Privacy Policy

QCRadar ("we", "us", "the site") is an information platform that aggregates publicly available product listings from Weidian and provides outbound links to third-party 代购 (reverse purchasing) services. This policy explains what personal data we collect, why, how long we keep it, and your rights under GDPR (EEA/UK) and CCPA/CPRA (California).

When the guest browsing limit is enabled, the strictly necessary __Host-browse-day cookie assigns a random, signed daily identity to enforce an allowance of 50 different product pages per day, resetting at midnight Beijing time (UTC+8). It contains no email, IP address or browsing list. Cloudflare stores the limited set of product identifiers for that identity until shortly after the day ends. This functional cookie operates independently of analytics consent and Do Not Track; it does not turn analytics back on.

To prevent bulk collection, signed-in browsing uses the random, signed __Host-browse-device browser cookie for 30 days. Each account and browser can open up to 30 new products in a rolling 10-minute window and 150 per Beijing calendar day; revisits that day do not count again. The server stores a hash of the browser identifier, linked account IDs and first/last observation times for up to 90 days after the last observation. Account deletion removes its links. This identifier is not a hardware fingerprint or proof that accounts belong to the same person. Clearing cookies or changing browsers can create a new identifier. It is used for access protection, not advertising or cross-site tracking, and does not enable analytics. Device associations begin with signed-in product browsing after this feature is enabled.

When network access protection is enabled, we use the connection IP address at the edge to derive a keyed hash and correlate short-window product access across accounts and browser identities. This protection stores hashes of the network, account, browser and product identifiers, access times, verification state and temporary restriction history in Cloudflare; it does not store raw IP addresses in that state. Short-window records are pruned during requests, and the remaining state is scheduled for deletion after 24 hours and 30 minutes without activity. Suspicious access may require Cloudflare Turnstile verification or temporarily restrict new product access. Cloudflare processes the verification token, connection IP and browser signals for this check. A shared IP does not prove that accounts belong to the same person. Verification does not reset browsing allowances. This security processing operates independently of analytics consent and does not enable analytics.

When the free QC preview is enabled, the strictly necessary qc_trial cookie assigns a random browser identity to unlock one inspection batch of full-size photos and videos. It lasts 30 days by default and does not reset daily. Our server retains the selected media references until this identity expires. The cookie contains no email, IP address or browsing history. It works independently of analytics consent and Do Not Track and never enables analytics. Clearing cookies or using another browser may create a new guest identity.

1. Data we collect

• Account data (only if you register): email address, hashed password (bcrypt), display name, role.
• Behavioral logs: search queries, product views, outbound buy-button clicks, IP address, user-agent. Stored in our database (search_logs / click_logs tables) for product analytics and search-quality improvement.
• Favorites & history (registered users only): products you save and view, retained while your account exists.
• Cookies: see Cookie Policy.
• Server logs: HTTP access logs (URL, status, method, IP, country, user agent, referrer) kept up to 7 days for security and abuse forensics. Cookie and Authorization headers are stripped before writing.

2. Data we do NOT collect

• Payment information. All purchases happen on third-party 代购 platforms (KakoBuy, Superbuy, Sugargoo, etc.). We never see your card or shipping address.
• Government identifiers (passport, national ID, SSN).
• Precise geolocation. We only record coarse country-level signal from IP for traffic analytics.

3. Why we process this data (legal basis)

• Contract (GDPR Art. 6(1)(b)): operating your account, favorites, history.
• Legitimate interest (GDPR Art. 6(1)(f)): security, fraud prevention, search-quality measurement, aggregated analytics.
• Consent (GDPR Art. 6(1)(a)): non-essential cookies, newsletter (when launched).
• Legal obligation (GDPR Art. 6(1)(c)): retaining audit logs of admin actions for compliance.

4. Third parties

We use these processors. Each is bound by their own DPA / privacy terms:

• Cloudflare — DNS, CDN, DDoS protection, WAF. Receives all HTTP traffic metadata.
• OVH — server hosting (EU region). Stores the database and logs.
• DashScope (Alibaba Cloud) — AI image-search and product attribute extraction. Receives uploaded images at search time; we do not retain them server-side after embedding.
• Resend — transactional email (account / password reset). Receives your email address only.
• Plausible (self-hosted, planned) — privacy-friendly, cookie-less analytics. No cross-site tracking.
• Google Analytics 4 — Google Analytics 4 is optional and loads only after you explicitly accept the updated Analytics notice. Google receives limited page, referral, device and interaction data, including QC usage and outbound clicks, and processes network information to deliver the service. We do not send account identifiers, email addresses, parcel numbers or raw search/link input. Advertising personalization and Google Signals are disabled. The _ga and _ga_* cookies expire one year after their last update. You can withdraw consent in Cookie preferences; we stop collection and delete these cookies. Google processes data under its Privacy Policy.

Outbound 代购 platforms (KakoBuy, Superbuy, Sugargoo, etc.) are independent operators. Once you click an outbound buy button you are on their site under their privacy policy.

5. Data retention

• Account data: until you delete your account.
• Search & click logs: 90 days for the per-user history view, then aggregated and stripped of IP / user-id.
• Server access logs: up to 7 days — rotated by size, so often shorter under heavy traffic.
• Admin audit logs: 2 years (compliance with our internal SOPs).

6. Your rights

Under GDPR Articles 15-22 and CCPA §1798.100-130 you have the right to: access, rectify, erase, restrict, port, and object to processing of your personal data. To exercise these rights see the GDPR Rights page or email us. You may also lodge a complaint with your local data protection authority.

7. International transfers

Our servers are in the EU (OVH). DashScope processes inference in Singapore / Hong Kong. Where data leaves the EEA, transfers rely on Standard Contractual Clauses or equivalent safeguards.

8. Children

The site is not directed at children under 16. We do not knowingly collect data from minors.

9. Security

Passwords are hashed with bcrypt (cost ≥ 12). Sessions use HTTP-only, Strict SameSite cookies + double-submit CSRF tokens. The database is encrypted at rest and TLS-encrypted in transit. Backups are encrypted before upload to object storage.

10. Changes to this policy

We will post material changes on this page with a new effective date and notify registered users by email when changes affect their rights.

11. Contact

Email [email protected]. Postal contact available on request.