Privacy Policy

Last updated: November 12, 2026

1. Who we are

MyForum and MyBlog are hosted community and blog services operated by Lü Jianfeng (吕建锋), an individual established in Menghai County, Xishuangbanna Dai Autonomous Prefecture, Yunnan, People’s Republic of China. For personal data processed to run the Service, we are the controller. Contact: [email protected].

2. What we collect

Account data: email address, display name, hashed password, session records, GitHub account ID/email/avatar if you sign in with GitHub, and the sites you create.
Content: posts, replies, pages, uploaded media and settings you or your members create.
Technical data: IP address, user agent, request logs, and security events (rate limits, failed logins) used to operate and protect the Service.
Billing data: handled by our Merchant of Record, Creem. We receive subscription status, plan, customer ID, invoices and — for per-post purchases — the purchased article, order ID and amount. We never receive your full card number.

3. Why we use it

to provide and secure the Service (contract performance);
to process payments and meet tax obligations (contract and legal obligation);
to prevent abuse, spam and fraud (legitimate interests);
to send service emails you requested, such as replies and digests (consent or contract).

4. Cookies

We use essential cookies and similar storage only: mf_session (keeps you signed in on the current site), mf_sso (central sign-in across MyForum and MyBlog), mf_lang (language preference), mf_theme (light/dark preference), mf_cookie_ok (remembers this notice), and short-lived OAuth state cookies during GitHub sign-in. We do not use advertising or third-party tracking cookies. If we add analytics later, we will update this page and ask for consent where required.

5. Sharing and subprocessors

We share data only with providers needed to run the Service:

Cloudflare — DNS, CDN, TLS, abuse protection and object storage (R2);
Creem — Merchant of Record for payments, tax calculation, invoices, refunds and subscription management;
Tencent Cloud — application and database hosting in Seoul, South Korea;
Alibaba Cloud — transactional email delivery;
GitHub — only if you choose “Continue with GitHub”, to verify your email and basic profile.

We do not sell personal data.

6. International transfers

Our servers are in South Korea, and our providers may process data in the United States, the European Union, Singapore and other locations. Where required by applicable law, transfers rely on appropriate safeguards such as standard contractual clauses or an equivalent mechanism.

7. Retention

Account data: until you delete your account, then 30 days recovery, then deletion.
Content: same as above; backups expire within 90 days.
Server logs: up to 30 days, unless needed for a security investigation.
Billing records: as long as required by tax law, held by Creem.

8. Your rights

Depending on where you live, you may request access, correction, export, deletion, or restriction of your data, and object to processing. Email [email protected] and we will respond within 30 days. You can also export your content from your dashboard at any time.

9. Children

The Service is not directed at children under 16. If you believe a child has created an account, contact us and we will remove it.

10. Security

Passwords are hashed with scrypt, sessions are stored server-side, traffic is encrypted, and access to production systems is limited to key-based authentication. No system is perfectly secure; report issues to [email protected].

11. Changes

We may update this policy. Material changes will be announced on this page with a new date.