1. Information we collect
Supabase Auth processes your email address, account identifier, email verification status and login records. With Google, GitHub or X sign-in, it also receives basic profile information returned by that provider, such as your name, provider user identifier and, when supplied, avatar URL. We do not receive your social account password.
Our community database stores your display name, role, account status, likes, bookmarks, comments, associated timestamps and administrative action records. Comments display their text, display name and date publicly. Like counts are public; personal bookmarks are not exposed to other visitors. Do not post sensitive information in comments.
Your browser and our infrastructure providers process request information necessary to serve the website, such as IP addresses, browser information, requested paths and security logs.
Linked X and GitHub accounts display public ownership badges and profile links, removed when unlinked. We cache the total Stars received by your public, non-fork GitHub repositories and the collection time via GitHub’s official API, excluding private and organization repositories. X follower counts are currently disabled; if enabled later, only the owner can request a public follower-count sync through the official API. These badges do not represent platform verification.
2. Google user data
Google sign-in uses Supabase and basic identity/profile permissions (email / profile, which Google settings may list as openid, userinfo.email and userinfo.profile). Account identifiers and email identify your account; your name is used to create a community display name. Profile information returned by Google is retained by the identity service to support sign-in.
We do not request Gmail messages, Drive files, Calendar events or Contacts. We do not send messages or modify Google resources on your behalf. Google user data is not sold, used for targeted advertising, traded or used to train general-purpose AI models. We handle it according to the Google API Services User Data Policy, including applicable Limited Use requirements.
Forum, profiles and images
We store your display name, avatar object identifier, posts, rich text, translations and edit times. Names and photos appear beside public posts and comments; unpublished content is accessible to its author and administrators; edits to published content are stored separately as private drafts visible only to the person saving them. On first use, a photo supplied by Google, GitHub or X is copied to Cloudflare R2. You can crop, replace, remove or restore it; later sign-ins do not overwrite your custom choice. Uploaded avatars and post images are stored in Cloudflare and served at public image URLs. Do not upload private material. The browser processes uploaded images; we retain upload size, ownership and time for quotas and maintenance. Replaced avatars are cleaned up, though browser caches may retain earlier images. Writing drafts autosave in this browser and sync to Supabase when explicitly saved. Deleting a post removes its comments, likes and bookmarks; public image URLs and cached copies may remain accessible. Your public profile includes your handle, bio, website, join date, public posts and replies, and follow relationships and counts. Settings let you edit your profile and sign-in methods. External players load on click by default, or automatically if you choose that reading preference. Loading YouTube, Bilibili, X or Spotify connects to that platform, which may receive your IP address and browser information and apply its cookie policy. Link preview metadata is cached through Cloudflare; YouTube and Spotify preview images are served through a Cloudflare proxy. Deleting a reply removes its content and preserves a placeholder when later replies need the context.
3. Why we use information
We use information to create and maintain accounts, authenticate users, save bookmarks, process likes and comments, enforce administrator permissions, respond to support requests, prevent abuse and maintain security. Google sign-in information is not used for unrelated purposes.
4. Providers and sharing
Supabase provides authentication and database services. Cloudflare provides hosting, content delivery and network security. When email sign-in is configured to use Resend, Resend processes recipient addresses, sign-in email content and delivery information. Your chosen Google, GitHub or X provider handles authorization under its own policies.
Information is processed or disclosed only as needed to provide these services, respond to requests you authorize, investigate security issues or meet applicable legal obligations. Operational personnel may access information necessary for maintenance or support. We do not sell personal information or supply Google user data to advertising platforms. Providers may process data outside your country.
5. Browser storage
Local browser storage maintains your session, language and theme preferences. The identity service may store or refresh session tokens. Signing out ends the current session; clearing site data removes local preferences. The current website code does not integrate advertising trackers or third-party marketing analytics. Infrastructure may use necessary security cookies.
6. Retention and deletion
Account and community data is kept while your account is in use to provide the service. You can remove your likes, bookmarks and comments. To request access, correction, export or account deletion, contact the address below with enough information to verify account ownership. Do not send passwords or sign-in tokens.
After verifying a request, we handle deletion or anonymization of relevant active data. Information may be retained only as needed for legal obligations, disputes or security investigations. Backups and provider logs may expire later under their retention cycles; immediate removal from every backup is not guaranteed.
7. Revoking Google access
You can revoke ChinaTeam access in your Google account’s third-party connections. Revocation does not automatically delete community data already stored by this website. Contact us separately to delete your website account. Public content remains readable without signing in.
8. Security
We use HTTPS, database access policies and role-based administration. Private bookmarks and account data have access restrictions; public comments are visible to visitors. No online service can guarantee absolute security. Report suspected issues to the contact below.
9. Updates and contact
We update this page and its date when features or data practices change, provide appropriate notice of significant changes and obtain required authorization before introducing new data uses. Send privacy questions, deletion requests and support inquiries to the contact below.
Account setup and display preferences
We store your chosen unique username, profile completion time, display language and theme preference. Account preferences apply when you sign in; guest preferences stay in the current browser. Posts display their original text, while news may have translations maintained by administrators. Public search covers public content and does not expose drafts, private bookmarks or account preferences.
We store reading preferences for news language, external media and repost visibility. Repost relationships and published quotes are public; undoing a repost does not delete the original. When an original is unpublished or deleted, its text is no longer shown in quote cards. Sensitive actions use email verification codes. Supabase verifies codes and keeps authentication records; Resend delivers the email. The website does not store the codes you enter.
Wallet and blockchain transactions
We store deposit orders, exact payment-identifying amounts, receiving and on-chain sender addresses, transaction hashes, withdrawal addresses, point transfers, tipping participants, review status and timestamps. Deposits need no wallet connection or signature. Wallet records are available to their owner and authorized financial administrators. On-chain addresses, amounts and transactions are public and may become linked to your account. Supabase stores the ledger, Cloudflare verifies transfers, and TronGrid supplies TRON data. We do not request private keys or recovery phrases.
Financial records support settlement, reconciliation, dispute handling and duplicate-payment prevention. The ledger cannot be directly overwritten or deleted. Account deletion involving outstanding balances or financial records requires support review of settlement and applicable retention obligations.
C2C market and merchant collateral
C2C records include merchant applications, collateral and refunds, offers, payment instructions, order status, participant messages and appeal decisions. Payment details are visible only to the order participants and the owner administrator after ordering. Merchant names, usernames, offers and completed trade counts are public. Do not post passwords, verification codes, private keys or unrelated sensitive information in messages.