Privacy policy (draft)

Document status

This is draft data guidance, not an effective privacy policy. The controller, complete processing inventory, retention periods, third-party recipients and rights-request procedures require operator confirmation.

1. Data controller and scope

Controller name, registered address and privacy contact: [operator to complete]. Effective date and version: [to be confirmed].

Covered products and websites, and boundaries between third-party app and platform processing: [operator confirmation required]. An app provider's privacy policy does not replace the platform's formal policy.

2. Account information and purposes

New accounts use a username, password and recovery codes for registration and recovery. Unmigrated legacy email accounts retain email recovery. Account settings also offer nicknames, avatars and optional contact details. Follow form requirements and regularly review identity and security settings.

For each field, necessity, purpose, legal basis and consequences of not providing it: [operator confirmation required]. The review must also include a complete inventory of sign-in security, order and service-usage data.

3. Uploads and public display

App names, icons, descriptions, collections and accessible resources may be shown to visitors. Check for personal data, internal documents and customer information before uploading, and confirm the intended sharing scope.

Processing of uploaded files, public details and operation records, and the respective user and platform roles: [operator to verify and complete].

4. Cookies, local storage and credentials

Passwords, verification codes, sign-in tokens and S3 Secrets are access credentials and must not appear publicly. Temporary links may contain credentials; share them with care for their actual expiry and access scope.

Names, purposes, lifetimes and controls for cookies, local storage and similar technologies: [operator to compile an actual inventory]. This draft does not claim that tracking technologies or particular data collection are absent.

5. Third parties and disclosures

Service categories, providers, data actually received, purposes and policy links: [operator verification required].

Whether cross-border processing occurs and its applicable arrangements: [operator verification required]. Using cloud services alone does not establish specific recipients, storage locations or transfer rules.

6. Retention, deletion and security

Retention periods and criteria for account data, files, logs, bills and backups: [operator to complete].

Account closure, deletion requests, backup deletion delays, post-termination handling, implemented security measures and incident notifications: [operator verification required]. This draft promises neither instant deletion, permanent retention nor any specific security certification.

7. Requests and choices

Channels, identity checks, response times and limitations for access, correction, deletion, closure and other applicable requests: [operator confirmation required].

Do not include complete identity credentials in public issue reports. Until formal privacy contacts are published, this page does not designate general troubleshooting support as the legal channel for privacy requests.

8. Arrangements for minors

Eligibility, processing of minors' data and guardian requests: [operator review against actual services required]. This draft sets no unconfirmed age threshold or consent rule.

9. Limit unnecessary disclosure in reports

Start with the time, product, error and redacted resource identifier. Hide email addresses, balances and unrelated filenames in screenshots. Remove tokens and signatures before sharing URLs. Never submit full passwords, cookies, private keys or Secrets.

10. Updates, contact and effective date

Policy-change notices, version history, privacy contact details and effective date: [operator to complete and review].

Current status: draft, awaiting operator confirmation, not a formal published policy. It can become a complete formal policy after the data rules above are confirmed.