Privacy Policy - Fuzhou Campus Board Alliance

The short version

We only collect what we need to handle applications, complaints, messages and console sign-in.
A complainant’s contact details are visible to the Alliance only, never to the board complained about.
Data is stored on a server in France; forms ask for your separate consent first.
We never sell your information, and we use no advertising or analytics cookies.
You can see, correct or delete your information at any time; we take extra care with minors.

Who we are

This website, fxql.org.cn, and its admin console are run by the Fuzhou Campus Board Alliance (福州校园墙联盟, “the Alliance”, “we”, “us”), a non-governmental, non-profit alliance founded in December 2022 by campus boards across Fuzhou. We are not a school or a government body. We handle personal information in line with the Personal Information Protection Law of the People’s Republic of China (PIPL).

This policy covers browsing the site; sending us a membership application, complaint, message, subscription or event sign-up; member boards and Alliance admins using the console; email sent to our addresses; and the board lookup on our WeChat account. Posts and messages you send to a campus board are handled by that board, not by us.

What we collect and why

Membership applications: your name or nickname, email address (required), optional mobile number, QQ or WeChat, your board or school, school type and message. We use them to review your application and contact you; once approved, the email address is used to sign in to the console and receive notices (and the mobile number, if given, for SMS sign-in and reminders).
Complaints: the board or post link, the type of problem, your description, screenshots, your relationship to the matter, your email address (required) and optional mobile number or other contact. We use them to look into the complaint and send you a reference number and the outcome. Screenshots may contain other people’s information; we use it only to handle that complaint. Please don’t include unrelated personal details.
Messages and event sign-ups: name, contact details, topic and message, to reply to you and arrange events.
Newsletter and event reminders: your email address, only to send the updates you asked for. Your subscription starts only after you click the link in our confirmation email, and every email has an unsubscribe link.
Console accounts: the email address, mobile number (if registered) and name of member-board operators and Alliance admins, sign-in times, IP address, browser details and a log of actions taken, for authentication, access control and security auditing.
Email to our addresses: messages sent to hello@mail.fxql.org.cn and our other addresses (sender, body and attachments), so we can read and reply.
Security data: IP address, time and browser type of requests, and records of verification codes sent (never the codes themselves), to prevent spam and abuse.

The WeChat board lookup only needs a school name, no personal information. Please don’t send sensitive details such as ID numbers, home addresses or health information.

Who can see it

Alliance admins (a small number of volunteers who need it for their work) can see all of the above.
The member board complained about sees the type of complaint, the description and screenshots, but never your email, phone number or other contact details.
Operators of the same board can see each other’s names and contact details (partly masked for non-owners).
Applications, messages, subscriptions and email are visible to Alliance admins only.

Service providers

We never sell, rent or trade personal information. These providers process it only on our instructions:

Hosting: Contabo GmbH (Germany), on a server located in France, which stores the site, the console and all the data above.
Network and security: Cloudflare, Inc., which carries requests to this site, including IP address and browser data.
SMS: 短信宝 (SMSBao), which processes your mobile number and the text of verification codes and reminders, only if you gave a mobile number.

Otherwise we disclose information only where the law requires it or a competent authority lawfully asks for it.

Transfer outside mainland China

This site and its console run on a server in France, so information you submit is stored outside the People’s Republic of China. The overseas recipients are Contabo GmbH (contact details at contabo.com) and Cloudflare, Inc. (cloudflare.com), which provide infrastructure only and do not use the data. The information involved is everything listed above, kept for the periods below.

Our forms ask you to tick a box agreeing to this policy, including this transfer, before you submit. If you don’t agree, you can reach us through our official QQ account, 2066750182, instead. You can exercise the rights below against the overseas recipients through us.

How long we keep it

Messages: up to 12 months after the matter is closed.
Event sign-ups: deleted 6 months after the event.
Membership applications: 12 months if declined; while the board is a member if approved.
Complaints: 12 months after closing we delete the screenshots and the complainant’s contact details, and keep an anonymised record.
Console accounts: while you are a member; up to 6 months after you are removed or the account is disabled.
Sign-in and action logs, SMS and email logs: 12 months.
Email to our addresses: up to 12 months after it is dealt with.
Newsletter: deleted within 30 days of unsubscribing; unconfirmed sign-ups are deleted after 7 days.

Security

The site uses encrypted connections throughout. Personal data such as complaints, contact details, messages and email is encrypted field by field in our database; screenshots and attachments are stored encrypted, with location and other metadata removed from photos; the keys are kept apart from the data. The console requires a one-time sign-in code, and admins must also use two-step verification. Repeated failed sign-ins lock the account, sign-ins from a new network trigger an email alert, every action is logged, and complaint screenshots are never public. The database is backed up daily in encrypted form and backups are kept for up to 8 weeks, so deleted information may remain in a backup for up to 8 weeks before it is destroyed with that backup. If a breach affects you, we will act to limit it and tell you and the authorities as the law requires.

Your rights

Under the PIPL you can ask us to show you or give you a copy of your information, correct it, delete it, withdraw consent (for example by unsubscribing or asking us to withdraw a complaint), close your console account, or explain how we handle it. Contact us as below; we may need to verify who you are and will reply within 15 working days. If you are not satisfied, you may complain to the cyberspace administration or another competent authority.

Minors

Many of the people we serve are middle and high school students. Information about children under 14 is sensitive personal information under Chinese law and needs a parent’s or guardian’s consent; if you are under 14, please ask a parent or guardian to submit it or contact us for you. If we learn we have collected such information without consent, we will delete it promptly.

Cookies and browser storage

We use no advertising or analytics cookies. The site keeps one value in session storage to remember the opening animation (no personal data, cleared when you close the tab). Signing in to the console sets one essential cookie that keeps you signed in. Cloudflare may set its own security cookies to block malicious traffic.

Changes and contact

We may update this policy as our work or the law changes; the date at the top shows the latest revision, and significant changes will be announced on this site and our WeChat account.

Email: privacy@mail.fxql.org.cn
Official QQ: 2066750182. You can also use our contact page or read our Terms & Conditions.