Privacy Policy

1. Who we are

China2BD (china2bd.site) is a community for people in Bangladesh who import and trade products from China: members post what they have or what they need, ask questions and talk to each other, and can ask China2BD for help with an import (Import Assistance). This policy applies to both our website and our mobile app.

China2BD is operated from Bangladesh. Contact: support@china2bd.site

2. What information we collect

• Account: name, email address (if you give one), a one-way hash of your password, username.
• If you log in with Google or Facebook: they give us only your name, your email address (if any) and an account ID. This ID is how we recognise you the next time. We never receive your Google or Facebook password; we do not take your friends list, posts or any other information, and we do not post anything on Google or Facebook on your behalf. An account opened this way may not have a password.
• Profile (optional): photo, bio, district, phone and WhatsApp number, website and Facebook links, business name.
• Content you create: posts, product photos, comments, quotes, leads and reviews.
• Messages: your messages with other members and attached photos.
• Import Assistance and support requests: your name, email, what you want to import or what went wrong, the link to the relevant page, screenshots and our replies.
• Verification documents: if you choose to submit them (NID/trade licence etc.).
• When using the app: a device token for push notifications (FCM) and, if the app crashes, a crash report.
• Technical data: when you open the website or the app, our server and Cloudflare receive your IP address, the page or address requested, the time, and your browser or app version.
• Usage: which pages are viewed and what is searched — to improve the service.

3. Why we collect it

To keep your account running, show posts and price quotes, connect buyers and sellers, answer your Import Assistance and support requests, send notifications, keep the service secure, prevent fraud and spam, and improve the service. We do not sell your information and we do not show advertising.

4. Who can see it

• Everyone sees: your name, username, photo, public posts, business profile.
• Only if you give permission: phone and WhatsApp number — you can control the permission to publish them separately in your profile settings and in the relevant posts.
• The people involved: your messages, quotes and leads. When investigating a complaint, the authorised moderation team may review reported messages and, where necessary, quotes/leads.
• Authorised admins only: verification documents — these are kept in a secure place and cannot be opened directly from the web.
• Support team: the problems you submit, your screenshots and the replies. Private Import Assistance inquiries can be seen only by you and authorised admins. Other members cannot see these.
• Your email address is never shown to other members. Your username is made from your name, not from your email address.

5. Services that handle data for us

We use these providers to run China2BD. Each one receives only what it needs for its job. Some of them process data outside Bangladesh.

• Hostinger: our website, app server and database run on a server we rent from Hostinger in Mumbai, India.
• Cloudflare: all traffic to china2bd.site passes through Cloudflare for domain name service, fast delivery and protection against attacks, so Cloudflare sees your IP address and the pages you request. Cloudflare Web Analytics counts page views on the website without cookies. Cloudflare R2 stores post photos and our encrypted backups, and Cloudflare Workers deliver photos and check that the site is up. Images of private posts or posts under review are not shown in the public feed.
• Resend: sends our emails (email verification, password reset, notifications and replies). It receives your email address and the content of the email.
• Google Firebase: Firebase Cloud Messaging (FCM) delivers push notifications (on iOS together with the Apple Push Notification service), and Firebase Crashlytics receives app crash reports.
• Google and Meta (Facebook): only if you choose to log in with them. They verify your identity and learn that you logged in to China2BD.

We use OpenAI to check whether a post is about China–Bangladesh import and business, and whether it contains political statements or text attacking anyone. Before publication, the text, images and relevant product details of the post you submit are sent to this service. Private messages, quotes and identity verification documents are not sent for this check. If you put personal information in the text or images of a post, that will also be part of the check. If a problem is found on either of these two points, the post is not published and the reason is given immediately; you can correct it or ask for a manual review by our team. If the automated check cannot be completed for the time being, the post is published and checked again later.

6. Mobile app permissions

The camera is used if you want to take a photo, and the system photo picker is used to add photos you choose. The app may ask separately for permission to send Notifications; you can turn this off in your phone's settings. It does not ask for permission to access your contacts list, microphone or GPS location. You provide the selected district or area yourself.

The login token is kept in your phone's secure storage. Firebase Analytics and advertising SDKs have not been added to this app, and the app does not use your phone's advertising ID. If the app crashes, Firebase Crashlytics sends technical details of the crash (phone model, Android/iOS and app version, time and cause of the crash); your name or email is not attached to this. Google and Facebook login use their own SDKs. The Facebook SDK contacts Facebook only when you tap Continue with Facebook (in the app: “Facebook দিয়ে চালিয়ে যান”); Meta then receives the technical device details its login needs, such as the app version and phone model. Its automatic app events and advertising ID collection are turned off. FCM uses information about the app installation and device token to deliver notifications. Private photos and messages can be seen only by the authorised participants; they are not claimed to be end-to-end encrypted.

7. Your control

• You can change or delete any profile information at any time.
• You can stop showing your phone/WhatsApp.
• You can delete your own posts.
• You can block anyone.
• From Google's or Facebook's own settings you can withdraw China2BD's permission at any time. When you delete your account, the connection with Google/Facebook is also deleted.
• You can delete your entire account — see here how.

8. Security and how long we keep data

A one-way hash of your password is kept, the connection is protected by HTTPS, and verification documents are kept in separate secure storage.

• Your account and content: kept while your account exists. When you delete your account, your public profile and posts are removed at once and stored files are removed by a background cleanup, normally within minutes.
• Encrypted backups: made every night and deleted automatically after 35 days. If we ever have to restore a backup, account deletions are applied again.
• Server logs (IP address, page requested, time, browser or app version): deleted after 14 days.
• Crash reports (Firebase Crashlytics): deleted after 90 days.
• Push notification token: deleted when you log out of the app or delete your account.

Some records of earlier quotes, leads, reports and support requests may remain after deletion, without your name; details are on the account deletion page.

9. Use by children

This is a business platform. It is not for people under 18.

10. Contact

If you have a question or a request about your information, write to support@china2bd.site or tell us through Support. We reply within 14 days.