Privacy Policy

This policy applies to MyTreat and 我请客 mobile apps, Web pages, deep links, customer support, and related features provided by the responsible operator for your service region.

It does not replace the privacy terms of independent restaurants, map providers, app stores, payment providers, identity-verification providers, or websites that you choose to visit. Their own notices apply to their processing.

The service is built for adults who discover and publish treat invitations, communicate, and may choose to meet offline. Because location and trust features are central to that experience, please read this policy before creating an account or publishing an invitation.

Account and authentication data may include your phone number, phone hash and encrypted value, last four digits, email address where supported, login method, one-time-code activity, account identifiers, and session information.

Profile data may include your nickname, verified legal name, resolved public name, username, avatar, gender selection, headline, introduction, marital status, height, weight, zodiac sign, account role, and status. Marital status, height, and weight are self-reported and are not identity-verified.

Invitation and community data may include titles, descriptions, budgets, restaurant or place names, map coordinates, guest preferences, messages or support requests, and any marketplace or community content submitted where those features are available.

Location data may include country or city-level location inferred from IP, precise device coordinates when you grant permission, places you choose on the map, and the coordinates attached to a published invitation. Search and place history may stay on your device unless you submit it as part of a service action.

Trust and transaction data may include the legal name and identity-document number submitted for verification, a protected reference portrait used for avatar matching, verification status and provider reference, credit score events, attendance and check-in records, deposit amount and status, payment-provider reference, refunds, forfeitures, and dispute status when those features are enabled.

Technical and safety data may include IP address, user agent, device fingerprint or characteristics, app and browser version, request time, authentication attempts, rate-limit events, error information, and administrative audit records.

We use information to create and secure accounts, deliver verification codes, maintain sessions, route you to the correct regional service, and provide customer support.

We use profile, location, and invitation data to display map stars, search and focus places, publish and recommend invitations, enable communication, and coordinate attendance-related features.

We use verification, deposit, attendance, and credit records to operate trust and safety rules, prevent duplicate or abusive accounts, calculate account standing, process applicable refunds or forfeitures, and resolve disputes.

We use technical and activity data to prevent fraud, enforce rate limits, diagnose errors, improve reliability, measure service performance, comply with legal obligations, and protect users and the platform.

Where required, processing is based on your consent, performance of our agreement with you, compliance with law, or our legitimate interests in operating a safe and reliable service without overriding your rights.

Published treat invitations are designed for discovery. Mainland users may choose whether their nickname or verified legal name is public. Global users publish their verified legal name after verification. Other users or visitors may also see your avatar, star gender, invitation content, approximate or selected place, headline, introduction, translated standardized profile values, and self-reported marital status, height, and weight marked as unverified.

Do not include phone numbers, home addresses, government identifiers, financial credentials, or other sensitive details in public invitation text. Public sharing pages may show a limited preview so recipients can decide whether to open MyTreat.

Your identity-document number and protected verification portrait are never shown publicly. Private support messages and account records are not made public. Access to sensitive trust, verification, deposit, and attendance records is restricted to the relevant user, authorized personnel, or service providers that need the data to perform their role.

We do not sell personal information. We share information only as described in this policy, at your direction, or where law allows or requires it.

Service providers may include Supabase infrastructure, regional map and place providers such as Tencent or Google, SMS and email delivery providers, identity-verification providers, payment or restaurant partners, hosting, security, and customer-support vendors. They receive only the information needed for their function and are expected to protect it.

We may disclose information to comply with law, respond to valid legal process, protect users or the public, investigate fraud or abuse, enforce our terms, or handle a merger, financing, acquisition, or transfer of the service with appropriate notice and safeguards.

Information you intentionally publish or send to another user is shared according to that action. Other users may save or reshare what they receive, so use care before disclosing personal details.

MyTreat operates separate Mainland and Global service regions. Your location or the brand domain you use helps route authentication, maps, and primary account data to the appropriate regional service. Accounts and data are not automatically synchronized between regions.

Map, place-search, identity-verification, messaging, payment, restaurant, or infrastructure providers may process information in the region where they operate. This can include coordinates, search terms, provider references, device or network data, and transaction status needed for the requested feature.

Where a transfer across national or regional borders is required, we use the safeguards required by applicable law and limit the transferred information to what is reasonably necessary for the service.

The Web service and mobile app use essential local storage, secure session storage, or similar technologies to keep you signed in, remember language and theme, route you to the correct service region, retain selected map preferences, and support security controls.

You can clear browser or app storage through your device settings, but doing so may sign you out, remove local place history, or reset preferences. Essential authentication storage is required while you remain signed in.

We do not currently sell data for third-party behavioral advertising. If advertising or non-essential tracking is introduced, we will update this notice and provide controls required by applicable law.

We keep profile, invitation, trust, support, and transaction records for as long as your account is active or as needed to provide the service, resolve disputes, enforce rules, and meet legal or accounting obligations.

Expired or consumed one-time-code records are scheduled for deletion, and authentication activity logs are scheduled to be removed after 400 days. Security backups and provider logs may follow separate, limited rotation periods.

Retention can vary by data category and service region. When the purpose ends, we delete, aggregate, or de-identify information unless continued retention is required or permitted by law.

We use measures such as encrypted transport, phone-number hashing and encryption, role-based access, row-level database policies, service-region isolation, restricted service credentials, rate limiting, and audit logging.

Identity-verification materials may be handled by a specialist provider. MyTreat may retain an encrypted identity-document number, binding hash, verified legal name, provider reference, and protected reference portrait needed for duplicate-account prevention and avatar matching. These materials are access-restricted and are never part of the public profile.

No system can guarantee absolute security. Protect your verification codes and device access, use only official download channels, and contact us promptly if you suspect unauthorized access or a safety incident.

Depending on where you live, you may have rights to access, receive a copy of, correct, delete, or restrict certain personal information, object to certain processing, withdraw consent, and complain to a data-protection authority.

You can change language, theme, location permission, browser storage, and similar device-level choices in the relevant app, browser, or operating-system settings. Withdrawing permission may limit map or authentication features that depend on it.

Submit account and privacy requests through Contact Us. We may verify your identity, clarify the scope, and refuse or limit a request where the law permits, including where it would expose another person's information or undermine fraud and safety controls.

You may request account deletion through an available in-app flow or the Contact Us page. We may ask you to authenticate or provide information needed to prevent an unauthorized deletion.

After a valid request is completed, we delete or de-identify account data that is no longer required. Limited records may remain where necessary for fraud prevention, financial reconciliation, dispute handling, safety enforcement, or legal obligations. A deletion-request audit record may be retained without keeping an active profile.

Deleting the app from a device does not by itself delete your account. Public copies already shared by other people, lawful backups pending rotation, and records held by independent third-party providers are handled under their own retention process.

MyTreat is intended only for adults who are at least 18 years old and have reached the age of legal majority where they live. Anyone under 18 may not register for, access, or use the app.

If you believe a minor has created an account or personal information was submitted without valid authorization, contact us so we can investigate and take appropriate action.

We may update this policy when features, providers, regional requirements, or our data practices change. Material changes will be communicated through the app, Web service, or another appropriate channel before or when they take effect.

The date at the top shows the current version. Continued use after an update means the revised policy applies to later processing, but it does not reduce rights that cannot legally be waived.

For privacy questions, requests, complaints, or to identify the responsible operator for your service region, use the Contact Us page. Mainland filing and contact information is also displayed in the site footer when applicable.