Privacy Policy

Updated and effective: September 7, 2026 · 中文

1. Scope and contact

This policy explains how straw-dog (straw-dog.com) handles personal information when providing technology content, accounts, project watches, and related commercial services. “We” refers to the website operator. Send privacy questions, account closure requests, and data rights requests to [email protected], with “Privacy request” in the subject line.

This policy covers information processed by this website. External projects, cloud providers, identity platforms, and payment providers operate under their own policies. Following our tutorial to run an application on your server does not automatically give us access to its users' data. If you engage us to access that data, the scope and responsibilities should be agreed before work begins.

2. Information we process

Browsing and security records

Our servers and supporting infrastructure may record IP addresses, request times, paths, response status, referring pages, and browser or device information to deliver pages, troubleshoot, and detect abuse. Request URLs may include search terms or other parameters. Do not put passwords, tokens, or confidential information in URLs or search fields.

Accounts and email verification

Registration, sign-in, and profile changes involve your display name, email, password hash, account and email verification status, and necessary timestamps. Email verification creates verification records, expiry information, and attempt counts. Sending a code requires sharing the recipient address and message with a mail service. Account passwords are not stored as directly readable plain text.

Social sign-in and account linking

When you select an available provider such as Google, GitHub, X, or Telegram, we receive the authorized account identifier, display name, nickname, avatar URL, and any email address or email verification status actually supplied. Not every provider supplies an email, and a provider email does not necessarily become your verified straw-dog email.

We record linking, last-use, and unlinking times and temporarily process session information needed to complete authorization. Social sign-in does not give us your platform password or by itself authorize reading private messages or contacts, or posting on your behalf. Review the platform's authorization screen for the requested permissions.

Unlinking revokes the sign-in association on our site. The current implementation retains a revoked record rather than immediately erasing identifiers and history. The system prevents removal of your last usable sign-in method. You can also revoke access in the provider's connected-app settings. Contact us to request further deletion of our records.

Project watches, membership, and subscriptions

We store watched projects, alert preferences, membership expiry, and voluntarily submitted newsletter email addresses, language, and registration status. The newsletter currently records subscription interest; it is not a promise that regular delivery has started. Creating an account, purchasing a service, and requesting marketing subscriptions are distinct actions. Security and order messages are also distinct from marketing messages.

Orders, payments, and correspondence

Purchases create records of the associated account, order number, product or service, amount, currency, payment status, provider transaction reference, and timestamps. Checkout sends the order number, product name, and amount needed for payment to the checkout provider and receives a transaction result for reconciliation. Our current EPay integration does not ask you to enter full card details, payment passwords, or banking SMS codes on this website. Consult the payment page's own information about its processing.

When you contact us, we process your email address, issue description, order details, and any attachments you provide. Remove customer information and secrets from logs or screenshots first. Remote deployment support requires a separate agreement on temporary permissions, access duration, and the data involved.

3. Purposes and processing grounds

We use this information to deliver pages and accounts, verify identity, prevent fraud and abuse, process purchases and support, maintain project watches and membership entitlements, respond to inquiries and rights requests, and satisfy applicable recordkeeping duties.

Where applicable law requires a processing basis, the relevant basis depends on the activity: providing a requested service or performing an agreement; meeting a legal obligation; protecting the website and users through legitimate interests where permitted; or your consent. Optional processing requiring consent can be declined or consent withdrawn without retrospectively affecting earlier lawful processing. Browsing the website is not blanket consent to all optional uses.

4. Cookies, local storage, and third-party requests

Session and security cookies maintain sign-in, verify requests, and complete authorization. Selecting “remember me” may retain a longer-lived sign-in credential. Removing or blocking these cookies can sign you out or interrupt registration and payment-return flows. Your browser can clear cookies and site data.

Pages with Cloudflare Turnstile enabled send verification requests to Cloudflare, which processes network, browser, and device signals needed to assess automated traffic. Read the Cloudflare Turnstile Privacy Addendum and Cloudflare Privacy Policy for details.

Loading social sign-in components, external avatars, or other remote resources may also send your IP address and request information to their providers. Following a referral link may allow its destination to use its own cookies or record referral attribution. Nonessential analytics or advertising tracking that requires prior consent should be subject to that choice; this policy does not itself supply your consent.

5. Sharing and international processing

We do not sell personal information. Hosting and infrastructure providers, security services, mail services, the identity platform you select, and payment services may process the information necessary for their specific roles. Their responsibilities and policies vary. A sponsorship discussion does not mean that sponsors receive account email lists, project watch lists, or order details.

Where required by applicable law, or necessary to investigate abuse or protect lawful rights, we may provide necessary information to authorized bodies or relevant professional advisers, limiting disclosure where permitted.

Our website uses servers in Tokyo, Japan. Mail, security, identity, and payment services may process data in other countries or regions, so international transfers may occur. Protections differ by location. Specific notices, consent, or other safeguards must be addressed where applicable requirements call for them. Using the website does not waive statutory rights.

6. Retention

Retention depends on purpose and necessity; there is no single rule to retain all information indefinitely.

• Account information is retained while providing the account. Following closure, outstanding orders, disputes, security matters, and legal duties determine whether information is deleted, anonymized, or retained with restrictions.
• Orders and related correspondence are kept as needed for delivery, support, financial records, and dispute handling, subject to applicable obligations and transaction circumstances.
• Access and security logs, verification records, and temporary authorization data are managed according to troubleshooting, abuse prevention, and validity needs. A code expiring does not mean all related records are immediately erased.
• Subscription interest is retained until no longer needed or removal is requested. Revoked social connections may retain necessary security and association history.
• Backup data may disappear through backup rotation rather than immediately alongside live records. Confirmed deletion requests need to be considered if backups are restored.

You may contact the address above about the retention grounds and deletion arrangements for your information.

7. Security and deployment access

We use measures appropriate to the service, including HTTPS, password hashing, access controls, and protection for sensitive settings. No networked system can guarantee absolute security. Use a unique password, secure your email and identity-provider accounts, and sign out on shared devices.

Do not send root passwords, SSH private keys, API secrets, payment passwords, or complete databases by ordinary email. If deployment work needs access, agree on a secure handover process, use temporary credentials with the minimum necessary permissions, and revoke or rotate them after completion. If a personal information incident occurs, we will take remedial action and make notifications to affected people or authorities where applicable requirements call for them.

8. Your choices and rights

Depending on applicable law, you may request information and access, a copy, correction, deletion, restriction or objection to particular processing, and, where applicable, portability or withdrawal of consent. These rights are not unlimited in every situation. If information must be retained by law, we will explain the reason and implications.

Account features allow changes to supported profile information, email and social connections. Project watch controls allow you to stop watching a project. Contact the address above to request account closure, data deletion, or removal of a newsletter registration. Account closure and requests for a data copy are currently handled by email.

Where possible, contact us from your verified account email and provide only the identification and request scope needed. We may reasonably verify identity to prevent unauthorized account deletion, but will not ask for passwords or verification codes. We handle requests within applicable statutory periods and explain if more information is needed or a request cannot be fully satisfied. You may also complain to a data protection or consumer protection authority with jurisdiction.

9. Children

The website primarily addresses people able to understand technical and transaction risks independently; it does not target children for information collection. Users below the age for independent consent or contractual capacity in their location should use relevant features with appropriate guardian involvement. Guardians may contact us about inappropriate submissions by a child so we can investigate and respond.

10. AI, changes, and language

AI may assist editorial research and drafting. That does not mean account information, orders, or private correspondence are automatically used to train public models. Using customer credentials, unpublished data, or identifiable private information with an external AI service requires separate consideration of necessity, authorization, and protection.

We update this policy and its date as features and processing change. Material changes will receive additional notice where required. Chinese and English versions are intended to express the same rules. Please report discrepancies; translation differences do not reduce statutory rights.

Related pages: About Us · Contact Us · Terms of Service