Privacy Policy

Who we are

Cluion websites and services are operated by Cluion, an individually run operation based in Taiwan. Cluion decides how personal data described here is used and is responsible for it. Questions about this policy can be sent to privacy@cluion.com.

What we collect

Your account

• Name and email address, and whether the email is verified.
• Your password, stored only as a one-way hash that we cannot read.
• If you enable them: two-factor authentication settings and recovery codes, and the public part of your passkeys.

Sign in with Google or GitHub

We store the account identifier the provider gives us so we can recognise you next time. When you create an account this way, we copy your verified email address and display name from the provider. We do not store provider access tokens and cannot act on your Google or GitHub account.

What you post and do

• Community discussions and replies, including earlier versions when you edit them, reactions, mentions, follows, and bookmarks.
• Feedback items, comments, and votes.
• Reports you submit and moderation decisions about content.
• Notification preferences, product release subscriptions, and badge visibility settings.

Security and sign-in activity

• For each signed-in session: IP address, browser user agent, and last activity time. You can review these and sign out other sessions in your security settings.
• Short-lived counters based on IP address or account, used to limit repeated sign-in and form attempts.
• Web server logs that record IP address, browser, the page requested, and time, used to keep the service secure and working.

Contact form

The name, email address, subject, and message you choose to send. See Contact messages below.

We do not collect payment details, and we do not ask for sensitive personal data such as health or biometric information.

How we use it

• To create and secure your account and sign you in.
• To run community, feedback, bookmark, follow, and notification features you choose to use.
• To send account emails (verification, password reset) and the notification emails you turn on.
• To answer messages you send us.
• To prevent abuse, moderate content, investigate security issues, and meet legal obligations.

We do not sell personal data, show advertising, or build advertising or marketing profiles.

Cookies

We use only cookies needed for the site to work. There are no analytics, advertising, or tracking cookies, and the site loads no third-party scripts.

• Session cookies keep you signed in on the public site and, separately, on the administration site. They expire after a period of inactivity.
• XSRF-TOKEN carries a CSRF token that protects forms against cross-site request forgery.
• Remember me cookies are set only if you choose to stay signed in, and are removed when you sign out.
• appearance and sidebar_state remember your theme and layout choices.

Who receives your data

• Other visitors can see what you post publicly, together with your display name.
• Google and GitHub process your data when you choose to sign in with them.
• Google Workspace delivers our emails and handles email conversations when we reply to you.
• Authorities, when disclosure is required by law.

These providers may process data outside Taiwan. We use them only for the purposes described here.

Where it is stored

Our databases, uploaded files, and backups are kept on servers we operate in Taiwan. Encrypted traffic to the site may pass through network providers in other countries.

How long we keep it

• Account data and sign-in sessions are kept while your account exists.
• Content you post stays until you withdraw it or delete your account. Earlier versions of edited or withdrawn content are kept for 365 days for moderation.
• Notifications are removed 90 days after you archive them, and otherwise after 365 days. Email delivery records are kept for 365 days.
• Contact messages: see Contact messages.
• Backups are overwritten on a rolling basis within about two weeks.

Content involved in a report, moderation case, or legal obligation may be kept longer until the matter is resolved.

Deleting your account

You can delete your account from your account settings. When you do, you are signed out everywhere and we remove your profile, sign-in methods, sessions, bookmarks, follows, reactions, votes, notifications, preferences, and subscriptions.

Discussions, replies, and feedback you posted publicly stay visible so conversations remain understandable, but they are no longer linked to you and show "Deleted member" instead of your name. Records we must keep, such as moderation history, are separated from your identity. A record that the deletion was completed, with no personal details, is kept for 365 days.

Your rights

Under Taiwan's Personal Data Protection Act you may ask to review your personal data, receive a copy, correct or complete it, stop its collection, processing, or use, or have it deleted. You can change your name, email, password, sign-in methods, sessions, and notification settings yourself in your account settings.

For anything else, email privacy@cluion.com from the address linked to your account. We may ask you to confirm your identity and aim to complete requests within 30 days. Applicable law may require a shorter response or allow a documented extension.

Security

We use HTTPS everywhere, hash passwords, offer two-factor authentication and passkeys, keep administration sessions separate from public ones, and restrict administrative access. No system is perfectly secure. Report suspected security or data incidents to security@cluion.com. We will investigate and give the notices the law requires.

Children

Cluion is not directed at children under 13, and they should not create an account. If you are under 18, please use Cluion with the consent of a parent or guardian.

Contact messages

Providing Contact details is optional, but we need a name, email address, subject, and message to reply. We do not store the IP address or browser of the sender with the message. Authorised Cluion administrators review messages in a private inbox. Automated alerts contain only a message number and a protected link, and Google Workspace handles the email conversation when we reply.

A resolved message is deleted 180 days after it is resolved, and an unresolved one no later than 365 days after it was sent. The same limits apply to copies in Google Workspace. A documented legal obligation or dispute may place a message on legal hold, which pauses deletion until the hold is released.

Changes to this policy

We will update this page and its date when this policy changes, and announce significant changes on the site before they take effect.