Last updated: November 7, 2026
NihaoMap ("the app") is a map of places in supported cities, built for travelers. This policy explains what data the app handles, what leaves your device, and what never does.
You can browse public maps and read place and collection details without signing in. Sign in to save places and collections across your devices or prepare a city for offline use. A city that is already installed can still be used after you sign out. NihaoMap does not show ads. NihaoMap product analytics is always on and has no in-app switch; Privacy & Map Data explains what it sends and how to copy the random installation ID its records are attributed to. A downloaded city can provide its declared map area, place search, details, nearby facilities and arrival cards without a connection. When connected, new searches use NihaoMap's online index, even if a city is downloaded. Offline searches use downloaded content and stay on your device. Online searches send your search text and — for "near me" searches, including nearby-facility lookups — a deliberately coarsened location (and the chosen facility category) to NihaoMap servers; the original GPS coordinate is not uploaded to NihaoMap servers. The rounded location can still be classified as precise by app-store privacy definitions. Mapbox may process map requests and, when you grant location permission and use a location feature, location data as described below.
On Android you can sign in with Google. On iOS you can use Google or Apple. We use the provider to verify your identity. Supabase Auth processes the provider identifier and authentication email, which can be an Apple relay address. NihaoMap uses its account identifier, sign-in provider, registration date and, when available, the name and avatar URL supplied by the provider. Your email is not shown in your NihaoMap profile. The app protects session credentials on your device and uses them to restore your session and authenticate private requests. If you have an avatar, the app requests it from the provider’s image host, which receives ordinary connection information such as your IP address.
Account and saved data are stored in our Supabase project in Singapore. Cloudflare processes requests to that service. We keep short-lived verification records and protect the provider credentials we need to revoke access when you delete your account. Google and Apple also process sign-in under their own policies.
When you save a place or collection, NihaoMap keeps its reference, save status and time, and the minimum display information needed to show it. Changes you make offline are held on your device until they can sync. A random sync identifier and time-limited operation records help us apply changes once, including when a response is lost. A minimal cancellation marker prevents an old device from bringing back a bookmark you removed.
NihaoMap checks your signed-in session before issuing a ticket for a new download, update, resumption or online recovery of a content key. Your installed cities and downloaded media stay on that device. NihaoMap does not use your account to keep a history of the cities you download.
Feedback you choose to send. If you submit feedback through the in-app form, we store: your message, the feedback category you picked, the related place (if any), your app version, and your device operating system name and version (for example, "iOS 26.5" or "Android 16"). We use this only to fix content errors and improve the app. We attach no account or contact identifier. A message can still identify you if you include personal information; please avoid sending information that is not needed for the correction.
Online search requests. New searches use the online service when connected, including when you have downloaded that city. Online search sends the text you type, the chosen city and search scope (city, near me, map viewport or named area). A near-me request sends a rounded center point, approximately 200–500 meters; viewport search sends the selected map bounds. These requests pass through Cloudflare's Worker network to NihaoMap's place index in Supabase, whose project database is in Singapore. The current app does not use an external Mapbox search supplement. NihaoMap does not implement a persistent personal search history. Cloudflare processes the connecting IP address for rate limiting; hosting providers also handle connection and security metadata under their own policies. This does not mean every provider processes all metadata only temporarily or stores it in Singapore.
When an installed city covers a search or nearby-facility request, the app reads its on-device index and calculates distances locally. That local query does not send its text or location to NihaoMap search.
Request security and compatibility. Requests to NihaoMap business APIs, including feedback and city download authorization, send the app platform, app version and build, operating-system version, device model (or "unknown"), request time and a new random request ID. We use these fields for compatibility, abuse prevention and short-term troubleshooting. The request ID changes for each request; it is not a persistent device or installation identifier. We do not use these fields for profiling, advertising or tracking a device across requests. Request signatures, app key material, download tickets and city decryption keys are not included in diagnostic logs. We do not retain full request headers, search text or location in those logs, and do not create a long-term per-request database.
Product analytics. Product analytics is always on: there is no switch in the app, and it is independent of map consent and location permission. NihaoMap sends explicit feature events to PostHog, Inc., using PostHog Cloud in the United States. Events describe startup, visible screen types, map readiness, search attempts and results, city selection, place and arrival-card actions, filters, feedback submission, sign-in prompts and results, saving or removing saved collections, and completed city installation. Sign-in events record the feature that requested sign-in, the provider category (Google, Apple or no provider selected), and the result category; they do not include your provider identity or credentials. Properties are restricted to app version/build, platform, environment, source/content versions, result category, result count, duration, controlled screen and entry types, sign-in purpose and provider categories, category/filter choices, selected-city buckets, result positions, permission outcomes and offline operation stages where those features are instrumented. Startup summaries include first or returning launch, network state, phase timing, aggregate map cache sources, request counts and measured transfer bytes with coverage status. They exclude tile URLs and coordinates. Screens are recorded only when visible and foregrounded, after loading. Successful actions reflect the actual storage, copy, navigation or submission result. A random installation ID persists across restarts so installations can be counted. It is not printed on a privacy screen: press and hold the version number at the bottom of Settings to copy a support summary that includes it, so that you can quote it to us. Foreground-session and operation IDs are temporary and only connect related events. None of these is a hardware, account or advertising ID. PostHog keeps one anonymous profile record per installation, linked by that random installation ID. These analytics events do not send names, email addresses, account identifiers, profile information, automatic device properties or other person attributes. Signing in does not link the analytics installation ID to your account. PostHog may also keep service-generated metadata and the connection IP described below. Quoting the installation ID helps us check whether a deletion request can be matched to its events. An event such as saving a place or collection records the action and controlled summary fields, such as item count and single-item or batch mode, not the place or collection ID, title, contents or your Saved list. We exclude search text, coordinates, addresses, feedback text, full URLs, advertising IDs and automatic device properties. Session replay, screenshots, automatic click capture and advertising attribution are disabled. PostHog still receives the connecting IP address and network metadata; disabling GeoIP in the client does not itself discard server IP data. See PostHog Privacy Policy.
Events that cannot be sent yet wait in a bounded on-device queue that the official SDK keeps in app storage, and are sent in batches when the connection returns; that queue survives an app restart. Delivery is bounded best effort, not a guarantee: once the queue reaches its limit the oldest unsent events are discarded, and a delivery failure that is not a network error discards its batch after a bounded number of retries. Uninstalling the app or clearing its data removes the local queue and the installation ID. An operation started before a new foreground session is not replayed into that session. This is not a guarantee of reliable offline delivery or cross-day user measurement.
Technical diagnostics. The app keeps up to 100 redacted diagnostic records for at most five minutes in memory. These records include stage, result, timing, version and per-request or per-download random IDs; they are not a persistent personal activity ledger. The official Sentry SDK (Functional Software, Inc.) is included for JavaScript/native exceptions and selected self-service request traces. Selected unexpected failures in sign-in, session restoration and secure storage, session cleanup, and saving or syncing your library use fixed operation and error categories. Routine cancellation, an expected authorization refusal or waiting for a connection is not reported as a crash. Exception text, user/device contexts, URLs and arbitrary payloads are removed at the SDK exits. Separately from that memory buffer, the Sentry SDK keeps its own on-disk cache so a native crash can still be reported on the next launch; not all diagnostics are therefore memory-only. When reporting is configured in a build, these diagnostics are sent to NihaoMap's Sentry project in the United States. Technical diagnostics are separate from product analytics. Sentry receives network connection metadata and its project settings allow the connecting IP address to be retained for technical diagnostics. Geography fields are scrubbed. PostHog also keeps connection IP data for product analytics. IP addresses are retained with the corresponding provider records; they are not promised to be discarded immediately. No full PostgreSQL trace, screen recording or advertising attribution is collected by this integration.
Location permission is requested only for use while you use the app ("When In Use"), after you choose a feature such as My location. NihaoMap uses it to show your position, move the map to you, and — if you run a "near me" search — to derive the coarsened center point described above (NihaoMap also uses the original coordinate locally to calculate exact distances to results). NihaoMap does not store the original GPS coordinate on its own servers. The active map SDK may process location data to provide its map and location functionality. If you decline location permission, city browsing still works and you can keep browsing your chosen area. The last viewed map center and zoom are stored on your device to restore your view when you reopen the app. This is a browsing preference, not a GPS history; after you use My location, the saved view may coincide with your location. NihaoMap does not upload this saved view as analytics or use IP geolocation to move the map automatically.
NihaoMap uses Mapbox as its base-map provider. Before the Mapbox SDK is initialized, the app presents the map-data notice and provider privacy link.
The base map is provided by Mapbox, Inc. Viewing or downloading the map sends requests to Mapbox for styles, tiles, fonts, and related map resources. These requests necessarily include an IP address and may include app, device, SDK, and request information used to provide, secure, and account for the service. If you grant location permission and use a location feature, Mapbox may also process location data. NihaoMap disables optional Mapbox telemetry in this integration and keeps Mapbox's logo and attribution control visible. Downloading a city sends the chosen map coverage to Mapbox; it does not require your device's precise location. After the map resources are downloaded, viewing them within that coverage can work offline. Offline searches use our on-device place index and cover only downloaded place content; downloading a city does not switch new connected searches away from NihaoMap's online service. Mapbox states that it processes product data primarily in AWS in the United States and may use CDN locations in other regions; it states that IP addresses are generally retained for 30 days unless needed for a security, fraud, or legal investigation. See the Mapbox Product Privacy Policy. If you decline the map-data notice, the app does not initialize Mapbox.
For faster startup, NihaoMap also keeps a small local cache of recently viewed place summaries and collection directories. Cached pages can be reused for up to seven days and are replaced as you browse. They stay on your device and are not uploaded as browsing history. Search text, nearby-location queries and time-sensitive filters are not saved in this browsing cache. Cached pages are marked as previously viewed content; they do not replace a downloaded city or promise complete offline coverage.
The app checks NihaoMap's online content service (hosted by Supabase, Inc., with project data stored in Singapore and reached through our Cloudflare gateway), including its city directory, for new place content and confirmed place-status changes. These requests can reveal the city and coverage you choose to download, the content version you hold, your IP address and basic connection metadata to NihaoMap and its hosting providers. The city catalog, place database, search index and selected photos are stored on your device for offline use. City content downloads use a short-lived authorization ticket; their content key is delivered over HTTPS and stored using the device security storage for continued offline use. Ticket expiry does not delete an installed city. Choosing a city does not request location permission or send precise location.
When you open Saved or an individual place outside installed city content, the app may request public details, including price and opening hours, for that place. These requests send the requested place IDs to the same Supabase content server, together with ordinary connection metadata. They contain no account identifier. Syncing the references in Saved is a separate request under your account.
Place photos and city content files are served from NihaoMap-controlled file hosting on Cloudflare R2 storage and Cloudflare's content delivery network. Loading or downloading an asset sends its file path to that host and, like any Internet request, exposes your IP address and basic request metadata to the network and hosting provider. Public online photo requests carry only the object path and ordinary connection metadata; they do not carry app security fields, download tickets, or a persistent device identifier. City content and sealed offline photos use short-lived download tickets without a persistent device identifier.
NihaoMap uses PostHog's free plan, whose published event query window is one year. The current project reports no enforced query cutoff; this is not a deletion schedule or a promise of indefinite retention. PostHog distinguishes query retention from deletion and does not offer a shorter window on request. Received events are removed through provider deletion tools; the app has no switch that deletes them, because product analytics has no off switch. Events are attributed to the random installation ID described above, which you can copy out of the app by pressing and holding the version number at the bottom of Settings; send that ID to privacy@nihaomap.com to ask us to delete those records. We will check whether they can be located and deleted. NihaoMap account information is not used to identify analytics records. Without the installation ID, we may not be able to locate your past events. Deleting the local queue or the installation ID does not delete history PostHog has already received. Server-side deletion is asynchronous. See PostHog event retention and data deletion. NihaoMap uses Sentry's free Developer plan, which keeps newly received errors and spans/transactions for 30 days. Data received during the earlier new-account trial retains its original periods: 90 days for errors and 30 days for spans/transactions. A plan change affects new data only. Error removal uses issue deletion, which removes all errors in that issue. Individual spans/transactions cannot be deleted; removing those requires deleting their project. This is not an immediate deletion or backup-erasure guarantee. We can investigate a request using an event ID and approximate time, but cannot reliably locate records by name or email because user identity fields are excluded. See Sentry retention and Sentry deletion.
Feedback records are kept as long as needed to maintain content quality. We generally cannot match feedback to a person unless its content or the information you provide in a deletion request allows us to identify it. For a deletion request, contact privacy@nihaomap.com with the message and approximate sending time. Search matching is performed in response to your request, without a NihaoMap personal search-history store. Hosting providers may retain connection or security logs under their policies. Device preferences and the local copy of your saved places and collections are removed when you delete the app. Saved items that already synced remain in your account until you remove them or delete your account. Map providers apply their own retention periods to data they process under their policies. Downloaded city content, search indexes and photos stay on your device until you delete that city or the app. Deleting a city removes its content and photos no other city uses, and releases its Mapbox offline region; Mapbox may retain underlying map resources in its ordinary cache until the SDK clears them. Deleting a city does not delete your saved places or collections. Incomplete downloads are kept only to resume or retry and are removed when cancelled or no longer needed.
In the app, open Me → Settings → Delete account. You can also use the NihaoMap account deletion page without installing the app. Verify the sign-in method you already use and confirm the request. When we accept it, we stop access to private account features and begin removing your account information, saved places and collections, and associated sign-in data. A receipt means we received the request. Some steps, such as revoking provider access, are processed in the background.
We keep account and saved data while your account is active. Detailed sync receipts are kept for up to 90 days. We keep a limited record of completed deletion for up to 90 days for recovery and to prevent an account being restored by mistake. The current daily backup configuration can retain older copies for up to seven days. If you cannot use the deletion flow, contact privacy@nihaomap.com.
Installed cities, device preferences and map settings are separate from your account. You can remove downloads from Offline cities. Account deletion does not identify or erase unlinked analytics or feedback; the sections above explain how to request those records.
The app is intended for travellers aged 14 and over. It is not directed at children under 14. NihaoMap does not ask for a date of birth or verify a user's age. If you believe a child has provided personal data through the app, contact privacy@nihaomap.com.
If this policy changes, the updated version will be posted at this URL with a new date.
NihaoMap is developed and operated by Guanwei Hao.
Email: privacy@nihaomap.com