Privacy Policy

Information we collect

• Account information: the email address and display name you register with, plus your password stored as a one-way hash (we can never see your plaintext password). If you sign in with Google, we receive the name, email and avatar Google returns.
• Community content: posts, comments, votes, saves, follows and product images you upload.
• Points and transaction records: earn/spend history of 好料 points, redemptions and lottery entries (kept for ledger consistency).
• Usage data: price-check and price-tracking records, and buy-link click logs. Click logs store your IP address solely for per-day deduplication and anti-abuse — not for profiling.
• Technical data: server logs (IP, browser user-agent, access time) used for security auditing and troubleshooting.

How we use it

• To provide the core service: sign-in sessions, publishing, price tracking and drop alerts.
• To send transactional email: verification and password-reset messages (delivered via Resend).
• To keep the points economy fair and prevent abuse (farming, bot clicks).
• To improve content: product intros, translations and similar-item recommendations are AI-generated from product/post text — not from your private account data.

Who we share it with

We never sell your personal information. We share it only as needed to run the service:

• Resend — transactional email delivery (receives your email address).
• Cloudflare R2 / Alibaba Cloud OSS — object storage for images you upload.
• AI providers (an Anthropic-compatible gateway / DeepSeek / Alibaba Bailian etc., per the live admin configuration) — process product and post text to generate intros, translations and moderation verdicts.
• Pinduoduo / Shopee and other affiliate platforms — once you tap a buy link and leave our site, their data practices are governed by their own privacy policies; we do not receive your order details.

Security and retention

Passwords are stored as one-way hashes; sensitive configuration such as third-party API keys is encrypted with AES-GCM. Data is kept until you delete your account or content; server logs rotate out on an operational schedule.

Your rights

Under the PDPA you may access and correct your personal data, and request deletion of your account and associated data. You can edit your profile under Account → Settings; for deletion or other requests, email us at the address below and we will respond within a reasonable time.

Children

The service is not directed at children under 13, and we do not knowingly collect their personal data.

Changes and contact

When this policy changes we update the date at the top and publish the new version on this page. Privacy questions: support@apabagus.my.