Privacy Policy
Version 1.0 · Last updated 2026-10-17
This policy applies to the HK IPO Calculator website, the "HK IPO Ledger" Chrome extension and the Pro licence service (together, the "Service"). It explains what personal data we collect, how we use, store and share it, and what rights you have. We collect only the minimum the Service needs.
1. Data controller
Controller: Tiezheng Zhang (individual developer)
Location: Shanghai, China
Privacy email: ztz1024666@gmail.com
Data Protection Officer: not applicable
2. Data we collect
| When | Data | Notes |
|---|---|---|
| Browsing the site / using the web calculator | Nothing, by us | The calculator runs in your browser and your inputs are never uploaded. There are no cookies, ads or third-party analytics. Our host, Cloudflare, processes the technical logs needed to serve and protect the site (e.g. IP address, browser type, request time) under its own policy. |
| Chrome extension | Nothing | Inputs, IPO records and your licence key are stored only in your browser (chrome.storage.local). The extension has only the "storage" permission. It makes no network requests and reads no web pages. |
| Buying Pro | Payment email, order ID, plan, amount, payment status (sent to us by Waffo Pancake) | Full card details are handled only by Waffo Pancake. We never see or store them. |
| Claiming a key | The email and order ID you enter | Used only to match your order. We do not store your email in plain text. We store a one-way hash (the first 16 hex characters of its SHA-256), the order ID, plan, issue time and key. |
| Contacting support | Your email address and message | Used to answer you. |
3. How we use it
| Purpose | Legal basis |
|---|---|
| Issuing, re-issuing and checking licence keys | Contract |
| Refunds and billing questions | Contract |
| Customer support | Contract / legitimate interests |
| Preventing abuse and fraud (e.g. rate-limiting the claim endpoint) | Legitimate interests |
| Legal compliance | Legal obligation |
We send no marketing, build no profiles and make no automated decisions.
4. Cookies & tracking
Neither the site nor the extension uses cookies, analytics, advertising or tracking.
5. Sharing
We do not sell your personal information. We share it only as follows:
- Waffo Pancake (Merchant of Record): processes payments, receipts, taxes and refunds. It handles your payment and order data as an independent controller under its own privacy policy.
- Cloudflare: hosts the site and runs the licence service (Workers/KV), which stores the records listed in Section 2.
- Google (Gmail): our support email provider.
- When required by law, a court order or a lawful request from a regulator.
- With your consent.
6. Security
All traffic uses HTTPS (TLS). Licence records store only an email hash, never the email itself. The signing key and admin token are kept as encrypted Cloudflare secrets that only the operator can access. If a security incident affects your rights, we will notify you and the relevant authorities within 72 hours of discovering it, as required by law.
7. Retention
| Data | Retention | Then |
|---|---|---|
| Licence records (order ID, email hash, plan, key) | 1-year plan: until 1 year after the licence expires. Lifetime plan: for as long as the licence is valid (so we can re-issue it) | Deleted |
| Transaction records held by Waffo Pancake | As Waffo Pancake's legal obligations require | See Waffo Pancake's policy |
| Support emails | 2 years after the last message | Deleted |
| Cloudflare technical logs | Per Cloudflare's policy (typically short) | Deleted by Cloudflare |
8. Your rights
You have the right to:
- be informed about how we use your data;
- access and get a copy of your data;
- have it corrected or erased;
- restrict how we process it;
- receive it in a portable format;
- object to processing;
- withdraw your consent;
- ask us to explain our processing rules.
To exercise any of these rights, email ztz1024666@gmail.com. We reply within 15 business days. Please note that if we delete your licence record, we can no longer re-issue your key. You can also complain to your local data protection authority.
9. Marketing
We send no marketing. Service messages, such as your key or a refund confirmation, are not marketing.
10. International transfers
Cloudflare, Waffo Pancake and Google may process data outside your country, for example in the United States or Singapore. We transfer only the minimum needed for the purposes in Section 3, and the licence service stores only an email hash. By claiming a key, you acknowledge and consent to these transfers.
11. Children
The Service is for people aged 18 and over. We do not knowingly collect children's data. Contact us if you believe we have, and we will delete it.
12. Third-party links
Our guides link to government and other third-party sites. Their privacy practices are not covered by this policy.
13. Changes
We will announce material changes on this page at least 15 days before they take effect, and update the date at the top.
14. Contact
Tiezheng Zhang (individual developer, Shanghai, China) · ztz1024666@gmail.com · Business days, UTC+8