Xianyu (闲鱼)

Is Xianyu safe?

Xianyu works for buying and selling used goods in China as long as you keep money and messages inside the app. Payment is held by Alipay until the buyer confirms receipt, and Alibaba runs its own fraud controls. The weak points are privacy and other users. The app reads running processes and the clipboard, keeps users' data in mainland China even when they live abroad, and has a long problem with sex-service and scam listings. We score it 41/100, below Taobao (42) and Mercari (49).

The app, 闲鱼 ("idle fish"), is run by Zhejiang Alibaba Xianyu Network Technology and is listed only in China's App Store. Its China listing carries an 18+ age rating.

What does Xianyu know about you?

Apple's China label is broad for a second-hand app. Linked to your identity are purchases, financial information, contact details, search history, browsing history and identifiers, and identifiers are used to track you across other companies' apps. Location, user content and usage data are collected but, Apple's label says, not linked to you.

The privacy policy that took effect on 17 July 2026 goes further. For security and anti-fraud it lists device data including installed apps, Bluetooth data, running app processes, motion sensors and the clipboard. To post items, sell services, run a group or meet tax and anti-fraud rules, you must complete real-name or face verification, and Xianyu may fetch your identity data from your Alipay account. De-identified data is used for machine learning and model training without a separate opt-in.

Storage is the other issue. Data collected in China stays in China. A separate policy for users outside China, from GOODUSUS Pte. Ltd. in Singapore and effective 14 September 2026, says Xianyu stores their data on servers in mainland China, and only sometimes in Singapore or elsewhere. Chinese law gives authorities broad access to company data, so a foreign seller should assume their identity documents end up there.

Scams and sex-service listings

Second-hand marketplaces attract fraud everywhere, and Xianyu's size makes it a target. Xianyu itself describes the main pattern: gangs use listings on big platforms to make first contact, then complete the fraud or sex deal off the platform, often after moving the buyer to another chat app. Inside the app, Alipay's escrow and Xianyu's dispute process give you some protection. Outside it, they give none.

The more serious problem is sex services. In September 2026 a Hebei TV investigation reported that sellers used Xianyu listings for massage vouchers, personal training or model photo shoots to steer buyers to sex services off the platform, and that coded phrases suggested minors were involved. Xianyu responded the same day: it said it had frozen 98,358 accounts used to divert users to sexual content from January 2026, referred leads to police and helped break up 15 gangs that year. It also said some of the reported listings were ordinary goods, and that the phrase about minors appeared in a seller's WeChat Work profile, not on Xianyu itself. Either way, the case shows listings that lead buyers off the app, which is exactly where Xianyu's controls stop.

The China App Store's 18+ rating also lists frequent simulated gambling and contests. Together with the sex-service cases, that makes it a poor place for children to browse unsupervised.

Has Xianyu been in trouble with regulators?

Yes, with orders but no fines. On 28 November 2023 Zhejiang's cyberspace office ordered 156 apps to fix unlawful data collection within 15 days, citing problems such as failing to state why data was collected and collecting it without consent. The list itself was published as images; Southern Metropolis Daily reported that Xianyu was on it. On 22 January 2024 the Ministry of Industry and Information Technology named Xianyu in its first batch of the year, among 31 apps and SDKs, for splash-screen pop-ups that "jumped" to other pages and misled users, and ordered fixes.

We found no order from the market regulator that names Xianyu; the 2021 antitrust fine on Alibaba named Taobao and Tmall. Two orders without a fine give a regulatory record (46) close to Amap (45), another Alibaba app.

Goofish, Xianyu outside mainland China

Goofish, the name Xianyu uses abroad, has its own app for users outside mainland China, published by GOOFISH PTE. LTD. of Singapore. The iPhone version has been on the Hong Kong App Store since September 2024 and is also listed in Singapore, Malaysia, Canada and the UK, with only a few hundred ratings in total. Its privacy policy, in force since 24 September 2026, names the Singapore company as data controller, says personal data is stored mainly in the United States and may be accessed and processed from mainland China, and bars users under 18, while the Hong Kong store rates it 13+. Apple's label shows no tracking but links precise location, email, phone number, photos, search history and a user ID to you. This page scores the mainland Xianyu app only.

How to use Xianyu more safely

1. Pay only through Xianyu's own checkout. Refuse any seller who asks for WeChat, a QR code, a bank transfer or a "deposit" outside the app.
2. Confirm receipt only after you have checked the item; confirming releases the money to the seller.
3. Turn off personalised recommendations under My, Settings, Privacy settings, Recommendation management, and personalised ads through the Privacy Lab link in the same menu.
4. Deny Bluetooth and location permissions unless you use nearby listings.
5. Report listings that use coded words for services, and keep children off the app.

How we scored it

Privacy (30) is the weakest factor: broad tracking, device scans and storage in mainland China for every user. Scams and harmful content (32) reflects repeated sex-service and fraud listings that lead buyers off the platform. Transparency and control (52) is the strongest, with in-app deletion and separate ad and recommendation switches. Security (50) has no known breach but no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, and the regulatory record (46) has two orders and no fine.