Privacy Policy

1. Who is responsible

Your personal data is handled by Nanguado, which runs AiSiWhale. Questions and requests: [email protected].

2. What we collect, and why

• Your email address and password, when you register: the email address to send you confirmation and password-reset emails and to recognise your account; the password only as a one-way hash.
• If you sign in with Google: your Google account id, your email address, and whether Google has confirmed that address — to recognise your account. We do not receive your name, photo or anything else from your Google account.
• A sign-in cookie: to keep you signed in, for up to 60 days. While you sign in with Google, a second cookie lasting 10 minutes checks that the sign-in started in your browser.
• Sign-in attempts: to stop password guessing we count attempts to sign in, register and reset a password, by a one-way hash of your IP address and of the email address used — never the address itself. The counts are deleted after about a day.
• Your orders and payments (plan, amount, time, the payment provider's reference): to grant your membership and keep accounts.
• Reading counts: when you open a story, your browser sends a random id that it replaces every day. It cannot be linked to you or followed from one day to the next, and nothing else about you is sent.

We do not collect your card number, your name, your address or your phone number. We do not use advertising or third-party tracking.

3. Who else sees it

• PAYUNi (統一金流), to take your payment. We pass your email address so that PAYUNi can send your receipt; your card details go to PAYUNi directly.
• Google, when you choose to sign in with it: Google confirms who you are and knows that you signed in to this site.
• Resend, which delivers our confirmation and password-reset emails, receives your email address for that purpose.
• Our hosting provider stores the data on our behalf.

Inside our own system, your email address is kept only in the account table. The software that runs the newsroom and the business — including its AI agents — knows members only by an anonymous id.

We do not sell your data. We disclose it to others only when the law requires it.

4. How long we keep it

Your account stays until you ask us to delete it. Payment records are kept for as long as accounting and tax law require (at least five years), even after the account is deleted. The tokens in confirmation and password-reset links are kept only as one-way hashes; a confirmation link stops working once used or after 24 hours, and a reset link once used or after 30 minutes. Sign-in session tokens are likewise kept only as one-way hashes; a session ends at once when you sign out, and otherwise when the session lifetime set by the system runs out.

5. Your rights

Under Taiwan's Personal Data Protection Act you may ask to see or copy your data, correct it, have us stop using it, or delete it. Write to [email protected] from the address on your account and we will answer within 30 days.

6. Changes

If this policy changes, the new version is posted here with a new date.