To provide push notifications, crash fixing, maps, and voice/video calls, the Xiaoxiang app (operated by 西双版纳大地神韵科技有限公司) integrates the third-party SDKs and open-source components listed below, grouped by whether they send information off your device. Each third party's own privacy statement governs its processing; SDK upgrades may change what is collected, and we will update this page accordingly.
These SDKs send device information to the listed provider, only for the stated purpose. Push channels carry only a fixed wake-up text and a push identifier, never message content.
| SDK / provider | Purpose | Information that may be collected | Applies to |
|---|---|---|---|
| Apple Push Notification service (APNs) apple.com | System push channel on iOS devices (part of iOS, no third-party SDK) | Device push token and VoIP token issued by Apple, app identifier | iOS devices only |
| 华为推送SDK (Huawei Push SDK) (developer: 华为软件技术有限公司) version 6.13.0.301 https://developer.huawei.com/consumer/cn/doc/development/HMSCore-Guides/sdk-data-security-0000001050042177 | System push channel on Huawei devices; on non-Huawei devices it may launch the HMS Core app for the shared connection and authentication | Android ID, basic app information, device model, OS information, system settings, network information, carrier information, SSID, IP address (settings, carrier, SSID and IP processed on the device only) | Huawei devices only |
| 性能加速库 (HMS Core component com.huawei.hms.stats, bundled with Huawei Push) (developer: 华为软件技术有限公司) version 6.13.0.303 https://developer.huawei.com/consumer/cn/doc/development/graphics-Guides/sdk-data-security-0000001050700772 | SDK call statistics and service operation | Device model, EMUI version, Android version, carrier identifier, country code, network connection type, app name, app version, package name, app ID, API call type, HMS Core version, API result code, API latency | Huawei devices only (used together with Huawei Push) |
| 荣耀推送SDK (Honor Push SDK) (developer: 深圳荣耀软件技术有限公司) version 10.0.39 https://developer.honor.com/cn/docs/11002/guides/sdk-data-security | System push channel on Honor devices | AAID, PushToken, APPID, app package name | Honor devices only |
| 小米推送 (Xiaomi Push) (developer: 北京小米移动软件有限公司) version 7.9.2 https://dev.mi.com/distribute/doc/details?pId=1534 | System push channel on Xiaomi devices | Android ID, app package name, version and running state, message creation / delivery / click times and pushed content (fixed wake-up text only), device maker, model, memory, OS version, Mi Push SDK version, device region, SIM carrier name and network type (read on the device only), Wi-Fi state, notification settings | Xiaomi, Redmi and POCO devices only |
| OPPO PUSH 客户端SDK (OPPO Push client SDK) (developer: 广东欢太科技有限公司) version 3.9.8 https://open.oppomobile.com/new/developmentDoc/info?id=11228 | System push channel on OPPO devices | RegisterId, appKey, appSecret, MCS app package name, app package name, app version, push SDK version | OPPO, OnePlus and realme devices only |
| vivo推送SDK (vivo Push SDK) (developer: 维沃移动通信有限公司) version 4.1.7.0 https://dev.vivo.com.cn/documentCenter/doc/878 | System push channel on vivo devices; push-SDK call success statistics | appid, appkey, app package name, app version, push SDK version, vpush regid, device type, OS type and version | vivo and iQOO devices only |
| 魅族推送SDK (Meizu Push SDK) (developer: 珠海星纪魅族信息技术有限公司) version 5.0.5 https://open.flyme.cn/docs?id=202 | System push channel on Meizu devices | Phone brand, model, OS version, system language, device identifier and derived push ID, tags and aliases, app push switch state, message display / dismiss / click data, pushed content held temporarily (fixed wake-up text only) | Meizu devices only |
| Firebase Cloud Messaging (developer: Google LLC) version 26.0.0 https://firebase.google.com/support/privacy | Push channel on devices of other brands, or where the vendor channel is unavailable, that have Google Play services | Firebase installation ID, FCM registration token, app identifier, device model and OS version | Devices with Google Play services only |
| Sentry (native 8.56 / UI layer 8.26; Functional Software, Inc., USA) sentry.io/privacy | Crash and error reports used to fix faults | Device model, OS version, app version, stack trace and time of the error, plus the most recent lines of the app diagnostic log (may include your position at the time and your account identifier); never chat content or phone number | All devices |
| Cloudflare Turnstile (Cloudflare, Inc., USA) cloudflare.com/privacypolicy | Human verification when binding a phone number or email (web widget in an in-app web view, not an embedded SDK) | IP address, browser/device characteristics | All devices, account binding only |
We embed no advertising SDK, behavioural analytics SDK, or third-party sign-in SDK.
These components send nothing to their developers; any network access goes only to our own servers (see Privacy Policy sections 3 and 4).
| Component | Purpose | Licence |
|---|---|---|
| MapLibre Native / MapLibre React Native | Map rendering and navigation UI; tiles and routing come from our servers | BSD-2, open source |
| WebRTC (libwebrtc 144) | Capture, codec and transport for voice/video calls; media relayed via Cloudflare | BSD, open source |
| React Native 0.79 / Expo 53 / Apollo GraphQL client | Runtime for the food-delivery and ride UI | MIT, open source |
| Glide, Fresco, uCrop | Image loading, animated image decoding and cropping; photo picking uses the system photo picker | Apache 2.0, open source |
| GSYVideoPlayer | Video message playback | Apache 2.0, open source |
| ZXing / zxing-lite | Scanning and QR code generation | Apache 2.0, open source |
| OkHttp, Retrofit, Gson, fastjson | Networking and data parsing, our servers only | Apache 2.0, open source |
| XPopup, SmartRefreshLayout, BaseRecyclerViewAdapterHelper, xLog, jsoup, etc. | UI widgets, pull-to-refresh, lists, local logging, HTML text parsing | Apache 2.0 / MIT, open source |
| Font | Where used | Licence |
|---|---|---|
| MiSans (Xiaomi) | Food-delivery and ride UI; dine-in and news web pages | MiSans Font Intellectual Property Licence (free for commercial use) |
| Roboto family (Google) | A few labels inside the chat component | Apache 2.0 |
| System font | Everything else, following your device's font and text-size settings | — |
Infrastructure our own services run on, not code embedded in the app; see Privacy Policy section 3: Amazon Web Services (Singapore region, hosting), Cloudflare (CDN, object storage, real-time media relay, edge protection), and a third-party weather data source (coarse coordinates only).
Questions about this list: privacy@banna.org.
为实现推送、崩溃修复、地图、音视频等功能,「小象」App(西双版纳大地神韵科技有限公司运营)接入了以下第三方软件开发包(SDK)与开源组件。本页按「是否会把信息发出您的设备」分为两类逐一列明;第三方的数据处理规则以其官方说明为准,SDK 升级可能导致收集范围变化,我们会同步更新本页。
以下 SDK 会把设备信息发送给对应的第三方。它们只用于本页写明的目的;推送通道只传送唤醒提醒的固定文案与推送标识,不包含聊天内容。
| SDK / 提供方 | 用途 | 可能收集的信息 | 生效范围 |
|---|---|---|---|
| Apple 推送通知服务(APNs) (Apple) apple.com | iOS 设备的系统级推送通道(iOS 系统自带,无第三方 SDK) | 由 Apple 分配的设备推送令牌与 VoIP 令牌、应用标识 | 仅 iOS 设备 |
| 华为推送SDK (开发者:华为软件技术有限公司) 版本 6.13.0.301 https://developer.huawei.com/consumer/cn/doc/development/HMSCore-Guides/sdk-data-security-0000001050042177 | 华为设备的系统级推送通道;在非华为设备上可能关联启动 HMS Core 应用以建立长连接和身份鉴权 | Android ID、应用基本信息、设备型号、操作系统信息、系统设置信息、网络信息、运营商信息、SSID、IP 地址(系统设置、运营商、SSID、IP 仅在本机处理) | 仅华为设备 |
| 性能加速库 (开发者:华为软件技术有限公司) 版本 6.13.0.303 https://developer.huawei.com/consumer/cn/doc/development/graphics-Guides/sdk-data-security-0000001050700772 | 随华为推送 SDK 一并集成的 HMS Core 基础组件(com.huawei.hms.stats):SDK 接口调用统计与产品运营维护 | 设备型号、EMUI 版本号、Android 版本号、运营商标识、国家码、网络连接类型、应用名称、应用版本号、应用包名、应用 App ID、接口调用类型、HMS Core 版本号、接口调用结果码、接口响应时延 | 仅华为设备(随华为推送调用) |
| 荣耀推送SDK (开发者:深圳荣耀软件技术有限公司) 版本 10.0.39 https://developer.honor.com/cn/docs/11002/guides/sdk-data-security | 荣耀设备的系统级推送通道 | AAID、PushToken、APPID、应用包名 | 仅荣耀设备 |
| 小米推送 (开发者:北京小米移动软件有限公司) 版本 7.9.2 https://dev.mi.com/distribute/doc/details?pId=1534 | 小米设备的系统级推送通道 | Android ID、应用包名、版本号与运行状态、消息创建/送达/点击时间及推送内容(仅固定唤醒文案)、设备厂商、设备型号、设备内存、系统版本、小米推送 SDK 版本、设备归属地、SIM 卡运营商名称与当前网络类型(仅本机读取)、WiFi 状态、通知栏设置 | 仅小米、Redmi、POCO 设备 |
| OPPO PUSH 客户端SDK (开发者:广东欢太科技有限公司) 版本 3.9.8 https://open.oppomobile.com/new/developmentDoc/info?id=11228 | OPPO 设备的系统级推送通道 | RegisterId、appKey、appSecret、MCS 应用包名、应用包名、应用版本号、推送 SDK 版本号 | 仅 OPPO、一加、realme 设备 |
| vivo推送SDK (开发者:维沃移动通信有限公司) 版本 4.1.7.0 https://dev.vivo.com.cn/documentCenter/doc/878 | vivo 设备的系统级推送通道;统计推送 SDK 接口调用成功率 | appid、appkey、应用包名、应用版本号、推送 SDK 版本、vpush 的 regid、设备类型、系统类型与系统版本 | 仅 vivo、iQOO 设备 |
| 魅族推送SDK (开发者:珠海星纪魅族信息技术有限公司) 版本 5.0.5 https://open.flyme.cn/docs?id=202 | 魅族设备的系统级推送通道 | 手机品牌、手机型号、系统版本、系统语言、设备标识符及据此生成的 push ID、标签与别名、应用推送开关状态、消息展示/划掉/点击数据、暂时收集的推送内容(仅固定唤醒文案) | 仅魅族设备 |
| Firebase Cloud Messaging (开发者:Google LLC) 版本 26.0.0 https://firebase.google.com/support/privacy | 非上述品牌、或上述厂商通道不可用且装有 Google Play 服务的设备的推送通道 | Firebase 安装 ID、FCM 注册令牌、应用标识、设备型号与系统版本 | 仅装有 Google Play 服务的设备 |
| Sentry(原生 8.56 / 界面层 8.26) (Functional Software, Inc.,美国) sentry.io/privacy | 崩溃与异常报告,用于修复故障 | 设备型号、系统版本、应用版本、出错时的程序堆栈与时间,以及最近的 App 运行诊断日志片段(可能含当时的位置坐标与账号标识);不包含聊天内容与手机号 | 全部设备 |
| Cloudflare Turnstile (Cloudflare, Inc.,美国) cloudflare.com/privacypolicy | 绑定手机号或邮箱时的人机验证(App 内置网页中的网页组件,非嵌入式 SDK) | IP 地址、浏览器/设备特征 | 全部设备,仅账号绑定时 |
我们没有接入任何广告 SDK、行为分析 SDK 或第三方账号登录 SDK。
以下组件不向其开发方传送任何信息;它们访问网络时只连接我们自己的服务器(见隐私政策第三、四节)。
| 组件 | 用途 | 许可 |
|---|---|---|
| MapLibre Native / MapLibre React Native | 地图渲染与导航界面;瓦片与算路数据来自我们的服务器 | BSD-2 开源 |
| WebRTC(libwebrtc 144) | 语音与视频通话的采集、编解码与传输;媒体经 Cloudflare 中继 | BSD 开源 |
| React Native 0.79 / Expo 53 / Apollo GraphQL 客户端 | 外卖与打车界面的运行时 | MIT 开源 |
| Glide、Fresco、uCrop | 图片加载、动图解码与裁剪;选图使用系统照片选择器 | Apache 2.0 开源 |
| GSYVideoPlayer | 视频消息播放 | Apache 2.0 开源 |
| ZXing / zxing-lite | 扫码与二维码生成 | Apache 2.0 开源 |
| OkHttp、Retrofit、Gson、fastjson | 网络请求与数据解析,只连接我们的服务器 | Apache 2.0 开源 |
| XPopup、SmartRefreshLayout、BaseRecyclerViewAdapterHelper、xLog、jsoup 等 | 界面组件、下拉刷新、列表、本地日志、网页文本解析 | Apache 2.0 / MIT 开源 |
| 字体 | 用在哪里 | 许可 |
|---|---|---|
| MiSans(小米) | 外卖、打车界面;堂食与资讯网页 | MiSans 字体知识产权许可协议(可免费商用) |
| Roboto 系列(Google) | 聊天组件内置的少量界面文字 | Apache 2.0 |
| 系统字体 | 其余全部界面,随您设备的系统字体与字号设置 | — |
以下是我们自己的服务所依赖的基础设施提供方,不是嵌入 App 的 SDK,详见隐私政策第三节:Amazon Web Services(新加坡区域,服务器托管)、Cloudflare(内容分发、对象存储、实时音视频中继、边缘防护)、第三方天气数据源(仅传送粗略坐标)。
对本清单有任何疑问,请发邮件至 privacy@banna.org。