Applies to: the Chinese-language site, English-language site, iOS / Android apps and authorised third-party distribution channels operated by TREE NEWS ("we", "us" or "the Platform").
Article 1 – Introduction and scope
1.1 This Policy applies to all of the Platform's products and services, including the website, iOS / Android apps, push services and authorised third-party distribution channels (the "Service").
1.2 "Personal information" means any information recorded electronically or otherwise that relates to an identified or identifiable natural person. Anonymised information is not personal information.
1.3 The Platform processes personal information under applicable law: for users in mainland China, the Personal Information Protection Law of the People's Republic of China (PIPL); for users in the European Union, the General Data Protection Regulation (GDPR); for users in California, the California Consumer Privacy Act (CCPA/CPRA); for users in Singapore, the Personal Data Protection Act (PDPA); and for users in Hong Kong, the Personal Data (Privacy) Ordinance (PDPO).
1.4 The Platform is a news media service and processes personal information only to the extent necessary to provide the Service (data minimisation). By using the Service you are deemed to have read and agreed to this Policy. Where the law requires separate consent for a processing activity, the Platform will obtain your consent separately.
Article 2 – Personal information we collect
2.1 Information you provide
- Registration and login: mobile number, email address, identifiers returned by third-party accounts (such as Sign in with Apple); where identity verification applies, your real name and identity document details (collected only in applicable scenarios);
- Interactions: comments, bookmarks, likes, reports and their outcomes, and follow relationships;
- Submissions: submitted articles, author credit and contact details (where needed for fees or verification);
- Contact details: contact details and correspondence you submit through customer service, corrections or feedback channels.
2.2 Information we collect automatically
- Device and log information: device model, operating system and version, browser type, language settings, IP address, network type, app version, device identifiers (subject to applicable law and app store rules), crash logs, access times and browsing history;
- Usage information: reading, search, click and share data (de-identified or anonymised for statistical analysis);
- Push information: push tokens and delivery / open status;
- Location (where applicable): only when you use event filtering by region or map features and grant permission, we collect approximate location; we do not collect precise location for profiling.
2.3 Information we generally do not collect
The Platform does not collect sensitive information relating to financial services (such as bank accounts, securities accounts, virtual currency wallet addresses or transaction records). Please do not disclose other people's sensitive personal information in comments or submissions.
Article 3 – How we use personal information
3.1 The Platform uses personal information for the following purposes:
- providing, maintaining and improving the Service (login, content display, comments, bookmarks, following, event reminders, submission review);
- sending push notifications you request or subscribe to (according to your preferences);
- personalised content recommendation (which you may turn off at any time; see Article 7 of the Terms of Service);
- security and anti-fraud (risk control, anti-manipulation, anomaly detection);
- customer service and dispute handling (corrections, reports, complaints, legal proceedings);
- statistical analysis (after de-identification / anonymisation, to improve content and the product);
- compliance with legal obligations (such as real-name requirements, content security and regulatory requirements).
3.2 The Platform does not process personal information for purposes unrelated to those above. If the purpose, method or scope of processing changes, the Platform will obtain your consent again, except where the law provides otherwise.
3.3 Except with your separate consent or where the law provides otherwise, the Platform does not sell personal information by providing it to third parties in exchange for consideration.
Article 4 – Cookies and similar technologies
4.1 The Platform's website uses cookies, local storage and similar technologies to maintain sessions, remember preferences, measure traffic and ensure security.
4.2 You may manage or delete cookies through your browser settings, but some features (such as staying logged in) may then be unavailable.
4.3 For users in the European Union, the Platform obtains consent before setting non-essential cookies as required by the GDPR. For users in California, the Platform complies with the CCPA/CPRA opt-out requirements regarding the "sale" or "sharing" of personal information.
Article 5 – Sharing, processors, transfer and disclosure
5.1 Sharing: the Platform does not share your personal information with third parties except:
- with your separate consent;
- with affiliated companies, limited to the purposes described in this Policy and bound by it;
- where necessary to provide the Service, with authorised partners bound by the Platform (such as push service providers, cloud service providers and analytics providers), limited to necessary information (see Article 6);
- to regulatory, judicial or other competent authorities as required by law;
- in other circumstances provided by law.
5.2 Processors: where the Platform engages a third party to process personal information, it signs a data processing agreement (DPA) specifying the purpose, duration, method, categories, protective measures and responsibilities, and supervises the processing.
5.3 Transfer: where personal information is transferred in a merger, division, dissolution or acquisition, the Platform will inform you of the recipient's name and contact details as required by law and require the recipient to continue to perform the obligations in this Policy. If the purpose or method of processing changes, consent will be obtained again.
5.4 Public disclosure: the Platform does not publicly disclose your personal information except with your separate consent or where required by law.
Article 6 – Third-party SDKs and embedded services
6.1 The Service may embed third-party SDKs or services for push notifications, analytics, maps and login, including but not limited to (the actual list in the Annex prevails): push services (Apple APNs, Huawei Push Kit, Xiaomi Mi Push, OPPO / vivo / Honor / Meizu push, FCM or third-party aggregated push), third-party login (Sign in with Apple and others), analytics and event map services.
6.2 Information collected by third-party SDKs is processed under their own privacy policies. The Platform lists each SDK's name, function, data fields, privacy policy link and DPA status in the Annex and discloses them in the app's privacy prompt.
6.3 All SDKs must pass a privacy and security assessment before going live. Non-compliant SDKs are not integrated.
Article 7 – Cross-border transfers
7.1 The Platform serves Chinese- and English-speaking users worldwide. If personal information of users in mainland China is transferred outside mainland China, the Platform will fulfil one of the following obligations under the PIPL and related rules: pass a security assessment organised by the national cyberspace authority, obtain personal information protection certification, or sign a standard contract with the overseas recipient and complete filing, and will obtain your separate consent where required.
7.2 Transfers of personal information to the European Union are made with appropriate safeguards under Article 44 et seq. of the GDPR (adequacy decisions, standard contractual clauses, etc.); transfers to Singapore comply with the transfer limitation obligation of the PDPA; transfers to Hong Kong comply with the PDPO.
7.3 The recipient's country or region, the purpose of processing and the safeguards are listed in the Annex.
Article 8 – Storage and security
8.1 Retention: the Platform retains personal information only for as long as necessary to fulfil the purposes of processing, except where the law provides otherwise (such as log retention and cybersecurity requirements). Specific retention periods are in the Annex. When the retention period expires, the information is deleted or anonymised.
8.2 Location: the Platform's servers are located in mainland China and user data is stored on cloud servers in mainland China. If the storage location changes, this Policy will be updated and consent obtained again where required.
8.3 Security measures: the Platform uses encrypted transmission (TLS), encrypted storage, access control, least privilege, log auditing, vulnerability management, backup and recovery drills and other technical and organisational measures, and conducts regular security assessments.
8.4 Security incidents: in the event of a leak, tampering or loss of personal information, the Platform will immediately take remedial measures, report to the competent authorities as required by law and notify affected users where the law requires.
Article 9 – Your rights
9.1 Under applicable law you have the following rights (see Article 12 for how to exercise them):
- Access and copy: obtain a copy of the personal information the Platform holds about you;
- Correction: correct inaccurate or incomplete personal information;
- Deletion: request deletion of personal information where the legal conditions are met;
- Account deletion: delete your account on the website under My Account – Security – Delete account or in the app under Settings – Account & Security – Delete account, after which your personal information is handled in accordance with this Policy;
- Withdrawal of consent: withdraw consent to processing (without affecting the lawfulness of processing before withdrawal);
- Restriction / objection (GDPR / CCPA users): restrict or object to specific processing activities;
- Data portability (GDPR users): receive your data in a structured, commonly used, machine-readable format and transfer it;
- Turning off personalised recommendation: see Article 7 of the Terms of Service;
- Complaint: complain to the Platform or to the competent supervisory authority (including the data protection authority in your jurisdiction).
9.2 The Platform responds to requests within 15 business days (or within the period required by law). Requests that are repetitive, unfounded or manifestly excessive may be charged a reasonable fee or refused in accordance with law.
9.3 Rights concerning children's personal information are exercised by the guardian.
Article 10 – Protection of minors
10.1 The Platform is intended primarily for adults. Children under 14 may not register for or use the Service. Minors aged 14 to 17 may use the Service with the consent of a guardian. For users in the European Union, the age threshold for consent is that set by the law of the member state concerned.
10.2 If the Platform finds that it has inadvertently collected a child's personal information, it will delete it as soon as possible in accordance with law. Guardians may request deletion through the contact details in Article 12.
10.3 The Platform does not apply personalised recommendation to minors and does not recommend virtual currency or investment content to them.
Article 11 – Updates to this Policy
11.1 The Platform may revise this Policy in response to changes in law, regulatory requirements or business needs, and will publish revisions in a prominent place on the Platform, through an app prompt or by in-app message.
11.2 For material changes (such as changes to the purpose, method or scope of processing, cross-border transfers or your important rights), the Platform will give prominent notice and obtain consent again where required. The version number and effective date at the top of this Policy will be updated.
Article 12 – How to contact us
12.1 Personal information protection contact: tree@treenews.cn (please put "Personal information" in the subject line).
12.2 To exercise your rights, email the address above or submit a request through the Corrections & Complaints page. For security, the Platform may verify your identity before processing a request.
12.3 Users in the European Union and the United Kingdom may also exercise their rights under the GDPR / UK GDPR through the address above. If the Platform appoints an EU or UK representative as required by law, the representative's contact details will be published in this Article.
Annex – Personal information processing inventory
This inventory is published together with the Privacy Policy and is updated as features and SDKs change.
| Category | Data | Purpose | Retention | Notes |
|---|---|---|---|---|
| Registration and login | Mobile number / email / Apple identifier | Account registration and login | Life of the account | Deleted on account deletion |
| Identity verification | Name, identity document (submissions) | Contributor identity verification | As required by law | Data minimisation |
| Interactions | Comments, bookmarks, likes, follows, reports | Feature provision and content governance | Life of the account | Comments subject to moderation |
| Device and logs | Device model, OS, IP, browsing history | Security and statistics | At least 6 months (log retention under the Cybersecurity Law) | De-identified |
| Push | Push token, delivery / open status | Push notifications | Life of the account | Can be turned off at any time |
| Location (where applicable) | Approximate location | Event filtering by region / maps | Session only | Requires permission |
| SDK list | Listed item by item in the app privacy prompt and app store privacy disclosure for each app version | Push / analytics / maps / login | See each SDK's privacy policy | DPA required |
| Cross-border transfers | Recipients, countries / regions and safeguards depend on the services actually integrated; handled under Article 7 and updated here | Global service | — | Assessment / certification / standard contract |