Privacy Policy
Last updated: 26 October 2026
This policy explains how the RGC project team (“RGC”, “we”, “us”) handles personal data on rgc-dev.tensorplay.cn, forum.tensorplay.cn, and related services. We design these services around the principles of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the EU ePrivacy rules: collect less by default, prefer anonymity, and require explicit consent for optional analytics.
1. Controller and contact
- Controller: RGC Team
- Contact email: zlx@tensorplay.cn
- Security reports: use the private channel described in Security Disclosures; do not disclose details in a public issue.
2. What we process
| Context | Data | Notes |
|---|---|---|
| Account and sign-in | GitHub user ID, login, email, avatar, display name | Obtained when you authorise GitHub sign-in; email is used only for verification or essential notices |
| Account security | TOTP secret (encrypted), recovery codes (hashed), passkey public key, session records (IP, authentication method, time), API tokens (hashed) | Used for sign-in, MFA, session management, and abuse investigation |
| Package registry | Package name, description, homepage, repository, keywords, README, version files, download counts, stars, organisation members and roles, publish tokens (hashed) | Version files live in GitHub Releases; public packages and READMEs are visible to everyone |
| Playground | Submitted code, run result, compile/run time, user ID, source IP, daily quota | Code is sent to the runner only for the request and is not persisted in our database; share links encode the code in the URL |
| Forum | Account profile, email, posts, replies, attachments, sign-in and moderation records | Attachments are stored in AWS S3; posts are public by default |
| Security and audit | Action, namespace/package/version, IP, time | Used for supply-chain provenance, abuse investigation, and security auditing |
| Anonymous performance | Normalised route, signed-in status, FCP / LCP / INP / CLS / TTFB, time | No IP, user agent, full URL, or account ID; kept for 90 days |
| Transactional email | Email address, verification/notification records, delivery status | Sent through AWS SES |
| Infrastructure logs | IP, time, request path, status code, user agent | Processed by Cloudflare, Azure, and AWS for delivery, security, and troubleshooting |
We do not intentionally collect special-category data such as identity documents, payment information, precise location, or health data. Please do not submit other people's personal information or confidential material in public packages, the forum, or the Playground.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Create an account, publish packages, use the Playground and forum | Performance of a contract (Art. 6(1)(b)) |
| Account security, MFA, abuse prevention, rate limiting, auditing, supply-chain provenance | Legitimate interests (Art. 6(1)(f)) — providing a secure and reliable developer service |
| Email verification and essential account notices | Performance of a contract (Art. 6(1)(b)) |
| Anonymous first-paint performance metrics | Your consent (Art. 6(1)(a)), withdrawable at any time |
| Responding to legal requests and complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Delivering the site through a CDN and loading fonts | Legitimate interests (Art. 6(1)(f)) — serving the site securely and efficiently |
4. Cookies and local storage
Essential cookies and local storage keep you signed in, protect your account, and remember basic preferences; they do not require consent. Optional anonymous performance metrics are off by default. See Cookie settings for the full list and controls.
We do not use advertising cookies, cross-site tracking pixels, or third-party analytics SDKs on this site, and we do not sell personal data.
5. Sharing and processors
We share data only with processors needed to run the service:
- Cloudflare: DNS, CDN, Workers, Tunnel, security protection, and edge logs.
- Microsoft Azure: backend virtual machine and PostgreSQL database.
- Amazon Web Services: SES transactional email, Playground runner, forum server, and attachment storage.
- GitHub: OAuth sign-in and package version file hosting.
- Google Fonts: brand font loading; the request transmits your IP but sets no cookie.
- Beehiiv: blog and newsletter, an independent site governed by its own privacy policy.
We do not sell personal data. We do not disclose data to unrelated third parties except where required by law, during a security investigation, or with your explicit consent.
6. International transfers
The processors above may process data outside your country. Where data is transferred from the European Economic Area (EEA), we rely on the EU Standard Contractual Clauses (SCCs) offered by our processors or equivalent safeguards. You can ask us for a summary of those safeguards using the contact email.
7. Retention
- Account data: kept until you delete your account. After deletion the user row is marked as deleted to preserve package provenance and audit records; public packages may remain.
- Sessions: browser sessions expire after 7 days; server-side session records support security auditing.
- MFA challenges: 5 minutes.
- Audit and Playground run records: kept for supply-chain provenance, quotas, and abuse investigation; they may survive account deletion.
- Anonymous performance samples: 90 days.
- Consent record: you are asked again after 6 months.
- Forum backups: daily rotation, up to 7 copies.
- Infrastructure logs: retained under the security and operations policies of Cloudflare, Azure, and AWS.
8. Your rights
Subject to applicable law, you may request:
- access to the personal data we hold about you;
- correction of inaccurate data;
- erasure (limited by package provenance, audit, and legal obligations);
- restriction of or objection to processing;
- a structured, commonly used copy of data you provided;
- withdrawal of consent for anonymous performance metrics, without affecting the lawfulness of processing before withdrawal;
- a complaint to your local supervisory authority (EEA users may contact their national data protection authority).
Contact zlx@tensorplay.cn. We may verify your identity through GitHub sign-in and will respond within one month; for complex requests we may extend this by two months and will explain why.
9. Security
Our measures include site-wide TLS, HttpOnly and SameSite session cookies, hashed API tokens, encrypted TOTP secrets, passkeys, MFA, least privilege, and audit logging. No system is absolutely secure; if you find a vulnerability, please report it privately through Security Disclosures.
10. Children
This site is intended for developers and is not directed at children under 16. If we learn that we collected a child's data without guardian consent, we will delete it.
11. Automated decisions
We use automated quotas and rate limits to protect the service, but we do not make automated decisions based on your data that produce legal or similarly significant effects.
12. Changes
We will update this page and its “Last updated” date. For material changes to purposes, recipients, or legal bases, we will post a notice on the site and ask for consent again where required.
13. Contact
Questions about this policy or requests to exercise your rights: zlx@tensorplay.cn.
See also: Terms of Service · Cookie settings.