Privacy Policy

Version 1 · 2026-10-25 HKT · Based on Lugfolio self-built auth (Cloudflare D1 / Workers · no Firebase)

Who we are

Lugfolio is operated by an individual in Hong Kong trading as Lugfolio. Contact: bodetechnologyhk@gmail.com. No individual legal name is published on this site.

What we collect

• Account: email, optional display name / avatar; password hash only (argon2id or bcrypt) if you register with email/password.
• OAuth (Google / Facebook / X): provider subject id, email if granted, optional name/avatar — we do not keep raw provider profile JSON long-term.
• Sessions: HttpOnly cookie (lf_session); we store only a hash of the session secret in Cloudflare D1, plus expiry / revoke flags.
• Wishlist / portfolio / alerts (when enabled): data you enter.
• Technical: IP (may hash), user-agent, Cloudflare logs; AdSense cookies when ads go live on production only.

Where stored

Cloudflare D1 (lugfolio-db) and Workers on Cloudflare. No Firebase Auth.

Processors

Cloudflare (hosting, D1, CDN); transactional email provider (alerts / password reset); Google / Meta / X as identity providers when you choose OAuth; Google AdSense on production later. We do not sell personal data.

Purposes (PDPO)

Provide accounts, sessions, wishlist/portfolio/alerts; security; legal compliance.

Cross-border

Processing may occur outside Hong Kong (Cloudflare / identity providers).

Retention

While the account is active; soft-delete / anonymize on request or Meta data-deletion; session rows until expiry or revoke.

Your rights

Access / correction via bodetechnologyhk@gmail.com. If we have material EEA users, a GDPR block will be added.

Children

Not for under-13 (under-16 in the EEA).

Advertising and cookies (AdSense)

When ads are enabled on the production host lugfolio.com (and www), Google AdSense may set or read cookies and similar technologies to serve and measure ads. Staging and preview hosts do not load AdSense.

You can manage ad personalization through Google ad settings. Lugfolio does not use AdSense on scraped marketplace pages; ads appear only next to our editorial encyclopedia and price-context pages. We do not sell personal data.

Contact for privacy questions related to ads: bodetechnologyhk@gmail.com.

Facebook Login

Before enabling Facebook Login, a Meta App plus a live data-deletion callback will soft-delete / anonymize Lugfolio account data linked to that Facebook id.

Passwords

Never stored in plaintext; reset via single-use time-limited email link (email delivery may be staged gradually).

Privacy Policy v1.1 · production https://lugfolio.com (also https://www.lugfolio.com). Staging https://lugfolio.pages.dev remains for preview. AdSense gated to production hostname.