Privacy Policy

1. Introduction

Cogito Libris ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you visit our digital library.

We comply with the EU General Data Protection Regulation (GDPR) and Hong Kong's Personal Data (Privacy) Ordinance (PDPO).

2. Data We Collect

We collect minimal data to provide you with the best reading experience:

• Anonymous usage analytics (page views, reading duration)
• Hashed IP addresses (retained for 2 years for vote system abuse prevention)
• Browser type and device information

We do not collect personally identifiable information unless you voluntarily provide it through comments or feedback.

3. How We Use Your Data

Your data is used solely for:

• Improving our website and user experience
• Preventing abuse of our voting system
• Understanding reading patterns to curate better content
• Security and fraud prevention

4. Legal Basis (GDPR)

Under GDPR Article 6, we process your data based on the following lawful bases:

• Consent (Art. 6(1)(a)) — For optional features like comments or feedback
• Legitimate Interest (Art. 6(1)(f)) — For analytics, security, and service improvement
• Legal Obligation (Art. 6(1)(c)) — Where required by applicable law

Under the PDPO, we collect personal data for purposes directly related to our library functions and use only what is necessary.

5. Data Retention

We retain your data only for as long as necessary:

• Hashed IP addresses: 2 years from last vote
• Analytics data: 25 months (Plausible default)
• Voluntary submissions (comments/feedback): Until deletion is requested

6. Data Storage & Transfers

All data is stored securely on Cloudflare Pages infrastructure. Cloudflare provides adequate safeguards for international data transfers through Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs).

Data may be transferred outside Hong Kong and the European Economic Area with appropriate safeguards in place as required by GDPR Chapter V and PDPO Section 33.

7. Third-Party Services

We use the following third-party data processors (all GDPR-compliant):

• Cloudflare Pages — Website hosting and security (Data Processing Agreement in place)
• Cloudflare D1 — SQLite database for storing reader ratings (no PII; one-way IP hashes only)
• Cloudflare Turnstile — Privacy-first bot protection on the rating form (no tracking, no fingerprinting beyond what's needed)
• Plausible Analytics — Privacy-focused, cookieless analytics (GDPR-compliant, no personal data stored)

8. Reader Ratings

Readers can rate each book and short story on a 1–5 star scale. When you submit a rating we:

• Hash your IP address with a server-side salt using SHA-256, and store only the hash. The raw IP is never stored, logged, or shared.
• Store the one-way hash, your score (1–5), and the work's slug in our D1 database to prevent duplicate votes from the same person on the same work.
• Verify the submission through Cloudflare Turnstile, which does not set cookies and does not track you across sites.
• Store the score you submitted in your own browser's localStorage so the widget can remember your vote on this device. This data stays on your device and is not sent to us.

The hash cannot be reversed into an IP address without breaking SHA-256. Rotating the server salt would permanently reset all ratings; this is a tradeoff we accept because the alternative (storing raw IPs) would be incompatible with our privacy stance.

9. Your Rights

Under GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure ("right to be forgotten") (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7(3))

Under the PDPO, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Ascertain our policies and practices regarding personal data

To exercise these rights, contact us at legal@cogitolibris.com.

10. Cookies

We use minimal cookies:

• Essential cookies for website functionality (legitimate interest)
• No tracking cookies or third-party advertising cookies

Plausible Analytics uses a first-party cookie with a 24-hour expiry for unique visitor counting (no personal data).

11. Children's Privacy

Our Website is not intended for children under 13 years of age. We do not knowingly collect personal data from children under 13. If you are under 13, please do not provide any personal data to us.

If we become aware that we have collected personal data from a child under 13 without parental consent, we will take steps to delete that information.

12. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this privacy policy or our data practices, please contact us at:

Email: legal@cogitolibris.com

We will respond to all requests within 30 days as required by GDPR and PDPO.