Privacy Policy

Last updated: November 11, 2026

Travel in China (travel-ff.com) is operated by Xingchengli Trading Co., Ltd., Shenzhen, China, published under the FarFlight brand (“we”, “us”). It is an independent English-language guide to China's national 5A-rated scenic areas. This policy explains what information we handle when you visit the site.

Accounts (optional)

Creating an account is optional — you can read everything and post guest comments without one. If you do create an account, we store:

• Email address — used as your sign-in identifier. For accounts created with email and password we do not send verification emails; for Google or Microsoft sign-in we receive the email address those providers share with us.
• Password — stored only as a salted PBKDF2 hash; we never see or store your plain password.
• Nickname — a random travel-themed nickname is generated when you register; you can change it any time from your account page. Comments you post while signed in always display your current nickname.
• Sign-in method — which provider (email, Google, Microsoft) the account uses, and the provider's account identifier for OAuth accounts.

When you register we also create a session: a random token stored in an httpOnly cookie that keeps you signed in for 30 days. This cookie is strictly necessary for the sign-in feature and contains no personal information beyond the random token.

What we do not collect

We do not run advertising trackers, sell personal data, or share it for advertising. We never ask you for card or bank details: all payments are processed by PayPal, and your payment information is entered on PayPal's own secure pages (see “Payments” below). We do not access your Google or Microsoft contacts, files or any other data — social sign-in requests only your email address and basic profile.

Payments (PayPal)

If you make a voluntary contribution or purchase a custom itinerary service, the payment is processed by PayPal as our payment service provider. We never see or store your card, bank or PayPal account details — those are handled entirely by PayPal under the PayPal Privacy Statement.

The donation button on the account page embeds its button content directly from paypal.com, so PayPal receives technical data (such as your IP address and browser information) when the button is displayed. Clicking the button takes you to PayPal’s own secure pages; no payment information ever passes through our site.

• What we receive from PayPal: your name, email address, the transaction amount and date, and the PayPal transaction ID. We use this only to deliver your supporter benefits, keep our payment records, and process refunds.
• Refunds: approved refunds are returned to your original payment method via PayPal — see our Refund Policy.
• Retention: transaction records are kept as long as required for accounting and tax purposes.

Comments and content moderation

Visitors may post comments on attraction pages. When you submit a comment, it is first checked against a fixed list of negative keywords (an automated content filter) and then held for review:

• Review before publication — every new comment is visible only to you until an administrator approves it. Once approved, it is stored in our database and displayed publicly. The data stored is: your display name (your account nickname if signed in, the name you entered, or “Anonymous” if left blank), the comment text, and the submission timestamp. You may request deletion at any time by contacting us with the page and comment details.
• Filtered comments — comments that match the keyword list are never sent to our database and are not stored on our servers. They are cached only in your own browser's local storage, so they remain visible only to you, on your device. No other visitor — on this or any other system — can see them. You can remove them at any time by clearing your browser's site data for travel-ff.com.

Local storage

The site uses your browser's local storage only to keep your own content visible to you on your device: comments filtered by the keyword list, comments you posted as a guest that are still awaiting review, and your guest-session data (favourites, saved travel plans and your guest display name created when you browse as a signed-in guest) (see above). This data stays on your device and is never transmitted to us or to any third party.

Storage access is strictly necessary for the site to function: it keeps you signed in between visits, preserves your favourites and plans on your device, and remembers your nickname. No consent banner is shown because no tracking or non-essential storage is used (ePrivacy Directive / UK PECR “strictly necessary” exemption). You can clear this data at any time in your browser settings without losing your account — only guest-session content on that device will be removed.

Data we never collect

We do not collect and have no reason to process special categories of personal data as defined by GDPR Article 9 (health, ethnicity, religion, political opinions, sexual orientation, biometric or genetic data), nor criminal-record data as defined by GDPR Article 10. The only content you can submit is travel-related text (comments, nicknames, travel-plan inputs). If you accidentally include such information in a comment or a message, contact us and we will delete it.

Security and breach notification

Passwords are stored only as salted PBKDF2-SHA256 hashes; all traffic runs over HTTPS; and access to the production database is limited to the site operators. If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it (GDPR Article 33) and, where the breach is likely to result in a high risk to you, we will also inform you directly and without undue delay (GDPR Article 34).

Service providers

The site is hosted on Cloudflare Pages; accounts, sessions and published comments are stored in a Cloudflare D1 database. Cloudflare processes standard request logs (including IP addresses) as part of delivering the site; their handling of such data is described in Cloudflare's own privacy policy. Social sign-in is processed by Google and Microsoft under their own privacy policies. Payments are processed by PayPal as described in the “Payments” section above. Booking and map links open external services (Trip.com, Amap) that operate under their own privacy policies.

AI travel plans. When you use the “Generate Your Travel Plan” feature, the details you provide (arrival and departure dates and cities, and the attractions you selected) are sent to a third-party AI model service to draft your itinerary. The generated plan is returned to your browser and, if you save it, stored with your account.

Interactive maps. Pages with interactive maps load the AMap (Gaode) map service from China, which receives your IP address and browser information when the map loads, as is standard for embedded map services.

Accounts and saved content. If you register, your e-mail address, a hashed password, your nickname and your sign-in method are stored in the Cloudflare D1 database. Your saved favourite attractions and any travel plans you choose to save are stored with your account in the same database. Contact via WhatsApp (where offered) is processed by WhatsApp/Meta under their own privacy terms.

Children

The site is general-audience travel content and does not knowingly collect personal information from children.

Your rights

Depending on where you live (for example under the GDPR or CCPA/CPRA), you may have rights to access, correct or delete personal data we hold about you. For account data (email, nickname, sign-in method) or comments, contact us and we will delete it — deleting your account removes your ability to sign in; comments you posted remain displayed under your nickname until you ask for their deletion.

You also have the right to restrict or object to the processing of your personal data, the right to data portability, and the right to lodge a complaint with your local data-protection authority. Account data is kept while your account is active; comments are kept until you or an administrator delete them; guest data stays in your browser until you clear it. Where personal data is processed outside your country (for example by Cloudflare, the AI service or the map provider), the transfer relies on the provider’s standard contractual safeguards.

Changes

We may update this policy as site features change; updates will be posted on this page with a revised date.

Contact

Questions, account, deletion, payment or refund requests: candy78hu@gmail.com.