PRIVACY & DATA

Privacy & data use

Last updated: 28 September 2026

Member sign-in and accounts

When sign-in is enabled, you can use Google or Apple. Enter your password only with that provider. GoJoy verifies the provider identifier and uses the available display name to create your member account. We do not request your provider password or permission to read your email address. If Apple does not return a name, we keep your existing display name or use GoJoy Member.

GoJoy stores the sign-in provider, a GoJoy member ID derived from the provider identifier, display name, account role, creation and latest sign-in times, revision and session control data, and role-change records in AWS. Provider credentials and any additional data returned during sign-in are processed only for verification; access tokens, identity tokens and email addresses returned by Google or Apple are not stored in those member records. Different sign-in providers create separate accounts and are not linked by name or email. Roles control editing, moderation and administration permissions.

Email registration and account recovery

When email registration is enabled, you provide a display name and email address and complete CAPTCHA verification. We send an activation link to that address. The link holder must choose a password and complete CAPTCHA before the account is activated; opening the link alone does not activate or sign in to an account. Email sign-in, activation resends and password recovery also require CAPTCHA. Email accounts remain separate from Google and Apple accounts and are not automatically merged by address or name.

Email member records in private AWS storage include the email address, chosen display name, verification status and time, account role, creation and sign-in times, and session control data. Passwords are stored only as individually salted scrypt hashes, never as readable passwords. Activation and reset tokens are stored only as hashes, are single-use, and expire after 24 hours and 30 minutes respectively. Resetting a password revokes existing member sessions. Unverified accounts cannot sign in.

Activation and recovery messages use the configured GoDaddy or Microsoft 365 SMTP mailbox over an encrypted connection. That mail provider processes the recipient address, display name and message, including the private one-time link, to deliver the service email. Your account password is never included. These messages do not subscribe you to marketing. The sender may retain mail records under its service policies; GoJoy's delivery status log records the result and time without the recipient address or link. A server acceptance status does not guarantee delivery to your inbox.

Reviews you submit

When you submit a review, GoJoy stores your member ID, current display name, listing ID, review text, optional rating, original language, creation and update times, moderation status, revision, your moderation consent and the applicable notice version, and moderation records. Approved reviews publicly show the text, display name, rating and dates. Unpublished reviews are visible only to the author and authorised staff.

Before submitting or editing a review, you must explicitly agree to this notice and to automated moderation. Before publication, reviews are sent to the configured DeepSeek or xAI service for automated moderation, including checks for spam, private information and unsuitable content. An uncertain result or service failure leaves the review pending for staff review. Moderation does not rewrite your review, and switching the site language preserves its original text. Do not include passwords, private contact details or other sensitive information.

Account and review spam protection

Google reCAPTCHA v2 loads on email account forms only after you tick the privacy and CAPTCHA consent box. When review protection is enabled, it also loads on the signed-in review form after you tick the review consent box. Google and Apple retain their own sign-in flows. It helps distinguish people from automated submissions. Your browser contacts Google, which may process your IP address, browser and device information, cookies and interactions for this check. reCAPTCHA sets a necessary security cookie when it runs. GoJoy sends the resulting CAPTCHA token to Google for verification without including your email address, password or review text, and does not store that token in member or review records. If verification fails or expires, you need to complete it again; your draft stays on the page.

Google Privacy Policy · Google Terms of Service

Guide conversations

When you use the GoJoy guide, your question, recent conversation turns and relevant public listing information are sent to the configured DeepSeek or xAI service to produce a reply. GoJoy does not persist chat content in server member records. The current page keeps recent turns for follow-up questions. Do not enter passwords, identity document numbers or other sensitive information.

Public sources, images and sharing cards

The site reads public information from sources including LCSD, HKMovie6, Broadway Circuit, HK Ticketing, official Hong Kong district guides, Openholidays and FEHD. Some images load from their source website, which may receive a request from your browser. Available image credits, licences and original sources are provided.

To make sharing cards, relevant public photographs and listing information may be sent to TeamoRouter for image processing. Completed images are stored and reused. Visitor conversations and member reviews are not sent as part of this process.

Google Maps restaurant search and photos

When you submit a Google restaurant search on a district page or ask the chatbot for Google or highly rated restaurants, GoJoy sends the selected district and your search words to Places API. Results, ratings and photos are displayed temporarily with Google Maps and author attribution; they are not stored in our catalogue or sent to our language-model provider. Viewing a photo connects your browser to Google image servers, which may process your IP address and device details. We retain private API settings, daily aggregate request counters and short-lived anti-replay tokens, not search terms or result records. Google results are a returned subset, not a complete Hong Kong ranking.

Google Maps features are subject to the Google Maps/Google Earth Additional Terms of Service and Google Privacy Policy linked below.

Google Maps Terms · Google Privacy Policy

Google Maps restaurant search

Authorised editors can use Google Maps Places API to search Hong Kong restaurants. Search terms are sent to Google; returned names, ratings, rating counts and addresses are displayed temporarily in the admin panel and are not imported or stored as listing content. GoJoy records daily aggregate API attempt, success and failure counts to control usage. Using this feature is subject to the Google Maps terms and Google privacy policy.

Google Maps Terms of Service · Google Privacy Policy

Booking platforms and affiliate links

Some booking links contain GoJoy affiliate identifiers. These include Klook links and Trip.com links when enabled. When you follow a link or complete a booking, the relevant platform and its affiliate services may use link parameters, cookies or other identifiers to attribute the referral. GoJoy may earn a commission, as disclosed beside relevant links. Each platform handles booking, payment and its own data processing under its privacy policy. GoJoy does not collect your payment details on this site.

Essential cookies, browser storage and traffic data

Member sign-in uses an essential HttpOnly cookie lasting up to 7 days. The sign-in handoff verification cookie lasts up to 10 minutes, and the separate admin sign-in cookie lasts up to 12 hours. You can sign out or clear cookies in your browser. Language, saved places and the notification device identifier use localStorage and can be cleared in browser settings.

GoJoy has not enabled Google Analytics. Hosting and CDN services may process IP addresses, request times, browser information and request counts for service delivery, security, traffic measurement and troubleshooting. Request counts are not unique visitors. Public pages load the Google AdSense script for site verification and advertising configuration. Your browser therefore connects to Google, which may process device, network, cookie and advertising information under its privacy policy. Loading the script does not mean the site has received advertising approval or that an advertisement will appear.

Saved places and optional reminders

Only after you explicitly opt in and allow browser notifications does GoJoy store your chosen interests, keywords, saved item IDs, notification language, push endpoint and encryption public keys in AWS. Preferences expire after 90 days, and turning reminders off deletes the server subscription. This consent does not include advertising or direct marketing. Chat messages do not automatically become notification interests.

Category map

Our category map displays source-backed listing coordinates using locally hosted Leaflet software and OpenStreetMap tiles. When you open the map, your browser requests only the visible map tiles directly from OpenStreetMap, which may receive your IP address, browser details and our site origin. Map searches and category filters run in your browser; they do not trigger Google Places searches or send your search words to a map provider. Location pins may refer to a building or venue rather than an entrance, as labelled. We do not request your current location on this page.

OpenStreetMap Foundation Privacy Policy

Location and transport

Location is used to find nearby parking and bus stops only when you choose the nearby option and grant browser permission. Coordinates are not added to notification preferences. Application logs do not record chat questions, subscription endpoints or locations. Opening external map directions sends the destination to that map service.

Corrections, deletion and contact

To ask about, correct or delete a member account or review, contact the email below. Include your display name, sign-in provider and relevant listing or review links so we can arrange ownership verification. Do not send passwords or sign-in credentials. The team may need to verify account ownership before handling the records. You can also turn reminders off in notification settings or clear saved places and language preferences in your browser.

cs@gojoy.ai