DParking Privacy Policy

Important Notice

We process personal information only for lawful, fair, transparent, and necessary purposes described in this policy and related to DParking services.
When you first launch the app, you will see a privacy notice. The app does not enter business flows, request Bluetooth or location permissions, scan Bluetooth devices, start Google Sign-In, or send business API requests before you have reviewed the notice and actively agreed where consent is required.
Runtime permissions, including Bluetooth and location permissions, are requested only when you use features that require them, and you can deny or later revoke them in system settings.
The Google Play international build supports account creation, phone/password login, Google Sign-In, Bluetooth lock control, offline lock control, lock management, sharing or authorization, records, account management, manual lock location entry, local cache, and network synchronization.
The Google Play international build is not configured to enable WeChat login, WeChat mini program flows, WeChat payment, WeChat sharing, WeChat withdrawal, Aliyun fusion one-tap login, advertising SDKs, or marketing push SDKs.
The Google Play international build does not declare READ_PHONE_STATE, does not query whether WeChat is installed, does not request QUERY_ALL_PACKAGES, and does not read the full installed-app list.
This Privacy Policy is publicly accessible without login. Google Play Console Data safety declarations for DParking must remain accurate, complete, and consistent with this policy and the actual behavior of the published Google Play build.

1. Core Features and Necessary Information

DParking provides account-based Bluetooth parking lock management. The core service lets users create or sign in to an account, bind supported parking lock devices, search for and connect to Bluetooth locks, control locks, use offline lock control when supported, manage locks, authorize or share access, and view operation records.

Category	Information involved	Purpose
Account and authentication data	Phone number, country or region code, verification code, password or password digest, login token, refresh token, session provider, locally generated sessionDeviceId, Google ID token, Google email, display name, and avatar URL if returned by Google and used to complete DParking sign-in	Account registration, sign-in, account linking, account display, session maintenance, security checks, and Google Sign-In.
Parking lock and Bluetooth data	Lock ID, binding code, parking space number, lock state, Bluetooth device name, Bluetooth advertising data, Bluetooth device identifier, connection state, command result, offline-controllable flag	Lock binding, Bluetooth search and connection, lock control, offline lock control, lock management, authorization, sharing, and records.
Manual parking setup data	Parking lot or location text entered by you, parking space number, floor, and related lock setup fields	Binding locks and helping you manage lock location labels. The current Google Play build does not collect business location coordinates for lock setup.
Device, network, and diagnostics data	Device model, operating system version, app version, network connection type or availability, API request metadata, error logs, security logs	Compatibility, troubleshooting, account security, fraud prevention, service stability, diagnostics, and online/offline flow handling.

2. How We Collect and Use Information

2.1 Account registration, login, and security

Information type	Use	Required?	Effect if unavailable
Phone number, country or region code, SMS verification code, captcha, captcha session cookie, login password or password digest	Registration, password login, verification, password reset, phone number change, and account security checks	Required for phone-based account features	You may be unable to register, sign in, reset your password, or change your phone number.
Login token, refresh token, session provider, account identifier, locally generated sessionDeviceId, device model, OS version	Maintaining sessions, refreshing login state, identifying the same device session, compatibility, troubleshooting, and security risk control	Required for secure account services	You may need to sign in again, or the app may be unable to restore your session after network recovery.
Nickname, avatar, account profile fields, Google email if provided through Google Sign-In	Displaying account information, distinguishing accounts, and managing authorization	Optional or generated by use	Basic lock control is not affected, but account display information may be incomplete.

2.2 Google Sign-In

Information type	Use	Required?	Effect if unavailable
Google authentication result, Google ID token, Google email, Google display name, Google avatar URL, platform value, and app package and app signature information used by Google Sign-In	Verifying your identity with Google, creating or linking your DParking account, and signing you in through our business server	Required only when you choose Google Sign-In	You can use phone/password login instead if Google Sign-In is unavailable or canceled.

Google Sign-In is triggered only when you tap the Google login option. We do not receive your Google password. Google may process information according to Google's own policies. We receive only the authentication and profile information needed to verify your identity and complete DParking login.

2.3 Bluetooth lock control, offline lock control, and lock management

Information type	Use	Required?	Effect if unavailable
Bluetooth permission state, nearby Bluetooth device advertising data, Bluetooth device name, Bluetooth device identifier for nearby devices, connection state, service and characteristic status	Searching for supported parking lock devices, connecting to a selected lock, and sending control commands locally over Bluetooth	Required for Bluetooth lock control	You cannot search for, connect to, or control a lock over Bluetooth.
Lock ID, binding code, parking space number, parking lot name, lock state, rise/drop command, command result, operation time, offline-controllable flag, pending offline report	Binding and managing locks, showing lock status, controlling locks, enabling supported offline control, and synchronizing operation records after network recovery	Required for lock features	You may be unable to bind, manage, control, or synchronize lock records.
Wake lock state during lock control	Keeping the screen awake while a lock operation is in progress	Required only during active lock control	The screen may sleep during a lock operation.

2.4 Adding locks and manual location entry

Information type	Use	Required?	Effect if unavailable
Parking lot or location text, parking space number, floor, lock ID, and binding code entered by you	Binding a lock and displaying a human-readable lock location label	Required for adding a lock	You may be unable to bind or identify the lock location label.

The current Google Play build does not provide map, place search, auto-location, nearby parking-place matching, reverse geocoding, or business coordinate collection for lock setup. Bluetooth scanning on Android 12 and later uses Bluetooth permissions; on older Android versions, location permission and location services may be required by the operating system for Bluetooth discovery.

2.5 Records, sharing, and online services

Information type	Use	Required?	Effect if unavailable
Lock operation records, authorization records, sharing records, parking or rental-related records if generated by your use, timestamps, operation result, network sync status	Displaying records, managing shared access, synchronizing lock events, handling disputes, troubleshooting, and security auditing	Generated when using related features	Related records, shared access, or synchronization features may be incomplete.
Business API request parameters and responses, account token, lock ID, operation result, app version, network state	Communicating with DParking servers for account, lock, record, deletion, and synchronization services	Required for online services	Online login, synchronization, and account services may be unavailable.

We do not deny basic features because you decline non-essential information. However, if certain information is necessary for a feature, that feature may not work without it.

3. Android Permissions Used by the Google Play Build

Permission or capability	Purpose	When requested or used	Effect if denied
BLUETOOTH, BLUETOOTH_ADMIN, BLUETOOTH_SCAN, BLUETOOTH_CONNECT	Searching for, connecting to, and controlling supported Bluetooth parking lock devices	When you enter Bluetooth lock control or related device operations	The app cannot search for, connect to, or control Bluetooth locks.
ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION	Bluetooth discovery support on older Android versions only; no background location is requested and business coordinates are not collected in this build	Only on OS versions that require location permission for Bluetooth scanning	On some older OS versions, Bluetooth discovery may be unavailable.
INTERNET	Account login, Google login verification with our server, lock list, records, account deletion requests, privacy policy access, security checks, and data synchronization	When online services are used	Online account and sync features cannot work.
ACCESS_NETWORK_STATE	Detecting network availability to support online/offline behavior	When the app needs to decide whether to use online services or cached/offline flows	The app may be less accurate in showing online/offline state.
WAKE_LOCK	Keeping the screen awake during active lock operations	Only during related lock-control flows	The screen may sleep during control operations.

The Google Play international build does not declare READ_PHONE_STATE, BLUETOOTH_ADVERTISE, QUERY_ALL_PACKAGES, ACCESS_BACKGROUND_LOCATION, or ACTION_PROCESS_TEXT processing queries.

4. Third-Party SDKs, Plugins, and Services

We use the following third-party SDKs, open-source plugins, or services to provide app functionality. We configure them for the minimum scope needed for the corresponding feature and reflect their data processing in Play Console Data safety declarations where applicable.

Name	Provider / type	Purpose	Information that may be processed	Sharing or transmission	Status in Google Play build
Google Sign-In	Google LLC / authentication SDK	Google account authentication for DParking login	Google authentication result, ID token, email, display name, avatar URL, app package and signature information	Information is processed by Google. The Google ID token and profile information needed for login are sent to our business server to verify and complete DParking sign-in.	Enabled when configured for Google Play login. See Google Privacy Policy.
DParking business APIs	Nanjing Tongyudao Technology Co., Ltd.	Account, lock, records, synchronization, Google login verification, and account deletion services	Account credentials, tokens, lock information, operation records, API request data, app version, network state	Sent to DParking servers through HTTPS business APIs.	Enabled for online services.
flutter_blue_plus	Flutter Bluetooth plugin	Calling system Bluetooth APIs for parking lock search, connection, and control	Bluetooth advertising data, device identifier, and connection status	Not sent to the plugin author by the plugin itself; local system Bluetooth APIs are used.	Enabled for local Bluetooth communication.
permission_handler	Flutter permission plugin	Requesting and checking Bluetooth and legacy Android location permission and service states	System permission and service status	Not sent to the plugin author by the plugin itself.	Enabled for permission flow control.
connectivity_plus	Flutter network status plugin	Checking network connection state for online/offline behavior	Network connection type and availability	Not sent to the plugin author by the plugin itself.	Enabled for network state handling.
device_info_plus	Flutter device information plugin	Getting device model and OS version for compatibility, troubleshooting, and security	Device model and operating system version	Not sent to the plugin author by the plugin itself; may be sent to our server for compatibility, security, or diagnostics when needed.	Enabled. We do not read IMEI, IMSI, MAC address, OAID, contacts, SMS, or call logs.
dio	Flutter HTTP client	Accessing DParking business APIs	API request parameters, tokens, and responses	Sent to DParking business servers through HTTPS.	Enabled for network requests.
url_launcher	Flutter URL launcher plugin	Opening privacy policy, account deletion help, and external web links selected by users	URL to be opened	Not sent to the plugin author by the plugin itself. The target website processes information under its own rules.	Enabled only when you tap a link.
wakelock_plus	Flutter wake-lock plugin	Keeping the screen awake during active lock control	Screen wake-lock state	Not sent to the plugin author by the plugin itself.	Enabled for active lock-control flows.
flutter_secure_storage / shared_preferences	Flutter local storage plugins	Storing login state, privacy consent state, language preference, selected lock, settings, and offline cache locally	Token, refresh token, account identifier, password digest where applicable (never plaintext password), sessionDeviceId, preferences, selected lock, offline pending records	Stored on your device. The plugins do not transmit this information to their authors.	Enabled for local persistence.

The codebase may contain compatibility modules for domestic distribution, including WeChat and Aliyun fusion authentication. In the Google Play international build, these capabilities are not included in the active runtime configuration, and related Android manifest entries are removed or not declared for the intl flavor.

5. Information We Do Not Collect in the Google Play Build

The Google Play international build does not read or collect contacts, SMS messages, call logs, photo or media library contents, clipboard contents, IMEI, IMSI, MAC address, OAID, advertising ID for advertising, background location, or a full installed-app list. The current Google Play build does not include advertising SDKs, third-party analytics SDKs, or marketing push SDKs, and does not use personal information for advertising profiling.

6. Data Sharing, Sale, and Disclosure

We do not sell personal information or personal and sensitive user data.
We share data only as needed with the service providers described in this policy to provide requested features, comply with legal obligations, protect users and services, or process requests made by you.
Google receives or processes authentication information when you choose Google Sign-In; we do not send your DParking password to Google.
Our business servers receive account, lock, operation, synchronization, and account deletion information necessary for online DParking services.
If our company is involved in a merger, division, acquisition, asset transfer, or similar transaction, we will require the new holder of personal information to continue following this policy or obtain your consent where required.
We do not publicly disclose your personal information unless you consent or disclosure is required by law, court order, government authority, or legitimate security and compliance needs.

7. Storage, Security, and Retention

Transmission security: We use HTTPS or equivalent secure channels for DParking business API communication. Local Bluetooth lock commands are sent to the selected lock device through the operating system's Bluetooth stack.
Local storage: Login state, privacy consent state, language preference, selected lock, settings, and offline pending records may be stored on your device. You can clear local data by signing out, clearing app data, or uninstalling the app.
Protection measures: We use reasonable technical and organizational measures such as access control, transport encryption, permission separation, and log minimization to protect personal information.
Security incidents: If a personal information security incident occurs, we will handle and notify users as required by applicable law.

Information type	Retention period
Account information, phone number, country or region code, login credentials	Kept until account deletion, user data deletion request, or completion of the processing purpose, unless retention is required by law or security obligations.
Login token, refresh token, session provider, sessionDeviceId, account identifier, password digest, Google login binding data	Kept until sign-out, app data clearing, uninstall, account deletion, token expiration, or completion of the processing purpose. After account deletion, data is deleted or anonymized unless legally required to retain it.
Privacy consent state, language preference, and local settings	Kept until you clear app data, uninstall the app, or reset the related setting.
Captcha, SMS verification code, and verification session cookie	Used only for short-term verification and not used for business after expiration.
Lock ID, binding code, parking space number, parking lot name, selected lock, and offline-controllable flag	Kept until you unbind or delete the lock, delete your account, or the processing purpose is complete.
Bluetooth scan result and connection state	Used temporarily during search, connection, and control. Generally not stored long term.
Manual parking location text and parking space number	Used during lock setup and retained until you unbind or delete the lock, delete your account, or the processing purpose is complete.
Authorization records, sharing records, parking or rental-related records, operation records, and offline pending records	Kept until deletion, account deletion, or the period necessary for dispute handling, security auditing, and legal compliance. Offline pending records are cleared after successful sync, app data clearing, expiration, deletion, or anonymization.
API logs, error logs, and security logs	Kept for the period necessary for troubleshooting, security auditing, anti-fraud, legal compliance, and service stability, then deleted or anonymized.

8. Google Play Data Safety Alignment

Google Play requires developers to declare how apps collect, share, and protect user data in Play Console. DParking's Google Play Data safety form must be completed accurately and kept consistent with this policy, third-party SDK behavior, and the actual published Google Play build.

Data collection may include account identifiers, phone number, account creation and authentication data, Google profile data used for sign-in, lock and Bluetooth data, manual parking location text, app activity records, device information, network state, and diagnostics. Location permission may be processed as an OS prerequisite for Bluetooth discovery on older Android versions.
Data sharing with third parties may include Google for Google Sign-In. DParking business servers process data as first-party service infrastructure for account and lock services.
DParking business API data is transmitted through HTTPS or equivalent secure channels; local Bluetooth communication is limited to the selected lock device.
Users can request account and associated data deletion through the in-app path and through the web resource or contact method below, including after uninstalling the app.
The Data safety form should also reflect that some data processing is optional and depends on whether the user uses Google Sign-In, Bluetooth lock control, manual lock setup, or online synchronization.

9. Your Rights and Account Deletion

Access and review: You can view account information, lock information, and related business records in the app.
Correction: If your account or lock information is incorrect, you can update it in the app where supported or contact us by email.
Permission withdrawal: You can disable Bluetooth, location, and other permissions in system settings. After withdrawal, related features may not work, but this does not affect prior processing based on valid permission or consent.
Sign-out and local data clearing: You can sign out, clear app data, or uninstall the app to clear local login state, settings, and offline cache. Data already synchronized to servers is handled according to this policy and applicable law.
Account deletion in the app: You can initiate account deletion through Personal Center / Account Settings / Delete Account in the app.
Account deletion outside the app: You can request account and associated data deletion from this public web resource by emailing support@dingdingtingche.com.cn with the subject "DParking Account Deletion Request" and the account phone number or Google email you used to sign in. This deletion request path remains available even if you have uninstalled the app: https://www.dingdingtingche.com/privacy_policy_google_play.html#account-deletion.
Identity verification: To protect your account, we may ask you to verify your identity before processing access, correction, deletion, or account deletion requests.
Response time: After receiving your request and completing identity verification, we will complete the request or explain its status within a reasonable period, generally within 15 business days unless applicable law requires or permits a different period.

Account deletion is irreversible. After deletion is completed, we will stop providing services for the deleted account and delete or anonymize server-side account information, login credentials, Google binding data, lock binding data, and related personal information associated with that account. Data that must be retained for legal, security, anti-fraud, accounting, dispute-resolution, or compliance reasons will be retained only for the required period and then deleted or anonymized.

10. Children and Minors

DParking is intended for users who are legally able to manage a parking lock account and related device services and is not directed to children under 13 or the equivalent minimum age in the user's jurisdiction. We do not knowingly target children or knowingly collect children's personal information. If you are a minor, use DParking only with guidance and consent from your parent or legal guardian. If a parent or guardian believes that a minor's information has been collected or used improperly, please contact us so we can handle the request.

11. Policy Updates

We may update this Privacy Policy when app features, data practices, third-party SDKs or services, legal requirements, or Google Play requirements change. If there are material changes to the purpose, method, type of personal information processed, third-party sharing, or sensitive information processing, we will provide notice through the app, website, or other appropriate means, update related Play Console declarations where required, and obtain consent where required.

12. Contact Us

Developer / operator: Nanjing Tongyudao Technology Co., Ltd. (南京同臾道科技有限公司).
Privacy contact email: support@dingdingtingche.com.cn.
Mailing address: No. 21 Lidao Road, Taishan Street, Jiangbei New Area, Nanjing, Jiangsu, China.
You may also submit related requests through the app's account settings, privacy policy entry, or account deletion entry.

13. Service Terms Summary

This summary explains basic service rules and does not replace this Privacy Policy. DParking is operated by Nanjing Tongyudao Technology Co., Ltd. for account creation and login, Google Sign-In, Bluetooth parking lock control, offline lock control, lock management, authorization, sharing, records, account management, and related services.
You should keep your account, password, verification codes, Google login state, and lock binding information secure. You are responsible for activities performed through your account.
You must not transfer or lend your account, misuse the service, infringe others' rights, interfere with platform operation, or use DParking for illegal or unauthorized purposes.
Bluetooth lock control, offline lock control, Google Sign-In, and network synchronization depend on phone system permissions, network availability, third-party service status, lock hardware status, and on-site parking conditions. Related features may be limited if required permissions are denied or external conditions are unavailable.
The Google Play build does not provide WeChat login, WeChat mini program flows, WeChat payment, WeChat sharing, WeChat withdrawal, Aliyun fusion one-tap login, or in-app withdrawal features. If these features are added to a future Google Play build, we will update this page and related in-app disclosures before enabling them.
If any part of this page is invalid or unenforceable, the remaining parts remain effective to the extent permitted by applicable law.