HakoSpace Official Account Privacy Policy

Collector: HakoSpace (legal@hakospace.com) Contact: legal@hakospace.com Effective: 2026-10-14

This version is an engineering draft and has not been reviewed by a practicing attorney. Review will be completed before public registration opens, and the result will be announced as a new version.

1. Introduction and Scope

This policy explains how HakoSpace handles personal data related to the "HakoSpace Official Account" (the "Official Account"). The Official Account is provided by a central service operated by HakoSpace ("we", "us"). You can reach us at legal@hakospace.com.

This policy is a different document from the Privacy Policy for the self-hosted HakoSpace software: that policy governs the software itself, while this one governs the Official Account data kept by HakoSpace. Statements in the self-hosted policy that the software does not collect data do not apply to the Official Account.

The Official Account is separate from any account on any HakoSpace server (self-hosted or set up by HakoSpace) and cannot be used to sign in to any server. We offer no SSO or OAuth for servers, and we will not link the Official Account to any member account on any server. HakoSpace cannot see the content of any server through the Official Account; the only exception is that, once you voluntarily list a server on hakoHub, we read the information that server publishes (Section 11).

The Official Account currently offers sign-in, management of the account itself, and listing on hakoHub (a public server directory; see Section 11). Other official services such as license binding are not part of this version. If an official service is added, or new categories of data are collected as a result, we will announce it in a new version of this policy; that is a material change and will require your fresh consent (see Section 14).

Visitors who browse the hakoHub directory (hub.hakospace.com) do not necessarily have an Official Account; the notice for visitors is the separate hakoHub Directory Privacy Notice (linked in the directory's footer), and Section 11.6 of this policy only summarizes it.

2. What We Collect, Why, and Where It Is Stored

Purposes: creating and managing the Official Account, verifying your identity, keeping the account secure, sending account-related email, keeping proof that you agreed to the terms, and (when you list on hakoHub) operating the server directory.

Email address: for sign-in, and for sending invitations, verification, password resets and security notices. Stored in lowercase ASCII in this first version. Your Official Account email address is kept only in the account table (staff email addresses are kept separately in the staff roster and staff action records); all other records point to the account using an opaque account identifier.
Password: we store only a hash of the password produced with the scrypt algorithm, not the password itself, and staff cannot see it. We also store the time the password was last changed.
Account status and settings: a randomly generated account identifier, status (pending, active, disabled), email language (Traditional Chinese or English; set by staff when inviting, or taken from the interface language at self-registration), creation and update times, the time the email was verified, an internal counter used to revoke sign-in sessions, and (while a deletion request is pending) the time of the deletion request and who made it (the user or staff).
Last sign-in time: only the time is recorded, to identify idle accounts; no IP address or browser information is recorded.
Sign-in sessions: the records needed to keep you signed in, including a hash of the session credential (the original is not stored), creation and last-use times, and idle and absolute expiry times. A session expires after 7 days idle or 30 days after it was created.
One-time link records: for invitation, registration confirmation and password reset links we store only a hash of the link credential, its purpose, and its creation, expiry and use times. Links are valid for 72 hours (invitation), 24 hours (registration confirmation) and 1 hour (password reset), and can be used once.
Lockout exception credential: after a successful sign-in we place a random credential in your browser (see Section 5, __Host-hako_dev); the server stores only its hash, its creation, last-use and expiry times, and the number of wrong passwords counted against this credential, for the exception to the failed-sign-in lockout described in the next item. It is a randomly generated credential, not a device fingerprint.
Failed sign-in counter: the number of consecutive failed sign-ins, the time of the last failure and the lock expiry time, used to defend against brute-force attacks. After 5 consecutive failures the account is locked for 1 minute, with the lock doubling each further failure up to 1 hour.
Email send counters: per account, per type of email, per day, the number sent and the last send time, used to prevent mail abuse.
Account event records: security and audit records of "which account (opaque identifier only), when, what happened, and who triggered it (the user, staff, or the system)". Events include invitation, resending an invitation, registration, activation, disabling and re-enabling, unlocking, sign-in success and failure, sign-out, password change, password reset request and completion, session revocation, deletion request and cancellation, permanent account deletion, clean-up of an account that was never activated, re-consent to the terms, email send failure and email quota exhausted. Event details contain only short categories (for example, the category of a sign-in failure reason) and do not contain email addresses, IP addresses, browser information, passwords or link credentials.
Consent records: which document (Terms of Service or Privacy Policy) you agreed to, which version, when, and the context of the consent. The age declaration is part of the consent tick-box wording; we do not store your age or date of birth separately.
Account deletion record: when an account is permanently deleted, we keep a record containing only the opaque account identifier, the deletion time and a retention end date, used to decide when the consent records may be removed; it does not contain the email address.
hakoHub listing data (only if you list on hakoHub): the server address, public information read from that server, the tags you set, the public fingerprint of the hub key (key_id), the encrypted probe key, probe status and times, the version of the Terms you agreed to by ticking the box when registering (the Listing Policy forms part of the Terms) and when, the registration cool-down counter, review records, notification records, and block-list and tombstone records. Details, the way probing works and public display are in Section 11; retention is in Section 9.
Staff action records: management actions staff take on Official Accounts in the operations console (invite, resend invitation, disable, enable, revoke sessions, unlock, request deletion on the user's behalf, cancel deletion), recording the acting staff member's email address, the time, the type of action, the opaque identifier of the affected account and a short category. The records do not contain the affected account's email address, IP address or browser information.
Email sent to legal@hakospace.com (reports, appeals, requests to exercise your rights, notifications and other inquiries): the sender's email address and the content and attachments of the message, used only to receive, verify, reply to and, where necessary, legally handle the matter; a person who reports a Listing does not necessarily hold an Official Account. Retention is in Section 9.

If you do not provide the data necessary to create and verify an account (an email address and a password), you cannot create or use an Official Account; if you do not provide hakoHub listing data, you simply cannot list on hakoHub, and the other functions of the Official Account are unaffected.

3. What We Do Not Collect

HakoSpace's account service program does not store: name, phone number, date of birth, address, display name, avatar, IP address, browser (User-Agent) information, device fingerprints (any identifier derived from browser or device characteristics), or geolocation information. The only browser-related items are the randomly generated session and __Host-hako_dev credentials described in Section 5, of which only hashes are stored.

Note that this describes only what the HakoSpace account service itself stores. Your connection still passes through third parties such as Cloudflare (see Section 7), which see connection information (such as your IP address) in transit; we cannot control that platform-level processing.

Telemetry (usage statistics that HakoSpace servers report after their administrator chooses to turn it on) is kept in a separate database. The Official Account service does not connect to the telemetry database, does not store telemetry instance identifiers, and does not link telemetry data to your Official Account. hakoHub and telemetry are two separate features, each of which a server administrator must choose to turn on: hakoHub does not use the telemetry instance identifier and is not linked to telemetry data.

4. IP Addresses and Security Measures

To limit how often sign-in, registration, password reset and similar actions can be attempted, our service temporarily uses your IP address (the first 64 bits for IPv6) as the key for Cloudflare's rate-limiting feature. We do not write it to a database, do not write it to service logs, and do not store it elsewhere. When counting by email address, only part of its hash is used; for a recognized browser (Section 5), the random identifier of its credential is used instead; actions after sign-in (changing the password, requesting deletion and the like) are counted by the opaque account identifier. The cool-down after failed hakoHub registration attempts is counted by Official Account identifier in the database (5 consecutive failures lock for 5 minutes, then 10, 20 and 40 minutes, up to 1 hour; the count restarts after 24 hours without a failure), so the account identifier and failure count are briefly stored in the database; no IP address is stored. The IP address is used only as the key for a per-minute attempt limit, handled temporarily by Cloudflare's rate-limiting feature.

We have turned off observability and logging features of the service's runtime environment. Our own program logs record only event categories, reason categories, email types and error codes; they do not record email addresses, account identifiers, IP addresses, headers, URLs, link credentials, passwords or form content.

Other security measures include: passwords are stored only as hashes; passwords must be at least 15 characters; when you set or change a password it is checked against a list of leaked passwords (see Section 7); lock-out after failed sign-ins; one-time links that are time-limited and single-use; existing sessions become invalid when an account is disabled or when you revoke sessions; and the staff console is access-controlled (see Section 8). These describe measures we actually take and are not a statement of conformity with any third-party certification or standard.

5. Cookies

The Official Account website program sets only the following three cookies, all necessary for sign-in and security:

__Host-hako_sid: your sign-in session. It contains the session identifier and credential; it is sent only over secure connections (Secure) and cannot be read by page scripts (HttpOnly). It lasts at most 30 days from creation (sign-in or password change), expires after 7 days idle, and is cleared when you sign out.
__Host-hako_dev: an exception credential for sign-in lockouts. It is a randomly generated credential, not a device fingerprint, and our server stores only its hash; one browser corresponds to one account. It lets a browser that has signed in successfully be unaffected by lockouts targeting that account (so that someone deliberately entering wrong passwords cannot lock you out): such a browser can still sign in, change the password, request account deletion and cancel a deletion while the account is locked; wrong passwords are counted against this credential instead (20 in total invalidate it) and not against the account's failed-sign-in counter; and a successful sign-in with it during a lockout does not clear the failure counter, so the lock simply runs out. It lasts 90 days and is replaced on each successful sign-in. It is invalidated when: the password is reset; the password is changed (including for the current browser); the account is disabled; staff revoke sessions; staff enable the account and require a password reset; staff request deletion on your behalf; you use "Sign out all other devices" (the current browser's credential is kept); you request deletion of your account (the credential of the browser that submitted the request is kept, so that you can still cancel from it during the grace period even if you are being targeted by a lockout); and when the account is permanently deleted.
__Host-hako_lang: remembers the interface language you chose (Traditional Chinese or English); it is not secret data. It is set only when you switch language and lasts 1 year.

Our program does not use advertising, analytics or tracking cookies. The human-verification service (Cloudflare Turnstile) has your browser load a Cloudflare script directly; whether it sets cookies or storage and what browser information it collects is determined by Cloudflare, so please refer to Cloudflare's privacy policy.

6. Email We Send

The Official Account currently sends only transactional email related to the account, from the address no-reply@hakospace.com: invitations, registration confirmation, password reset, a notice that "someone registered with your email address but an account already exists", a security notice that your password has been changed, one notice each when you yourself request deletion of your account and when you cancel it, and (when you list on hakoHub) hakoHub notices: the result of a review (approved, or returned with a reason), a Listing being taken down (with the reason and the appeal channel, legal@hakospace.com), a Listing being reinstated (when an appeal succeeds, with the reason entered by staff), a server being hidden because it cannot be reached, a server reporting information that does not meet the rules (with a reason category), and a Listing about to be removed or already removed (no email is sent when staff request or cancel a deletion, nor when permanent deletion completes). Invitation, confirmation and password-reset emails contain one-time links. We turn off open and click tracking in email. To prevent abuse, apart from the password-changed and deletion request/cancellation security notices, emails that users can trigger (forgot-password, registration and the like) have per-account limits on how many of each type can be sent; invitations and reset emails triggered by staff, and hakoHub notices, are not subject to them. Once the terms and this policy are in effect, every email and every page footer carries links to the Terms of Service and Privacy Policy and legal@hakospace.com; the deletion-request email always says "to cancel, sign in with the browser you used to request the deletion; if you cannot cancel, write to legal@hakospace.com".

Emails are sent on our behalf by a third-party sending service (see Section 7); we currently provide no setting to opt out of these account-security emails; hakoHub notices are all necessary notices about the status of a Listing and likewise have no separate opt-out; if you no longer want them you can withdraw the corresponding Listing in your account.

7. Third-Party Services, What Is Sent, and Cross-Border Transfer

Cloudflare, Inc.: provides the service's runtime environment (Workers), databases (D1; one for accounts and one for hakoHub), object storage (R2, which holds the public hakoHub snapshot), delivery of the hub.hakospace.com directory pages, rate limiting and human verification (Turnstile), and acts as a reverse proxy for all connections, so it processes connection information in transit. The account database, the hakoHub database and the object storage holding the public snapshot are all located in Cloudflare's Asia-Pacific region (currently primarily in Singapore). The staff console is additionally fronted by Cloudflare Access for staff sign-in (staff only; not related to ordinary account users).
Cloudflare Turnstile (human verification, used on the sign-in, forgot-password, set-password, reset-password, registration, cancel-deletion, and hakoHub registration and change-address forms): your browser loads Cloudflare's verification script directly and communicates with it; what it sends is determined by Cloudflare, so please see its privacy policy. When our server checks the result with Cloudflare, it sends only the verification token and a randomly generated request code, and does not send your IP address, email address or password.
Zoho (Zoho CPaaS, using its US-region endpoint): sends the emails described in Section 6 on our behalf. What is sent is the recipient's email address, the sender, the subject, a label for the type of email and the email body (including the one-time link; the body of a hakoHub notice includes the name and address of the server you listed). We do not send your IP address or account identifier. How Zoho retains this data is governed by its own policies.
Have I Been Pwned (Pwned Passwords): when you set or change a password, our server sends only the first 5 characters of the password's SHA-1 hash to query the service (k-anonymity); matching is done on our side. Your password, the full hash and your email address are not sent. If the query times out or fails, we let the password be set rather than blocking you.

Cross-border transfer. These third-party services may process data outside Taiwan, and the account database, the hakoHub database and the public snapshot are located in Cloudflare's Asia-Pacific region (currently primarily in Singapore). By using the Official Account you acknowledge and agree that your personal data will be transferred outside Taiwan for the purposes above. We currently use no third parties other than Cloudflare, Zoho and Have I Been Pwned to process your Official Account data. A server you list on hakoHub, and its administrator, are not our processors but independent third parties: our service connects to that server (Section 11), and visitors' browsers load its icon directly from it.

Other than the services above, the directory content you choose to publish on hakoHub (Section 11) and as required by law, we do not sell or rent your personal data and do not provide it to other third parties.

8. Who Can See the Data

You: you can see your account information and the number of devices currently signed in on the account page.
HakoSpace staff (through the operations console): the console can be used only by staff who sign in through Cloudflare Access and whose identity and role the console itself verifies again; account management is limited to the administrator role (other roles cannot see account data). Administrators can see, in the console: the account list with account identifier, email address, status, language, creation time, last sign-in time, and the time and requester (the user or staff) of a deletion request; the number of email send failures in the last 7 days (a number only); the time of the last successful periodic cleanup; and staff action records (which show the affected account's current email address, or only the identifier if the account has been deleted). Administrators can: invite and send an email, resend an invitation, disable, enable (optionally requiring a password reset: the old password is voided and a reset email is sent), revoke sessions, unlock, and request deletion of an account on the account holder's behalf (with a 14-day grace period) or cancel a deletion. The console has no function to read password hashes, session credentials or one-time link credentials, cannot show the content of account events, cannot view or directly set your password, and cannot delete an account immediately.
Staff with a hakoHub review role: staff with the hub_reviewer or administrator role can see, in the operations console, pending hakoHub content with old and new side by side, all Listings (address, key fingerprint, the host name the server reports, the version of the Terms of Service you agreed to (the Listing Policy follows it) and when, public information, tags, status, time of the last successful probe), review records and the block list, and can approve, return, take down, reinstate, block, lift a block and manage tags; icons on the review page are downloaded by our service and passed to staff, so staff browsers do not connect to your server; the system also sends these staff a digest email (at most one per hour) that contains only the number of pending items and a console link. The review page reads the hakoHub database, which holds no email addresses, so review staff cannot see the lister's email address or account identifier on it. Review staff who are not administrators cannot see the other account data described above.
HakoSpace itself: because HakoSpace manages the Cloudflare account and database, it may technically be able to access the database directly. We access it only to the extent needed for operations, security and legal purposes.
We do not use Official Account data for advertising, analytics or marketing.

9. Retention

The following are upper limits on retention (extended as described in the last item below when a scheduled run fails); much of the data may be deleted sooner.

Account data (email, password hash, status, language, times, etc.): for as long as the account exists; after deletion, see Section 10.
Accounts not yet activated (including accounts disabled by staff that never had a password set): deleted once 7 days have passed since the account was created, since its last change (including staff disabling or re-enabling it), and since the last invitation or confirmation link was sent; if staff act on the account or a link is resent in the meantime, the 7 days count from that moment. An account with a pending deletion request is handled under Section 10.
Sign-in sessions: deleted within 1 day after they expire (by the periodic cleanup, which runs every 6 hours, and by checks at time of use).
Lockout exception credentials: valid for 90 days; deleted immediately when invalidated (see Section 5), and by the periodic cleanup once expired.
One-time link records: 7 days after use or expiry.
Failed sign-in counters: cleared on a successful sign-in, on setting, resetting or changing the password, when you yourself request or cancel deletion, when staff enable the account and require a password reset, and when staff unlock the account (exception: while the account is locked, a successful sign-in or deletion cancellation from a recognized browser does not clear them, so the lock simply runs out); a last failure older than 24 hours is no longer counted; the rest are deleted by the periodic cleanup.
Email send counters: only the current day (and the previous day if still in cool-down) is kept.
Account event records: 365 days after the event.
Account-related staff action records: 365 days (records that concern only the staff roster itself are about staff, not about Official Account users, and are not covered by this period).
Consent records and account deletion records: consent records are kept for as long as the account exists, then for a further 5 years (1,826 days) after the account is deleted, after which they and the account deletion record are deleted.
hakoHub listing data (address, public information read, tags, key_id, encrypted probe key, probe status): for as long as the Listing exists. When the account has a deletion request pending or is disabled, Listings are hidden and probing stops right away, and the data is kept temporarily so it can be restored if the deletion is cancelled; when the account is permanently deleted, it is deleted in the same cleanup run; if any of these synchronizations fails temporarily, a daily reconciliation corrects it at the latest. When a Listing is removed (you withdraw it in your account, publishing is disabled or the key is regenerated in hakoApp and we confirm it, it has been unreachable for 30 days, or the account is permanently deleted), the entry, the encrypted probe key, the tag links and the probe state are deleted immediately, leaving only the tombstone below; to come back you must list again and go through review again. A Listing taken down by staff does not count as "removed": the entry and its approved content are kept in the hidden state (so an appeal can be handled), it is never restored automatically, probing is reduced to once a day, and it is still removed after 30 days unreachable; you can also withdraw it yourself at any time.
hakoHub Listings that stay unreachable: marked unreachable after about 1.5 hours (three failed probes in a row); hidden after 72 hours, with probing reduced to once a day; a warning is sent about 7 days before removal; removed after 30 days, leaving only a tombstone. The time is counted from the last successful connection (and restarts on listing, a change of address, restoration of the account and the like); when HakoSpace pauses automatic hiding and removal because it judges its own service to be malfunctioning, the periods are extended accordingly (Listing Policy 7.1).
hakoHub tombstones: contain only a hash (SHA-256) of the server address, the full hash of the key (the key_id is its first 16 characters), the removal time and a reason category, and no account identifier, entry number or original address; 90 days.
hakoHub block list: blocked domain names (in the original form, without the port, so staff can recognise them; a different port or a subdomain is blocked too) or key fingerprints (key_id), a reason category, a staff note (required; if existing Listings that match are taken down by the block, the note is sent to their lister as the reason), the staff member who made the entry and the time; no expiry, and staff can lift a block.
hakoHub review records (the actor, time, decision and reason, and the content of a change such as tags added or removed; blocks and lifted blocks are recorded too, including the blocked domain name in the original form or key fingerprint, and after a block is lifted the row in the block list is deleted but this record is kept until it expires): 365 days (the same as account-related staff action records).
hakoHub notification records (a notice not yet sent contains the server address and name and a reason category or an explanation written by staff): this content is cleared when the notice is sent, leaving only the notice type, the recipient account, the entry number and the times created and sent, and the record is deleted 30 days after sending; a notice that has not been sent is kept for at most 90 days after creation. When you withdraw a Listing yourself or the account is permanently deleted, notices not yet sent are deleted with it (and when the account is permanently deleted, the records of sent notices too). The same applies to a "removed" notice sent to you after a server is removed: once it is sent, its record no longer contains the server address or name; the same applies to a "reinstated" notice (which includes the reason entered by staff).
hakoHub registration cool-down counters: a last failure older than 24 hours is no longer counted; the rest are deleted by the periodic cleanup, and they are deleted with the account when it is permanently deleted.
hakoHub public snapshot: regenerated and written over the same file after each probing round (a batch of Listings that are due is processed about every 5 minutes; each server is probed about every 30 minutes, or once a day while hidden); older versions are not kept, and it contains only publicly displayed content.
Email sent to legal@hakospace.com (reports, appeals, rights requests and the like): 365 days after the matter is closed (the same as review records), then deleted; where the law requires a longer period, that period applies.
Database backups: Cloudflare D1's point-in-time restore feature (applies to both the account database and the hakoHub database), with a restore window of at most 30 days (Workers Paid plan); data that has been deleted stays in backups for at most a further 30 days and disappears as the window passes.
Server logs: we do not retain them (see Section 4).
The account database's periodic cleanup runs every 6 hours and the hakoHub database's retention cleanup runs once a day; if a run fails it is retried at the next run, so actual deletion may come slightly after the periods above.

10. Deleting Your Account

After signing in you can request deletion of your account from the account page; you must re-enter your password and tick a confirmation. The account is then first disabled, all devices are signed out, and a 14-day grace period starts. During the grace period you can cancel by signing in on the sign-in page with your email and password, then re-entering your password on the page that appears and pressing "Cancel deletion"; the account is then restored (you must sign in again afterwards, and simply signing in during the grace period does not cancel the deletion). When you request deletion, we keep only the lockout exception credential of the browser that submitted the request (the credentials of other browsers are invalidated), so that you can still cancel from that browser even if you are being targeted by a lockout; please cancel with the browser you used to request deletion, and if you cannot cancel, write to legal@hakospace.com. We send one notification email when you request and one when you cancel. When the grace period ends, the periodic cleanup, which runs every 6 hours, permanently deletes your account data (within about 6 hours after the grace period ends; if a run fails, at the next run), including the email address, password hash, sessions, one-time link records, lockout exception credentials, failed sign-in counters and email send counters; no further email is sent when permanent deletion completes. After deletion the same email address can be registered again immediately (provided registration is open at that time), and the new account has no connection to the retained records.

Staff can also request deletion on your behalf (with the same 14-day grace period). No notification email is sent when staff request or cancel a deletion; the next time you sign in with the correct password you will see the status of the deletion request. You cannot cancel a deletion requested by staff yourself and must write to legal@hakospace.com; staff can also cancel a deletion during the grace period (whoever requested it), after which the account's status returns to what it was before the request (an account that was already disabled when the request was made stays disabled); devices signed out and credentials and links invalidated at the time of the request are not restored.

Deleting an account does not make all data disappear immediately. The following continue to be kept until their own retention periods end:

Account event records: they contain only the opaque account identifier and no email address, and are kept until 365 days after the event.
Consent records: they contain only the opaque account identifier, the document, version and time of consent, and no email address. As proof that you agreed to the Terms of Service and Privacy Policy, they are kept for 5 years after the account is deleted.
Staff action records: the account-related ones are kept for up to 365 days; the affected account appears in them only as an opaque identifier.
Account deletion record: contains only the opaque account identifier, the deletion time and a retention end date, and no email address; kept until the consent records are removed (see Section 9).
Database backups: see Section 9.

hakoHub Listings. When you request deletion or the account is disabled, your Listings are hidden right away and no longer probed; after the deletion is cancelled or the account is re-enabled, a Listing is restored when our next probe succeeds (it stays hidden if the server cannot be reached or was already hidden for another reason before the account was disabled); when the account is permanently deleted, the Listings are deleted together with the encrypted probe key, pending notices and the registration cool-down counter, leaving only a tombstone that contains no account identifier (Section 9). If your server was ever blocked, the block-list record is still kept as described in Section 9; it does not point to your account. The review record left when a Listing is removed (it contains the entry number but no account identifier) is also kept for 365 days as described in Section 9.

We also disable and delete an account when we learn that its holder does not meet the age requirement (deletion follows the process described above).

11. hakoHub Listings and the Directory

11.1 What this is. hakoHub is a public directory of HakoSpace servers operated by HakoSpace (hub.hakospace.com). A server is listed only when its administrator chooses to turn this on and the administrator (or someone they have authorized) registers it with an Official Account. Your rights and obligations are in Section 7 of the Terms of Service.

11.2 What data we store.

What you submit: the server address (only domain names using https), the hub key (see 11.3), tags (up to 5 per server, 1 to 20 characters each), and your consent.
Public information we read from the server: name, description, the URL of the icon (we store only the URL, not the image), how to join (registration mode), a member-count range; when the administrator chooses to publish it, an online-count range; the hakoApp version and the protocol version; and the host name the server reports having received (for review staff reference only, not shown publicly). Member and online counts arrive only as ranges (0, 1–4, 5–19, 20–99, 100+); we do not receive exact numbers.
Key-related data: the public fingerprint derived from the hub key (key_id), and a separate key derived from the hub key and used for probing, which is stored encrypted. The original hub key is not kept: it passes through the service's memory only at the moment you register or change the address, and is not written to the database or logs.
State: approved and pending content, the Listing's status, the next probe time, the number of consecutive failures and the last success time.
Registration and consent: the version of the Terms of Service you ticked when registering (the hakoHub Listing Policy follows it), and when; and the cool-down counter for failed registration attempts (Official Account identifier, number of consecutive failures, time of last failure and cool-down expiry).
Review and notification records: who (a staff member, the system, or you) did what to a Listing and when (review decisions and reasons, automatic hiding or removal, your withdrawal, address and tag changes), and the notices to be sent to you.
Owning account: a Listing records only the opaque identifier of your Official Account, not your email address.
Block list and tombstones: see Section 9.

11.3 Probing: HakoSpace connects to your server periodically. For hakoHub, hakoApp does not connect to HakoSpace on its own to notify or upload directory information; the direction is the opposite: our hakoHub service (the only service that connects to the address you listed) periodically (currently about every 30 minutes) sends a request to the hub endpoint of your server. The request carries the address you listed, a time, a random value, the Listing's current status (pending, listed or hidden, with a reason category) and a signature computed with the hub key; your server signs its response with the same key. The probe request and response carry only signatures, never the key itself; when you register or change the address, you submit the hub key once to the Official Account service over an encrypted connection (see 11.2). Before each connection we use Cloudflare's DNS service to look up your domain and confirm that it points to a public network address. When you register, a complete probe is run first and the Listing is written only if it passes; we also check the file type and size of the icon URL (it must be PNG, JPEG or WebP and no larger than 512 KiB) and do not store the image. When review staff view a Listing on the review page (both the approved icon and a pending new icon), our service downloads the icon from your server solely to show it on the review page and does not store the image. The User-Agent of the probe request is HakoSpace-Hub/1 (+https://hub.hakospace.com/bot), and that page explains what the probe does and how to stop it. Your server will see these requests from the HakoSpace service and may record them in its own logs. You can stop this at any time: disable publishing in hakoApp, regenerate the key, or withdraw the Listing in your Official Account.

11.4 What is shown publicly. Approved content (how to join and the count ranges follow what the server reports and are not reviewed separately) is shown on hub.hakospace.com, where anyone can see it: name, description, icon, how to join, the member-count range, the online-count range (only if the administrator turned it on), tags, the connection status (shown only when the server is unreachable), and the server address (the card shows the domain name, and the address is used for "Join" and "Copy address"). Each card has a "Report" link that opens the visitor's mail program with a message to legal@hakospace.com, carrying the entry's public code, name and address in the subject and body. The directory is ordered randomly with a seed that is fixed for each UTC day, not by payment or rating. The public snapshot is stored in Cloudflare R2 and contains only publicly displayed content and an irreversible public code, not your email address, account identifier or entry number. We do not show your email address, but the name, description and address you choose to publish may themselves point to you indirectly.

11.5 Notices. We email the Official Account's email address to tell you the result of a review, that a Listing has been taken down (with the reason and the appeal channel), that a server has been hidden because it cannot be reached, that the information a server reports does not meet the rules, that a Listing has been reinstated (when an appeal succeeds), and that a Listing is about to be removed or has been removed. The types and sending rules are in Section 6.

11.6 Visitors who browse the directory. Browsing the directory does not require an Official Account, and a visitor is not necessarily "you" as used in this policy. What the directory pages do with visitors' data is set out in the hakoHub Directory Privacy Notice (linked in the directory's footer). In short: server icons are loaded by the visitor's browser directly from each server, so the administrator of each server sees the visitor's IP address and browser information; the directory pages themselves are delivered through Cloudflare (see Section 7), and beyond that we do not separately record visitors' IP addresses, and the pages set no cookies and use no analytics scripts.

11.7 Withdrawal. You can withdraw a Listing on the hakoHub page of your Official Account, or disable publishing or regenerate the key in hakoApp (we withdraw it once we detect and confirm that). When a Listing is removed, the entry, the encrypted probe key and the tag links are deleted immediately (Section 9); to come back you must list again and go through review again. We have no withdrawal form that works with only an address and a key and no sign-in.

11.8 Changing the address. You can change the listed address on the hakoHub page of your Official Account: you must paste the original hub key of that Listing again, we probe the new address again, and once it passes the Listing goes back to review (see Section 5 of the hakoHub Listing Policy).

12. Your Rights and How to Exercise Them

Under the Personal Data Protection Act and other applicable law, you may request, regarding your personal data: inquiry or access, a copy, supplementation or correction, cessation of collection, processing or use, and deletion.

Write to legal@hakospace.com, from the email address of your account so that we can confirm it is you; if you cannot use that address, are applying through a representative, or have no Official Account (for example, as a person who reported a Listing), say so in your message and we will confirm your identity in a reasonable alternative way. We will handle and reply within the periods set by Article 13 of the Personal Data Protection Act: for requests for inquiry, access or a copy, we will decide within 15 days of receiving the request, extendable by up to 15 days where necessary; for requests for supplementation or correction, cessation of collection, processing or use, or deletion, we will handle them within 30 days of receiving the request, extendable by up to 30 days where necessary. If we need an extension, we will notify you in writing of the reason. We do not currently offer a self-service export; when you request a copy, we provide it manually.

As permitted by law we may refuse or limit a request in certain cases (for example, where necessary to comply with a legal obligation or to keep consent records); if we refuse, we will explain why. You may also complain to the competent authority.

13. Minors

The Official Account is only for people who are at least 18 years old and have reached the age of majority where they live (whichever is higher). When we learn that an account holder does not meet this requirement, we disable and delete the account. Anyone may report this by writing to legal@hakospace.com.

14. Consent Records, Changes to This Policy, and Re-Consent

14.1 When you tick the consent box while setting a password to activate an account (accepting an invitation or completing registration), we record the documents and versions you agreed to and the time (see Section 2).

14.2 This policy is identified by its effective date. An updated version will be announced on the HakoSpace website at least 14 days before its effective date. We do not promise to notify you of policy changes by email.

14.3 A material change is: an expansion of the categories of data collected, a change to retention periods, a new third-party processor, a new official service or category of feature, a change to the region where data is sent, or any change that, on a good-faith assessment, would affect a reasonable user's decision. After a material change takes effect, the next time you use the Official Account you must read and agree to the new version, and you cannot use the Official Account until you do. That page offers two choices: "Sign out" and "I do not agree; delete my account".

14.4 Editorial versions (corrections to typos, formatting and links, and clarifications that do not change the meaning) are published only as a new version with an announcement and do not require re-consent. The system requires re-consent only for material changes: it is enough that you have consented to any version from the most recent material-change version up to the current one, so an editorial version does not block you.

14.5 Earlier versions are never modified; historical versions are available on the website's archive pages.

15. Language Versions

This policy is provided in Traditional Chinese and English. If there is any ambiguity or inconsistency between the two language versions, the Traditional Chinese version shall prevail.

16. Contact

For questions about this policy, or to exercise the rights in Section 12, write to legal@hakospace.com.