Draft, awaiting approval.
Privacy
We collect as little as we can, and never ask for ID, a phone number or an address.
What we keep
- Your email (to log in), the name you give (real or chosen), the name on your card and your Telegram username.
- The year you first joined. For the young tier, the date it ends: we ask your year of birth to work it out, and do not keep it.
- New applicants: the two members you named, their letters and your answers.
- Your payments: amount in HKD and sats, and the date. No bitcoin addresses.
- If you use them: your classified posts and their photos (location data removed), your authenticator app for two-step login, and the phones you turn notifications on.
- Sponsors: the company's details and the emails of the people in its seats.
- If you ask to hear when applications open: only your email, deleted once we have told you.
- A login cookie on your device. No tracking or advertising cookies.
Who sees it
- You, and BAHK's admins, including the treasurer.
- Places that scan your card see your card name, tier and whether it is valid.
- Members see the name on your card on your classified posts, and your Telegram username only when they tap Message seller.
- A sponsor's admin sees the names and emails of the people in its seats.
- Our BTCPay sees your first name and member number with each payment, for the accounts.
- It is stored by Supabase (Singapore), served by Vercel, and paid through BAHK's own BTCPay. Login codes are sent by our email provider. We never sell or share it.
How it is protected
- Encrypted in transit and at rest.
- Referral letters, applicants' answers and admin notes are encrypted again with a key our database provider never has.
- Admin access needs a second factor.
How long, and your rights
- Payment records are kept for 7 years for the accounts, linked only to your member number.
- You can delete your account at any time from your account page. Your personal details, posts and devices are erased at once.
- If a membership was ended or an application not accepted, we keep a scrambled copy of the email (it cannot be turned back into the address), so it cannot simply join again.
- To see or correct what we hold, email info@bitcoin.org.hk.