1. Information we collect
Supabase Auth processes your email address, account identifier, email verification status and login records. With Google, GitHub or X sign-in, it also receives basic profile information returned by that provider, such as your name, provider user identifier and, when supplied, avatar URL. We do not receive your social account password.
Our community database stores your display name, role, account status, likes, bookmarks, comments, associated timestamps and administrative action records. Comments display their text, display name and date publicly. Like counts are public; personal bookmarks are not exposed to other visitors. Do not post sensitive information in comments.
Your browser and our infrastructure providers process request information necessary to serve the website, such as IP addresses, browser information, requested paths and security logs.
2. Google user data
Google sign-in uses Supabase and basic identity/profile permissions (email / profile, which Google settings may list as openid, userinfo.email and userinfo.profile). Account identifiers and email identify your account; your name is used to create a community display name. Profile information returned by Google is retained by the identity service to support sign-in.
We do not request Gmail messages, Drive files, Calendar events or Contacts. We do not send messages or modify Google resources on your behalf. Google user data is not sold, used for targeted advertising, traded or used to train general-purpose AI models. We handle it according to the Google API Services User Data Policy, including applicable Limited Use requirements.
Forum and writing data
We store submitted posts, rich text, image URLs, translations and edit times, and display content according to its publication status. Published posts, bylines and comments are public; drafts are accessible to their authors and administrators. The writing page autosaves drafts in the current browser and syncs them to Supabase when you save. External images load from their providers, which may receive your IP address. You can delete your own posts; deletion also removes associated comments, likes and bookmarks.
3. Why we use information
We use information to create and maintain accounts, authenticate users, save bookmarks, process likes and comments, enforce administrator permissions, respond to support requests, prevent abuse and maintain security. Google sign-in information is not used for unrelated purposes.
4. Providers and sharing
Supabase provides authentication and database services. Cloudflare provides hosting, content delivery and network security. When email sign-in is configured to use Resend, Resend processes recipient addresses, sign-in email content and delivery information. Your chosen Google, GitHub or X provider handles authorization under its own policies.
Information is processed or disclosed only as needed to provide these services, respond to requests you authorize, investigate security issues or meet applicable legal obligations. Operational personnel may access information necessary for maintenance or support. We do not sell personal information or supply Google user data to advertising platforms. Providers may process data outside your country.
5. Browser storage
Local browser storage maintains your session, language and theme preferences. The identity service may store or refresh session tokens. Signing out ends the current session; clearing site data removes local preferences. The current website code does not integrate advertising trackers or third-party marketing analytics. Infrastructure may use necessary security cookies.
6. Retention and deletion
Account and community data is kept while your account is in use to provide the service. You can remove your likes, bookmarks and comments. To request access, correction, export or account deletion, contact the address below with enough information to verify account ownership. Do not send passwords or sign-in tokens.
After verifying a request, we handle deletion or anonymization of relevant active data. Information may be retained only as needed for legal obligations, disputes or security investigations. Backups and provider logs may expire later under their retention cycles; immediate removal from every backup is not guaranteed.
7. Revoking Google access
You can revoke NextChina.org access in your Google account’s third-party connections. Revocation does not automatically delete community data already stored by this website. Contact us separately to delete your website account. Public content remains readable without signing in.
8. Security
We use HTTPS, database access policies and role-based administration. Private bookmarks and account data have access restrictions; public comments are visible to visitors. No online service can guarantee absolute security. Report suspected issues to the contact below.
9. Updates and contact
We update this page and its date when features or data practices change, provide appropriate notice of significant changes and obtain required authorization before introducing new data uses. Send privacy questions, deletion requests and support inquiries to the contact below.