽约累计次数。签到、距离和私人反馈不会自动获得履约记录；每场活动每位会员最多计算一次。爽约申诉处理中保留上次核定结论，改判撤销后移除该次爽约，不自动计为履约；工作人员也可撤销正面核定。累计次数与滚动报名限制分别计算。其他会员看不到个案详情、理由或审核人员记录；原资料权限、屏蔽及账号限制仍适用。这些数字不保证任何会员的可靠性或安全。

这些账号关联记录用于资料功能和出席管理，不用于广告或AI处理。旅行清单保留至您修改、移除或删号；核定记录按现有账号及安全记录生命周期保存。删号流程会删除您的新增旅行记录、履约及相关审计记录；原有备份和提供方保留限制继续适用。更正或隐私请求可联系contact@airuizhu.cn。本功能不新增外部接收方或持续定位追踪。