🔒 Privacy Policy

Last updated: 2026-07-10

1. Data Controller

The controller responsible for processing your personal data is:

Bei ZhaoWei

2. What data do we collect and why?

We only collect data necessary for community operations. We do not sell data or share it with third parties. No advertising or tracking services are used.

Data	Collected when	Purpose	Legal basis	Retention
Username	Registration	User identity, post attribution	Art.6(1)(b) Contract	Account lifetime
Email	Registration	Unique identifier, contact	Art.6(1)(b) Contract	Account lifetime
Password (hash)	Registration	Authentication	Art.6(1)(b) Contract	Account lifetime
Language preference	Registration / switch	UI display	Art.6(1)(f) Legitimate interest	Account lifetime
IP address	Login	Security (brute-force protection)	Art.6(1)(f) Legitimate interest	30 days
Browser type (UA)	Login	Security	Art.6(1)(f) Legitimate interest	30 days
Post / reply content	Creating posts/replies	Content display	Art.6(1)(a) Consent	Until deleted by user or admin

3. Cookies

This site uses only the following strictly necessary cookies (essential for core functionality, no consent required under ePrivacy Art.5(3)):

Cookie	Purpose	Duration
`COMMUNITY_SID`	Login session management	2 hours (session)
`lang`	Language preference	30 days

No tracking, analytics, or advertising cookies are used.

4. Your Rights

Under the GDPR, you have the following rights:

Right of Access (Art.15) — Know what data we hold about you
Right to Rectification (Art.16) — Correct inaccurate data
Right to Erasure (Art.17) — Request deletion of your data
Right to Restrict Processing (Art.18) — Limit how we process your data
Right to Data Portability (Art.20) — Export your data in a structured format
Right to Object (Art.21) — Object to processing based on legitimate interest
Right to Withdraw Consent (Art.7(3)) — Withdraw previously given consent at any time

To exercise any of these rights, contact us at: beixianwei@126.com

5. Right to Complain

If you believe we have violated data protection laws, you have the right to lodge a complaint with the supervisory authority:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit (LfDI)
The data protection authority of your federal state. For Hesse: datenschutz.hessen.de

6. Data Security

We protect your data with: bcrypt password hashing, HTTPS encryption for all traffic, PDO prepared statements to prevent SQL injection, CSRF tokens to prevent cross-site request forgery, and rate limiting to prevent brute-force attacks.

7. Data Deletion

You can request deletion of your account and all associated data by emailing us. Upon verification, we will anonymize or delete your posts within 30 days of receiving a valid deletion request. Login logs (IP and browser data) are automatically purged after 30 days.