Privacy Policy

Last updated: October 10, 2026

This policy explains what data Bosian Li’s Blog (https://bosianli.com, “we” or “the site”) collects, how we use and store it, and how you can have it deleted.

1. Who runs the site and how to reach us

If you have questions about this policy or your data, or want your data deleted, email the address above.

2. Reading articles

You can read every article on the site without signing in. When you browse, the following data is processed:

  • Cloudflare: We use Cloudflare to deliver pages and block malicious traffic. Cloudflare processes your IP address and connection details under the Cloudflare Privacy Policy (opens in new tab).
  • Google Analytics 4: Counts page views without identifying you. Google signals and ad personalization are turned off, and signed-in members and site staff aren’t counted. GA4 sets cookies such as _ga in your browser. Data is processed under the Google Privacy Policy (opens in new tab).
  • Microsoft Clarity: Shows how readers use our pages (such as clicks and scrolling) through heatmaps and session replays, which we use to improve the site’s layout. Signed-in members and site staff aren’t recorded. Clarity sets cookies such as _clck and _clsk in your browser, and data is processed under the Microsoft Privacy Statement (opens in new tab).
  • Article view counts: We count views of each article ourselves. Your browser keeps a random identifier (cas-session) in localStorage so the same article isn’t counted twice within 30 minutes; our server stores only a cryptographic hash of that identifier and deletes it after 30 minutes. We don’t record IP addresses, locations or referrers, and we don’t keep long-term records of visitors.

3. Reader accounts (Sign in with Google)

3.1 What we receive

When you sign in with your Google account, we receive only:

  • Your Google account ID: a number Google assigns, used to recognize you as the same member.
  • Your email address: stored only if Google has verified it, and used only when we need to contact you (for example, about your account). It’s never shown publicly, and we don’t send marketing email.

We never receive your Google password, and we don’t read your Google name, profile photo, contacts or any other Google data. We request only Google’s basic sign-in permissions (openid, email, profile), and we don’t store your Google name or profile photo.

3.2 Data you create on the site

  • Display name: chosen by you and shown publicly next to your comments.
  • Avatar: the first character of your display name, generated by the site. We don’t use Gravatar or your Google profile photo.
  • Comments: the text and time of your comments are shown publicly (after moderation).
  • Likes: each article’s like count is public, but who liked it isn’t.
  • Saved articles (My Bookmarks): visible only to you.
  • Sign-in time: when you last signed in, used for account management and security.

3.3 Cookies

When you sign in, your browser stores WordPress sign-in cookies (wordpress_logged_in_…, wordpress_sec_…) that keep you signed in for up to 14 days and are cleared when you sign out. They’re used only to keep you signed in, never for tracking or advertising.

3.4 Retention and deletion

  • Account data is kept until you delete your account. Inactive accounts aren’t deleted automatically.
  • You can delete your account at any time in Account settings. When you do:
    • Your Google account ID, email address, display name and sign-in records are deleted immediately.
    • Your likes and saved articles are deleted, and like counts go down accordingly.
    • Your comments stay on the site but are credited to “Deleted member”, and the email address, IP address and browser information attached to them are removed. If you’d like your comments deleted too, email us before you delete your account and tell us which ones.
  • You can also remove the site from “Third-party apps & services” in your Google Account. That only stops future Google sign-ins; it doesn’t delete data we already hold. To delete your data, use Delete account or email us.

4. Comments

  • Only signed-in members can comment.
  • When you post a comment, WordPress records your IP address and browser information (user agent) to prevent spam and abuse. This information is never shown publicly, is visible only to Bosian Li and is kept with the comment; it’s removed when the comment is deleted or when you delete your account. Our anti-spam records keep only hashed values, never raw IP addresses or email addresses.
  • Our anti-spam system runs on our own server, and comment text is never sent to a third-party anti-spam service.
  • Comment images: When you upload an image, Cloudflare Turnstile checks that you’re a person (processed under Cloudflare’s privacy policy). Images are stored in a non-public directory on our server and checked automatically for inappropriate content by software running on that server; they’re never sent to a third party. Every image is re-encoded (animated GIFs are rebuilt frame by frame), which strips metadata such as GPS location and camera model.
  • Comments posted before members-only commenting began are anonymous, and the email addresses entered with them aren’t shown publicly.
  • We don’t use Gravatar. Every avatar is generated by the site from the first character of a name, so no one’s email address (or a hash of it) is sent to a third-party avatar service.

5. Sharing

Apart from the processing by Cloudflare, Google and Microsoft described above that’s needed to run the site, or where the law requires it, we don’t sell, rent or give your personal data to any third party, and we don’t use it for advertising.

6. Where your data is stored and how it’s protected

Member and comment data is stored in the site’s WordPress database; article view counts and comment images are stored in non-public directories on our server. The whole site uses HTTPS. Only Bosian Li can access this data.

Bosian Li uses AI tools (currently Anthropic’s Claude Code and OpenAI’s Codex) to help maintain the site. While doing so, these tools may read data such as site settings, comment text and member display names; that content is sent to the AI service for processing and handled under that service’s terms and Bosian Li’s account settings. Bosian Li doesn’t use your data to train AI models, and doesn’t give member data to AI services for any other purpose.

7. Your rights

Under Taiwan’s Personal Data Protection Act, you can ask to access, view or get a copy of your personal data, to add to or correct it, to have us stop collecting, processing or using it, or to have it deleted. You can do most of this yourself in Account settings; for anything else, email [email protected] and we’ll reply within 30 days.

8. Children

You must be at least 13 years old, and meet Google’s age requirements for accounts, to become a member. If you’re under 18, please get permission from a parent or legal guardian before you sign up or comment. If we learn that someone under 13 has created an account, we’ll delete it.

9. Changes to this policy

When we change this policy, we’ll update this page and the “Last updated” date above. We’ll announce significant changes on the site.