Privacy Policy（私隱政策）
泊好車 Chapaan HK — Version 1.4 (effective 10 October 2026)
Effective date: 10 October 2026
This is an English translation of the Chinese 私隱政策. If the two versions differ, the Chinese version prevails.
This policy explains how we collect, use, keep and protect your personal data. The operator of the Service is a data user under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO").
1. What we collect
| Data | What it is | Why |
|---|---|---|
| Account data | Your Google account email and name, or your Apple ID email (which may be an Apple private relay address) | To create and verify your account (phone number sign-in was removed in September 2026) |
| Location data | The GPS coordinates when you send an alert (accurate to about 100 m); your latest location when you view nearby alerts (updated at most every 5 minutes, each new location replaces the old one) | To create the alert at that place and work out who it reaches; to decide which nearby alerts are pushed to you |
| Parking search location | Your location when you look up nearby car parks and meter spaces | Used only to answer that search, never stored |
| Push token | Your device's push token | To send you notifications about nearby alerts |
| Alert records | Alert location, time, confirmations and false-report marks (recorded under an internal ID) | To run the Service, prevent abuse and keep long-term statistics |
| Requests | The text of the feature requests you submit and your votes (recorded under an internal ID; other users cannot see who you are) | To collect product feedback |
| Report and block records | The content you report, the reason and the time; the users you block (recorded under an internal ID) | To review objectionable content; to hide reported or blocked users' content from your screen |
| Terms acceptance | The version of the Terms of Service you accepted and when | To show that you accepted the terms |
| Account status | Whether your account has been suspended for breaking the terms, and when | To enforce the Terms of Service |
| Technical logs | Server logs (IP, time, request ID) | Security, debugging and abuse prevention |
We do not: track your location continuously (we read your location only while you use the map, parking, parking alerts, saving your parking or giving feedback in the app); upload your parking record (where you parked and your meter time are stored only on your device); get your GPS location in the background; show your identity or personal data to other users; sell your data.
2. How we use data
We use the data we collect only to:
- provide the Service (accounts, alert broadcasts, push notifications);
- prevent abuse (filtering objectionable words, handling reports, suspending accounts that break the terms, rate limits);
- analyse operations (alert statistics by area and time of day, with no personally identifiable information);
- meet legal requirements (see section 5).
3. Retention
- Alert and feedback records are kept long term for statistics, recorded under an internal ID with no contact details.
- Account data is kept while your account is active. When you ask us to delete your account, we delete your account data, push tokens and the report and block records linked to you within 30 days (except aggregated statistics that cannot identify you).
4. Third-party services
The Service uses these third-party services, each with its own privacy policy:
| Service | Use | What is sent |
|---|---|---|
| Clerk (sign-in service) | Account verification (Google / Apple) | Email, verification records |
| Apple (Sign in with Apple) | Apple ID sign-in | Apple private relay email (if you choose it) |
| Apple APNs / Expo Push | Push notifications | Push token, notification content (area name) |
| Cloudflare (server hosting) | Backend hosting | Technical service data, IP |
| Apple Maps | Showing the map | Map tile requests (without your identity) |
5. Your rights (PDPO Data Protection Principle 6)
You can:
- access and correct your personal data (just email us);
- ask us to delete your account and the personal data linked to it;
- withdraw consent: turn off push notifications or location permission (the related features will be limited);
- complain: if you think we have breached the PDPO, contact us or complain to the Office of the Privacy Commissioner for Personal Data.
6. Security
Data is sent over HTTPS and stored in Cloudflare D1 (a managed database with 30-day point-in-time recovery). Only the operator can reach operational data, through the admin console.
7. Children
The Service is only for people aged 18 or over. We do not knowingly collect personal data from minors.
8. Changes to this policy
We will tell you about a material revision in the app. Continuing to use the Service means you accept the revised policy.
9. Contact
Privacy questions or requests, and reports of objectionable content or behaviour: hello@chapaanhk.app