Privacy Policy

Information We Collect

Account information: if you sign up via an email magic link or Google sign-in, we store your email address. With Google sign-in, we only receive the email, name and avatar Google provides (openid / email / profile scope) — nothing else from your Google account.

Payment-related information: for Stripe subscriptions, your card details are handled directly by Stripe and we never see or store full card numbers. For Alipay/WeChat manual verification, we may temporarily keep a payment screenshot and note for reconciliation, and do not retain it long-term afterward.

Entitlement code: to support checkout without an account, we issue an order code (e.g. HLD-XXXXXX) and store it as a cookie in your browser to restore your entitlement on that browser; you may optionally bind it to a login email.

Usage and technical data: access logs, browser/device type, pages visited, and country/city inferred from request headers (we do not store full IP addresses).

"Ask" content: if you use the in-site Q&A feature, the questions you submit are sent to third-party AI providers to generate a response. Signed-in users' Q&A history is stored against their account; anonymous users' history is stored by session.

How We Use Your Information

We use the information we collect to:

• Provide and maintain core features: character graph, timeline, poetry search, Q&A, etc.
• Handle account sign-in, subscription activation/renewal, and payment reconciliation
• Understand feature usage through aggregated, anonymized analytics to improve the product
• Respond to your emails, corrections and entitlement questions
• Prevent fraud and abuse, such as anomalous order-code redemption

Cookies and Analytics

Sign-in state: NextAuth sets a session cookie in your browser to keep you signed in.

Guest entitlement: your order-code entitlement is stored as a browser cookie; clearing browser data removes it (you can restore it by re-entering your order code).

Analytics: we use a self-hosted Umami instance (umami.hongloudata.com) for traffic analytics. This data is used internally only — never shared with ad networks or sold.

Behavior analytics: we also use Microsoft Clarity to understand page interactions (clicks, scrolling); its data handling follows Microsoft's privacy policy (clarity.ms).

Third-Party Services

We do not sell your personal information. To operate the service, we share the minimum necessary data with:

• Google (OAuth sign-in) — authentication only
• Stripe (online subscription payments) — payment and billing processing
• Email delivery service — sign-in verification links and account notices
• Third-party AI providers — to generate responses for the "Ask" feature
• Microsoft Clarity — page behavior analytics

Data Retention

Account data is retained while your account is active; subscription and order-code records are retained longer for billing reconciliation and fraud prevention.

Payment verification materials (e.g. screenshots) are kept only as long as needed for reconciliation.

You may email us at any time to request deletion of your account and associated data, subject to reasonable financial and legal retention requirements.

Data Security

Data is stored in a PostgreSQL database with access controls, and production traffic is served over HTTPS. We work to protect your data, but no method of transmission or storage is completely secure — please keep your order code and login email access safe.

Your Rights

You may email us at any time to access the information we hold about you, correct inaccuracies, request deletion of your account and related data, or object to certain processing. We aim to respond within a reasonable time, typically 30 days.

Children's Privacy

Our services are not directed at children under 13, and we do not knowingly collect their personal information. If you believe a minor has provided us with personal information, please contact us to have it removed.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect product or regulatory changes. Updates are posted on this page along with a revised "Last updated" date.

Contact Us

Questions about this Privacy Policy or our data practices? Email contact@hongloudata.com.