Privacy Policy
1. Who we are
Chinese Naming (https://qiming.liuxxiaojun.cn, “this site”) offers traditional Chinese naming and reading tools: name scoring, name generation, BaZi charts and two-name compatibility.
Data controller: the site owner, an individual developer. There is no company entity; domain and hosting costs are covered by Google AdSense revenue. Contact: see section 12.
This English page is a full translation. If anything is unclear, the Chinese version is authoritative.
2. What we collect
2.1 Inputs to the naming and reading tools — they never leave your device. The tools ask for a surname, sex, birth date and time, and birthplace. The chart and the naming run entirely in your browser. None of it is uploaded, and nobody, including the site owner, can see it over the network.
2.2 Messages you send us — these are uploaded. When you submit the contact form, the name you give, the subject, the body and any optional reply address are sent to our server and stored in the site database, readable only by the site owner. Messages are never published. Half-written drafts stay in your browser's localStorage.
Anti-abuse records kept with a submission: the time, a one-way hash of your IP address (used only for a 60-second rate limit; the raw IP is not stored), and your browser's User-Agent.
2.3 Browser local storage — not uploaded.
- Language preference (Chinese or English)
- Saved names
- The surname, sex and birth details carried between pages so you need not retype them
- Drafts of the contact form
2.4 Server access logs. The site is hosted on Cloudflare Pages. Cloudflare records the device information needed to serve and secure requests — IP address, browser type, time, requested page — under the Cloudflare privacy policy.
2.5 Our own page-view counter — no cookies, no raw IPs. To know which pages are read and where readers come from, the site counts page views with its own program running on Cloudflare. Each view records:
- the page path and the time, bucketed to the hour in Beijing time
- the referring domain, if you arrived from an external link (
google.com,baidu.comand so on); direct visits are recorded as direct - a country or region code derived by Cloudflare from network location — never a city, street or precise position
- device type (desktop or mobile)
- whether the request came from a search-engine crawler, which is counted separately and excluded from human traffic
- a per-day visitor identifier: a salted SHA-256 hash of the IP address, with the salt rotated daily. The raw IP is not stored and the same person cannot be recognised across days.
The counter sets no cookies, uses no tracking pixels, writes nothing to your browser, and cannot follow you to other sites or identify you. It produces daily totals only: no visitor profiles, no ad targeting, no linkage to advertising data. Aggregated counts are stored in Cloudflare's key-value store outside mainland China.
2.6 Advertising identifiers. Google AdSense serves the ads. Google sets advertising cookies in your browser and receives your IP address, browser type and the page URL for delivery and measurement. See section 9.
3. How we use it, and on what legal basis
Under Article 6 of the EU General Data Protection Regulation, each purpose has a stated basis:
- Messages — your consent (Art. 6(1)(a)). Submitting the form means agreeing that we may process it in order to reply. You may withdraw at any time.
- Access logs and anti-abuse records — legitimate interest (Art. 6(1)(f)): keeping the site secure and preventing spam. We keep the minimum necessary (IP addresses only as hashes).
- Our own page-view counter — legitimate interest (Art. 6(1)(f)): knowing whether the content is useful. It is de-identified (no raw IP, no cookies, no way to identify a person, no link to ad data), so the impact on your privacy is minimal. See section 10.
- Advertising cookies — your consent (Art. 6(1)(a)). In the EEA and the UK, personalised ads appear only with consent, which you can withdraw at any time as described in section 10.
- Local storage (language, saved names, drafts) — necessary to provide a feature you asked for, and used for nothing else.
4. Sharing, processors and transfers
We do not sell your personal information and do not pass it to third parties for marketing. Only these providers act as processors:
- Cloudflare, Inc. (United States) — hosting, CDN and message storage. Site content is served from its global edge network.
- Google LLC (United States) — AdSense delivery and measurement.
These providers may process data outside your country, including in the United States. Transfers rely on the safeguards they offer, such as the EU Standard Contractual Clauses and their own transfer commitments, as set out in their privacy policies.
Beyond a legal requirement or the processors above, we disclose your information to nobody.
5. Storage and security
- Inputs to the naming and reading tools never leave your device. We neither hold nor store them.
- The only thing uploaded is a contact message, held in Cloudflare KV, reachable only through an admin passphrase, over HTTPS throughout.
- The site sets no first-party cookies of its own, runs no third-party analytics, and builds no user profiles.
- To be honest: nothing on the internet is absolutely secure. We take reasonable technical measures; we cannot promise that no breach will ever occur.
6. Retention
- Messages — deleted automatically 180 days after submission; the stored record carries an expiry. To have one removed sooner, send another message with roughly when you wrote and what the subject was, and it will be located and deleted.
- Rate-limit counters — expire after 60 seconds.
- Browser local data — stays on your device until you clear site data in your browser.
- Access logs — cleared under Cloudflare's retention policy.
- Page-view counts — daily totals are kept long term (numbers only, nothing identifying); the daily visitor hash used for de-duplication expires after 48 hours. The owner can delete the whole set at any time.
7. Your rights
Within the scope of applicable law (GDPR Arts. 15–22, the California CPRA and similar), you have the right to:
- be informed about what we collect and how we use it — this policy
- access a copy of what we hold about you
- correct inaccurate information
- erase your messages and related records
- restrict processing
- object to processing based on legitimate interest
- portability — receive what you provided in a common format
- withdraw consent at any time, without affecting the lawfulness of earlier processing
- non-discrimination — exercising any of these will not degrade or change the service you get
How to exercise them: section 12. We reply within 30 days; where a request is complex we may extend, and will say why in advance.
If you are unsatisfied with the answer, you may complain to your local data protection authority (a DPA in each EU member state; the ICO in the UK).
8. Children
The site offers baby-naming tools, but the forms do not collect guardian identity information and require nothing about the child beyond the name the guardian chooses to consider; everything is entered by the guardian.
The service is not directed to children under 13 (the US COPPA threshold); for users in the EEA the age of digital consent is 16, or lower where a member state has legislated so. If you are a guardian and find that a child has submitted information without consent, contact us as in section 12 and we will delete it.
9. Third-party advertising and cookies
Ads are served by Google AdSense and pay for the domain and hosting. This part is Google's, not ours:
- Google, as a third-party vendor, uses cookies — including the DoubleClick cookie — to record an identifier in your browser and serve ads based on your earlier visits to this and other sites.
- Ad requests pass Google your IP address, browser type and the page URL. We do not give Google or any advertiser the surname, birth details or birthplace you type into the naming tools.
- In the EEA and the UK, personalised ads appear only with consent. Before any consent prompt takes effect, you can opt out yourself as described in section 10.
- How Google uses data for advertising: Google's partner-sites notice.
- Blocking third-party cookies in your browser or with an ad blocker does not affect naming, scoring or chart functions in any way.
Apart from advertising, the site uses no third-party analytics, tracking or profiling service. Page-view counting is done by the site's own program (section 2.5); the data goes to no third party and is not used for advertising.
10. Your privacy choices (including California)
Turning off personalised advertising — the only place the site is involved in cross-site behavioural tracking. Use any one of these:
- Google Ads Settings — turn off ad personalisation, which applies to this site and every site using Google ads.
- aboutads.info or Your Online Choices (Europe) — turn off cookies from participating third-party vendors.
- Set your browser to block third-party cookies, or install an ad blocker.
You will still see ads afterwards; they simply stop being based on your browsing history.
About the page-view counter — it sets no cookie, keeps no raw IP, cannot identify you and is not linked to advertising data, so it runs on legitimate interest and needs no separate consent. Precisely because it happens server-side, with no script in your browser, there is no browser setting that turns off just this count. If that is unacceptable to you, please do not use the site. For California residents: we do not “share” this data for cross-context behavioural advertising.
For California residents (CCPA / CPRA):
- Categories collected — identifiers (the name you give, an optional reply address, the IP hash, the User-Agent), internet activity (pages viewed, ad interactions), and the content you submit. Purposes are in sections 2 and 3.
- We do not sell personal information for money. Under the CPRA definition, however, allowing third-party advertising cookies for cross-context behavioural advertising may count as “sharing”. You can opt out as above.
- Global Privacy Control — if your browser sends a GPC signal, the site's ad consent tool treats it as an opt-out request; before that tool is active, opt out manually using the links above.
- Non-discrimination — exercising these rights does not affect any feature of the site.
- Authorised agents — you may have someone act for you; we may ask for proof of authorisation.
11. Changes
If this policy changes, the effective date on this page is updated and the change described. Material changes to the purposes, categories or recipients of processing are flagged prominently on this page before they take effect.
12. Contact
For any personal-information request — access, correction, deletion, withdrawal of consent, objection, or a copy of this policy in another form — use the contact form. Say what you want, plus roughly when you wrote before and what the subject was, so the record can be found. We respond within 30 days, to the reply address you leave if you leave one.
This is a personal site with no live support. All communication goes through the contact form. Messages without a reply address are still read, but can only inform improvements rather than be answered individually.