GridOne Privacy Policy

Chengdu Xiyu Technology Co., Ltd.

Entity Information

In this Privacy Policy, "we", "us", and "our" refer to Chengdu Xiyu Technology Co., Ltd. (hereinafter referred to as "we" or "GridOne").

App Operator/Developer: Chengdu Xiyu Technology Co., Ltd.
Contact: hi@gridoneapp.com

If you have any questions, comments, or suggestions regarding this Privacy Policy, please contact us using the information above.

1. Introduction

1.1 This GridOne Privacy Policy (hereinafter referred to as "this Privacy Policy") applies to all products of GridOne, including the GridOne website, iOS applications, and Android applications.

1.2 Please carefully read and fully understand this Privacy Policy in its entirety before using GridOne's products and/or services. Once you use or continue to use GridOne's products/services, you are deemed to have agreed that Chengdu Xiyu Technology Co., Ltd. (hereinafter referred to as "we") will use and process your relevant information in accordance with this Privacy Policy.

2. Definitions

Unless otherwise agreed, the terms used in this Privacy Policy generally have the following definitions:

2.1 Personal Information (pursuant to GB/T 35273-2017 Information Security Technology — Personal Information Security Specification): means information recorded electronically or otherwise that can identify a specific natural person, alone or together with other information, or reflect that person's activities. This Policy treats only information expressly listed in the actual business scenarios below as within the collection and use scope.

2.2 Sensitive Personal Information (pursuant to GB/T 35273-2017 Information Security Technology — Personal Information Security Specification): means personal information that may endanger personal or property safety or otherwise harm an individual's rights if leaked, unlawfully provided, or misused. The sensitive personal information we actually process is limited to the specific business scenarios described below.

2.3 Device: refers to any device used to access our products and/or services, such as desktop computers, laptops, tablets, or smartphones.

2.4 IP Address: Every device connected to the internet is assigned an Internet Protocol (IP) address. A server may receive the IP address when you access a network service.

2.5 SSL (Secure Socket Layer) is a security protocol implemented over TCP/IP communications.

2.6 Cookies are small data files stored on your device when you log in to or use a website or other online content. Similar technologies include web beacons and embedded scripts.

2.7 Account: When you register and provide the required information, the system uses account information to authenticate you and prevent unauthorized access.

2.8 De-identification/Anonymization means technical processing that prevents identification without additional information or makes processed information impossible to restore.

2.9 Server Logs: When you access a network service, the server may record network requests, IP address, client or browser type, and request date and time to deliver the service, protect security, and troubleshoot failures.

3. How We Collect and Use Your Personal Information

3.1 GridOne collects and uses personal information that you actively provide during the use of our services or that arises from the need to provide products and/or services, in accordance with laws and regulations and following the principles of legitimacy, legality, and necessity. If we intend to use your personal information for purposes not specified in this Privacy Policy, or to use the collected information for other purposes based on specific objectives, we will promptly inform you in a reasonable manner and obtain your consent again before such use.

3.2 The types of personal information we collect and use fall into two categories: Category One: information necessary for the core business functions of our products and/or services. Such information is essential for the normal operation of the products and/or services, and you must authorize us to collect it. If you refuse to provide it, you will be unable to normally use our products and/or services. Category Two: information that may need to be collected for additional business functions. This is information required for non-core business functions, and you may choose whether to authorize us to collect it. If you refuse to provide it, the additional business functions may not be realized or may not achieve the intended effect, but it will not affect your normal use of the core business functions.

3.3 Typically, we collect and use your personal information in the following scenarios:

3.3.1 Account Registration (1) When you register and log in to a GridOne account, you need to complete a series of registration procedures according to our guidance. During this process, you need to provide us with the following information: account nickname, mobile phone number, or email address (sensitive personal information, used to receive verification codes and verify personal identity). Only by providing accurate and truthful information described above can you successfully register a GridOne account and use the core functions of our products and/or services. If you choose not to provide the above information necessary for realizing GridOne's core product functions, we may be unable to provide you with these core product functions. (2) Our products support login using third-party platform accounts (WeChat account). If you log in using a third-party platform account, we will obtain relevant information under that third-party account based on your authorization (including: username, nickname, profile picture, etc.) as well as identity verification information (sensitive personal information). We undertake that the collection of the above information is used to provide you with account login services and to protect the security of your account against security risks. If you refuse to authorize such information, you will be unable to log in to our platform using the third-party platform account, but this will not affect the normal use of other products and services we provide. (3) At the same time, you need to understand that mobile phone numbers or email addresses and verification code matching results constitute your sensitive personal information. We collect such information based on the relevant requirements of laws and regulations. If you refuse to provide it, you may be unable to register an account and use relevant product features. Please carefully consider before making your choice.

3.3.2 Clipboard description metadata: The Android App uses Android System WebView to display its launch animation, User Agreement, Privacy Policy, and membership pages. On some Android System WebView versions, when WebView receives window focus, the system component calls ClipboardManager.getPrimaryClipDescription() and reads the current clipboard description metadata (data type/MIME type only) for WebView input-compatibility checks. This call does not read clipboard text, images, passwords, sharing codes, links, or other clipboard content. GridOne does not store, upload, or share clipboard content with third parties.

3.4 Third-Party SDKs and System Components

To provide account login, payment, web content, voice, and network communication functions, we may use the following third-party SDKs or system components. Components may differ by distribution channel.

3.4.1 Android System WebView

Provider: Android system component provided by Google or the device manufacturer.
Channel: Android distributions.
Purpose: Display the User Agreement, Privacy Policy, membership pages, and launch animation inside the App.
Information processed: IP address, User-Agent, access time, and network-request logs sent to the page server when an online page is loaded; clipboard description metadata (data type/MIME type) that WebView may read when it receives window focus.
Processing method and purpose: Network information is used to deliver web content and protect service security. Clipboard description metadata is accessed automatically by the system WebView for input-compatibility checks. See Section 3.3.2 for the exact clipboard processing scope.

3.4.2 WeChat Android SDK 6.8.0

Provider: Tencent Technology (Shenzhen) Co., Ltd. and the WeChat Open Platform.
Channel: Mainland China distribution.
Purpose: WeChat account login, identity verification, and WeChat Pay.
Information that may be processed: When you actively choose WeChat login or payment, information necessary to provide the selected authorization or payment function. Specific fields are governed by the SDK privacy guidelines published by the WeChat Open Platform.

3.4.3 Other Android System Services

Android text-to-speech services: Used to detect whether a usable text-to-speech engine is available; the name or package name of an available TTS engine may be processed locally to select a voice service.
Calendar services: Used to create, read, or delete the relevant calendar event when you actively use race-reminder features.
Device environment information: The App reads device brand and manufacturer locally for Home Screen widget adaptation, device-specific compatibility checks, and troubleshooting. First-party code does not upload these fields to the server.

Our current audit of the Android App's first-party code found no active reading of IMEI, hardware serial numbers, device MAC addresses, or Android ID. The exact processing scope of third-party SDKs is governed by their official privacy guidelines and actual runtime test results. If that scope changes, we will update this Policy and obtain authorization where required by law.

4. Payments

When you make payments on GridOne, such as subscribing to monitoring services or purchasing goods, payment functionality is required. During the payment process, we may collect the user ID of your third-party payment channels (e.g., Apple user ID, Alipay user ID, WeChat Open ID) (sensitive personal information). The above information is necessary for us to provide you with the goods and/or services you purchase. We cannot solely obtain your personal property information or identify a specific natural person's identity based on this information alone.

We value the protection of your personal information. Your personal information is an important basis and component for us to provide you with products and/or services. We only collect and use your personal information within the purposes and scope described in this Privacy Policy or as required by laws and regulations, and we maintain strict confidentiality. Normally, we will not share your personal information with any company, organization, or individual, except in the following circumstances:

5.1.2 Where we have obtained your explicit authorization or consent in advance;

5.1.3 Where sharing is required in accordance with applicable laws and regulations, legal procedures, mandatory government orders, or judicial rulings;

5.1.4 To the extent required or permitted by law, where it is necessary to provide your personal information to third parties to protect the interests, property, or safety of GridOne and its users or the general public from harm;

5.1.5 Your personal information may be shared among our affiliated companies. We will only share necessary personal information, and such sharing is also subject to the purposes stated in this Privacy Policy. If an affiliated company wishes to change the purposes for processing personal information, it will seek your authorization and consent again.

5.2 Transfer

We will not transfer your personal information to any company, organization, or individual unless we obtain your explicit consent. In the event of a merger, acquisition, or bankruptcy liquidation, personal information may be involved in transfers. In such cases, we will require the new company or organization holding your personal information to continue to be bound by this Privacy Policy. If any changes are made to the manner in which personal information is collected or processed under this Privacy Policy, the company or organization will seek your authorization and consent again.

5.3 Public Disclosure

5.3.1 Public disclosure refers to the act of releasing information to the public or unspecified groups. Except for necessary disclosures such as announcing penalties for violating accounts or fraudulent activities, or publishing de-sensitized winner lists, we will not publicly disclose your personal information. If there are reasonable grounds that require public disclosure, we will inform you before the disclosure of the purposes and categories of information to be disclosed (if sensitive personal information is involved, we will also inform you of the content of such information), and we will only proceed with public disclosure after obtaining your authorization and consent, unless otherwise provided by laws and regulations or this Policy.

5.3.2 For the public disclosure of your personal information, we will carefully review its justification, reasonableness, and legality upon receiving a public disclosure application and will take the strictest personal information security protection measures and means during and after the public disclosure to protect it.

Please be aware that, in accordance with laws and regulations, your prior authorization and consent is not required for sharing, transferring, or publicly disclosing your personal information in the following circumstances:

5.4.1 Directly related to national security or national defense security;

5.4.2 Directly related to public safety, public health, or major public interests;

5.4.3 Directly related to criminal investigation, prosecution, trial, and execution of judgments; or as required by laws and regulations, or by competent authorities such as administrative organs, public security, procuratorates, or courts;

5.4.4 For the protection of the life, property, or other major legitimate rights and interests of you or other individuals where it is difficult to obtain your consent;

5.4.5 Personal information that you have voluntarily made public or that has been collected from legally publicly available sources (such as legitimate news reports, government information disclosure, etc.);

5.4.6 As necessary for the conclusion and performance of relevant agreements or other written documents with you;

5.4.7 Other circumstances as provided by laws and regulations.

6. Storage and Protection of Your Personal Information

6.1 Information Storage

6.1.1 Storage Location: In accordance with laws and regulations, we will only store the personal information collected about you within the territory of the People's Republic of China. Currently, we do not have any scenarios involving cross-border storage of your personal information or the provision of personal information to overseas parties. If cross-border data transfer is truly necessary, we will separately and explicitly inform you (including the purpose of data export, the recipient, methods and scope of use, content to be used, security measures, security risks, etc.), obtain your authorization and consent, and ensure that the data recipient has adequate data protection capabilities to protect your personal information.

6.1.2 Storage Period: We retain your personal information for the shortest period necessary to fulfill the purposes of providing products and services. For example, when you use our registration and membership features, we need to collect your mobile phone number, and we need to continuously keep your mobile phone number during the period you use this feature to provide you with the feature normally and to protect the security of your account and system. In addition, we may retain your relevant information for the necessary period as prescribed by relevant laws (for example, the E-Commerce Law requires that information on goods and services and transaction information be kept for no less than three years from the date of completion of the transaction).

6.1.3 After exceeding the above storage period, we will delete or anonymize your personal information.

6.2 Information Protection

6.2.1 The security of your personal information is of vital importance to us. We will strictly comply with relevant laws and regulations and adopt industry-recognized, reasonable, and feasible measures to protect your personal information, preventing unauthorized access, disclosure, use, or modification, and avoiding damage or loss of information.

6.2.2 We use industry-standard security measures to protect the personal information you provide, preventing data from unauthorized access, public disclosure, use, or modification, and preventing damage or loss of data. We will take all reasonable and feasible measures to protect your personal information. For example, we use SSL encryption to protect data; we have established access control mechanisms to ensure that only authorized personnel can access personal information; and we periodically hold security and privacy protection training sessions to strengthen employee awareness of the importance of protecting personal information.

7. Permission Description

7.1 Calendar permission: When you actively enable race reminders and choose to add them to the system calendar, the App may request calendar read/write permission to create, read, and delete the relevant race events. Refusing this permission does not affect other core features.

7.2 Notification permission: When you actively enable race reminders or live notifications, the App may request notification permission to send race-start, countdown, and service-status notifications. Refusing this permission does not affect other core features.

7.3 Network permission: The App uses network access for account, schedule, news, weather, and live-timing services and may generate IP addresses, request times, and network logs.

7.4 Overlay permission: When you actively enable the live-timing floating window, the App may request permission to display over other apps for live race information. Refusing this permission does not affect other core features.

7.5 Storage and media: The App accesses relevant media or files only when required for image caching, cache clearing, profile-photo capture, or file selection. Refusing this permission does not affect other core features.

8. Account Cancellation

8.1 Users may cancel their accounts on their own through user-side settings (except as otherwise provided by relevant laws and regulations or by this Agreement and various site rules). Account cancellation will be completed immediately.

8.2 Special Reminder: After canceling your GridOne account, you will no longer be able to log in to and use all products and services of GridOne and its affiliated companies, as well as services cooperating with third parties within the products and services, using this account. GridOne will also simultaneously terminate the provision of our various products and services to you under this account. This will inevitably cause inconvenience for your after-sales rights protection. Furthermore, once the cancellation of a GridOne account is completed, it cannot be restored. Please carefully consider before cancelling.

8.3 If you are certain that you need to cancel your GridOne account, you have fully understood and confirmed that the UID will still exist after account cancellation, but you will no longer have account-related rights and interests, including but not limited to:

8.3.1 After account cancellation, you will no longer be able to log in to and use all products and services of GridOne using this account;

8.3.2 After account cancellation, GridOne has the right to no longer provide users with any services related to the account;

8.4 Before you apply to us for cancellation of your GridOne account, in order to protect the security of your account and property rights and interests, you need to first check and ensure that the account you apply to cancel simultaneously meets the following conditions, including but not limited to:

8.4.1 The account was registered by the user through official channels, complies with this Agreement and relevant regulations, and is your own member account;

8.4.2 You follow the cancellation process required by customer service;

8.4.3 The account is in a secure state, including: it is not in the process of applying for a password recovery or mobile phone number change; there are no unprocessed complaints or reports; and no other unsafe/abnormal states exist;

8.4.4 If the account had subscribed to "continuous monthly/annual" services, you have already canceled such services on your own;

8.4.5 Other conditions that should be satisfied.