1. Scope and controller
This English policy is intended for users worldwide and applies to services provided on liuhuo.org and its subdomains, including Liuhuo Stack. The controller and service operator is Chongqing Yuzhong District Liuhuo Qianzai Network Technology Studio, established in the People's Republic of China and operating under the Liuhuo Qianzai brand. You can contact us at admin@liuhuo.org.
Privacy laws differ by location. This policy provides a global baseline; any additional or stronger protection that cannot be waived under applicable law continues to apply.
Third-party websites have their own privacy practices. This policy does not govern processing that occurs after you follow a discovery link to another service.
2. Information we process
We process only the information needed for the relevant feature. Some information is optional, but a feature may not work if required information is not provided.
The service does not require identity documents, financial accounts, precise location, health data, or other sensitive personal information. Do not include unrelated sensitive information in comments, feedback, cooperation inquiries, or attachments. If a feature genuinely requires such information, we will explain why it is necessary, limit its use, and meet any additional notice, legal-basis, or consent requirements that apply.
- Account and profile data: registration email, display name, avatar, and one-way password hashes. We do not store plaintext passwords.
- Authentication and security data: session identifiers, sign-in and action times, IP address, browser or device details, request records, and administrator audit records.
- Personal features and public interactions: website and tool favorites, helpful votes, comments, and replies. Comments and display names are shown publicly as indicated by the feature.
- Feedback and cooperation: feedback content, attachments, and status history; contact name, email, organization, inquiry type, message, and source page submitted through the cooperation form.
- File data: avatars, feedback images, or content attachments you choose to upload, together with filename, type, size, purpose, and storage status.
- Product analytics: page views, website views or visits, tool-use events, and a SHA-256 hash derived from a server-issued random visitor identifier. Product analytics do not use IP addresses or browser fingerprinting to identify visitors.
- Operational logs and traces: request path, status, duration, request identifiers, IP address, User-Agent, and necessary error context. Logs are designed not to record passwords, tokens, or form bodies.
3. Local processing in tools
Liuhuo Stack tools process inputs in your browser by default. Text, images, and other inputs are not uploaded to Liuhuo servers merely to perform those local calculations.
If a future tool needs an upload or server-side capability, we will explain it before the action and send data only after you initiate it. A tool-use event may still be recorded without the tool input.
4. Purposes and legal bases
We process information to create and maintain accounts, sync favorites, operate community features, handle feedback and cooperation, support file features, understand product usage, protect accounts and networks, and meet legal obligations.
Depending on the context and applicable law, processing is based on performing our service agreement or taking steps you request, complying with legal obligations, our legitimate interests in operating and securing the service, preventing abuse, and improving it, your consent, or another legally permitted basis. Where we rely on legitimate interests, we consider the impact on your rights. You may withdraw consent at any time without affecting processing already carried out lawfully.
We do not currently use personal information for personalized advertising or make automated decisions that have a significant effect on individual rights. Catalog ordering and recommendations are based on content status, operational configuration, or aggregated statistics rather than a profile of a specific person. We will provide any notice and choices required by law if this changes.
5. Cookies and local storage
We use HttpOnly cookies for authentication sessions, cross-site request protection, and an anonymous analytics visitor identifier. A regular cookie stores your language preference. The analytics identifier is not required for account access or the browser-based tools, and you can block or delete it through browser settings. Authentication tokens are not stored in localStorage or sessionStorage.
Recent-use history and limited interface preferences may remain in your browser. Favorites are stored only in the server-side account data of signed-in users. Clearing browser data may sign you out or remove language and recent-use preferences.
6. Processors, disclosures, and international transfers
We do not sell personal information. We may engage cloud infrastructure providers for database, object storage, bot protection, and observability services. They may process necessary data only within the agreed scope and subject to access and security controls.
When personal information is transferred across borders, we use the transfer mechanism and safeguards required by applicable law. Depending on the relevant jurisdiction, these may include an adequacy decision, contractual safeguards, security assessments, regulatory procedures, or explicit or separate consent where that consent is a valid and required basis. We will provide additional transfer information when required.
We may disclose necessary information when required by law or a lawful authority, or where genuinely necessary to protect the lawful rights and safety of users, the platform, or the public.
7. Retention
We retain information for the shortest period needed for its purpose. Account data is generally kept until account deletion; active sessions remain until expiry or revocation plus a limited security grace period; hashed unique-visitor details are currently retained for up to 90 days; administrator audit logs are currently retained for up to 365 days.
Comments, feedback, cooperation records, and related files are generally kept until deleted, the matter is complete and no longer needed, or they can be removed after account deletion. Backups, security investigations, disputes, or legal duties may delay deletion for a limited period.
8. Your rights
Subject to applicable law, you may request access to or a copy of your personal information, correction or completion, deletion, restriction, transfer or portability, or object to certain processing. You may also withdraw consent, close your account, or ask us to explain our processing. Profile, password, and device sessions can be managed in account settings where available.
For other requests, email admin@liuhuo.org from your registered address and describe the request. We may verify your identity to prevent misuse and will respond within the period required by applicable law. We will not discriminate against you for exercising a privacy right where applicable law prohibits it.
You may complain to us first and, where applicable, lodge a complaint with the data protection, privacy, or other competent supervisory authority in the country or region where you live or work or where the alleged infringement occurred.
9. Security
We use access controls, password hashing, encryption in transit, session rotation, CSRF protection, rate limits, auditing, and file-reference validation to reduce security risks. No internet service is completely secure. If an incident may affect your rights, we will take remedial, reporting, and notification steps required by law.
10. Children
The service is designed for a general audience and is not directed to children. If you are below the minimum age at which you may lawfully provide personal information or agree to an online service where you live, do not create an account or submit personal information unless a parent or guardian has provided any authorization required by local law.
Age thresholds differ by jurisdiction. They include under 14 for personal-information processing in mainland China, under 13 for services covered by the United States Children's Online Privacy Protection Act, and between 13 and 16 for consent-based online services in the European Economic Area, depending on national law. Contact us if you believe a child provided information without legally valid authorization; we will investigate and take the action required by applicable law.
11. Regional information
Mainland China: where the Personal Information Protection Law applies, sensitive personal information and certain cross-border transfers are subject to its additional notice and separate-consent rules, and information about children under 14 receives the protection required by that law.
European Economic Area and United Kingdom: where the EU GDPR or UK GDPR applies, the legal bases described above apply to the relevant processing. You may have rights including access, correction, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a competent supervisory authority. International transfers will use a mechanism permitted by the applicable regime.
United States: the service is not directed to children under 13, and we do not knowingly collect their personal information in circumstances covered by COPPA without verifiable parental consent. Where an applicable state privacy law grants additional rights, you may exercise them through the contact method below. We do not sell personal information or share it for cross-context behavioral advertising.
12. Changes and contact
We may update this policy when features, processing, or legal requirements change. The updated date will appear on this page, and material changes affecting your rights will receive an additional reasonable notice.
Questions about this policy, personal information, or account closure can be sent to admin@liuhuo.org.
If you believe our processing infringes your rights, you may complain through that email address or contact a competent privacy or data protection authority where applicable.