HBoot Privacy Policy

1. Operator and scope

HBoot Unified Account is provided by the HBoot service operator, an independent developer based in Nanjing, Jiangsu, China. Contact: hboot0230@gmail.com. This Policy covers unified registration, sign-in, identity linking, product authorization, sessions, and security management. Product business data is governed by the relevant product notice.

2. Information we collect

• Account data such as an email address you choose to provide and bind, verification state, display name, avatar, and global user ID. Google and GitHub sign-in do not require an email address or email verification; internal identity identifiers support accounts without a bound email.
• Google or GitHub account identifiers, display names, avatars, and authorization credentials needed for authentication. We use basic identity information for sign-in and linking and do not request access to Gmail messages, Google Drive files, or private GitHub repositories.
• WeChat OpenID and, where available within the same WeChat Open Platform account, UnionID.
• Session, authentication method, device, browser, IP address, sign-in, and activity data.
• Product identifiers, local user mappings, registration/link state, and confirmed pending-merge state.
• Security, operational, audit, error, and feedback records.

3. Why we process it

• Create and maintain your account, verify your selected sign-in identity, and process linking or unlinking that you request.
• Issue, validate, and rotate secure product sessions.
• Maintain product identity mappings and coordinate user-confirmed merges.
• Show devices and activity and prevent abuse or account takeover.
• Respond to support, rights, and deletion requests and meet legal obligations.

4. Cookies and tokens

The Web service uses appropriately secured HttpOnly cookies for sessions. OAuth uses short-lived authorization codes, state, and PKCE. Essential cookies are required for sign-in and security.

5. Sharing and service providers

We do not sell personal information. We provide the selected product only the minimum identity mapping and session result needed for sign-in. When you choose Google, GitHub, or WeChat sign-in or linking, we exchange the information needed to verify your identity with the selected provider. That provider processes your authorization request under its own terms and privacy policy. Hosting and storage use the infrastructure of this service instance. Depending on its configuration, Alibaba Cloud mail services or Resend process recipient email addresses and message content to deliver verification codes and notices.

6. Storage and retention

• Data is stored on the servers of the HBoot service instance you are using. Mainland China instances primarily store data on Alibaba Cloud servers in Hangzhou, China; overseas instances primarily store data on Alibaba Cloud servers in Singapore. The location depends on the service instance you access; changing the interface language does not move your data. Google or GitHub authentication and overseas email services may involve processing necessary identity or email information outside mainland China; we provide notices and follow applicable procedures where required.
• Account data, linked Google, GitHub, or WeChat identities, product mappings, and active session relationships are kept while the account exists and as needed to provide the relevant features.
• After deletion, the account is disabled immediately; related primary-database data is deleted or anonymized within 24 hours, and backup remnants are retained for no more than 30 days.
• A keyed irreversible identity digest and deletion time are retained to prevent duplicate one-time new-user benefits; plaintext sign-in identities are not retained for this purpose.
• Login, security, and audit logs are retained for one year. Resolved feedback records are retained for one year.
• Each product controls retention of its own business data.

7. Your rights

You may review account, product, device, and activity information in the account center and unlink Google or GitHub in your account settings. To revoke authorization at the provider itself, also manage authorization settings on that provider. Contact hboot0230@gmail.com to request access, correction, a copy, deletion, an explanation, withdrawal of consent where applicable, or account deletion. We normally respond within 15 working days after identity verification.

8. Account deletion

First delete product accounts and business data in every product you used and transfer owner or administrator roles. Then submit a unified-account deletion request in the account center using the dedicated email verification code. If no usable email is available but Google or GitHub is linked, authorize that linked account again to verify ownership before submitting. If neither method is available, contact hboot0230@gmail.com for reliable manual ownership verification. After administrator review, we revoke sessions and delete or anonymize data held by the unified platform according to the timelines above. Product business data remains the responsibility of each product.

9. Security

Controls include encrypted transport, HttpOnly cookies, short-lived codes, PKCE, key hashing, access control, rate limiting, audit logging, and session revocation. If an incident may affect your rights, we will take remedial and notification measures required by law.

10. Minors

Users under 14 should use the service only with guardian consent and guidance. If we discover that children's data was processed without valid guardian consent, we will delete it or take other legally required measures.

11. Updates and contact

Material changes will be prominently disclosed and renewed consent obtained where required. Contact the HBoot service operator at hboot0230@gmail.com, Nanjing, Jiangsu, China, with privacy, complaint, or deletion questions.