Privacy Policy

Version 1 · 2026-10-25 HKT · Based on Lugfolio self-built auth (Cloudflare D1 / Workers · no Firebase)

Who we are

Lugfolio is operated by an individual in Hong Kong trading as Lugfolio. Contact: bodetechnologyhk@gmail.com. No individual legal name is published on this site.

What we collect

• Account: email, optional display name / avatar; password hash only (argon2id or bcrypt) if you register with email/password.
• OAuth (Google / Facebook / X): provider subject id, email if granted, optional name/avatar — we do not keep raw provider profile JSON long-term.
• Sessions: HttpOnly cookie (lf_session); we store only a hash of the session secret in Cloudflare D1, plus expiry / revoke flags.
• Wishlist / portfolio / alerts (when enabled): data you enter.
• Technical: IP (may hash), user-agent, Cloudflare logs; AdSense cookies when ads go live on production only.

Where stored

Cloudflare D1 (lugfolio-db) and Workers on Cloudflare. No Firebase Auth.

Processors

Cloudflare (hosting, D1, CDN); transactional email provider (alerts / password reset); Google / Meta / X as identity providers when you choose OAuth; Google AdSense on production later. We do not sell personal data.

Purposes (PDPO)

Provide accounts, sessions, wishlist/portfolio/alerts; security; legal compliance.

Cross-border

Processing may occur outside Hong Kong (Cloudflare / identity providers).

Retention

While the account is active; soft-delete / anonymize on request or Meta data-deletion; session rows until expiry or revoke.

Your rights

Access / correction via bodetechnologyhk@gmail.com. If we have material EEA users, a GDPR block will be added.

Children

Not for under-13 (under-16 in the EEA).

Facebook Login

Before enabling Facebook Login, a Meta App plus a live data-deletion callback will soft-delete / anonymize Lugfolio account data linked to that Facebook id.

Passwords

Never stored in plaintext; reset via single-use time-limited email link (email delivery may be staged gradually).

Privacy Policy v1 · staging https://lugfolio.pages.dev · production domain lugfolio.com (DNS pending). AdSense stays off staging.