Welcome to HsiaoEye (the Site). This policy explains data processing, analytics, browser storage and ways to opt out.
1. Information we collect
1-1 Information you provide
No registration is required to read the Site. Readers are not asked for names, identification numbers, medical records, symptom descriptions, photos or contact details. The Site does not offer appointment booking. Please do not enter such information in site search.
1-2 Server logs and error diagnostics
The Site is hosted by Vercel. Requests, security protection and error diagnostics may process IP addresses, browser and operating system information, page URLs, referrers and timestamps. These logs differ from the first-party performance samples below and should not all be described as anonymous.
Eligible browser error reports include messages, stacks, URLs, browser information and IP addresses and may appear in deployment logs. When KV storage is configured, up to 200 additional reports are retained. Preview, editing, automated and opted-out browser diagnostics are excluded; necessary server security logs may still be retained.
1-3 Cookies and browser storage
The hs_lang cookie stores a language preference for 365 days. localStorage may hold language, theme, font size, reading position and cache version preferences, and browser caches may retain offline pages. Local administrator drafts use browser storage separately from reader statistics.
hs_telemetry_optout=1 is a telemetry opt-out preference, not an authentication credential or visitor identifier. Administrator login sets it to exclude administrative activity; logout does not automatically undo the opt-out. Administrator authentication uses a separate eight-hour HttpOnly session cookie.
1-4 First-party performance and experiment statistics
The Site may send Web Vitals values, page paths, timestamps, measurement versions and sample IDs to its own endpoint. With KV configured, each metric retains up to 1,000 samples and its list has a 30-day expiry. Sample IDs support deduplication and are not a count of unique visitors.
Content experiments can record exposure and click counts by experiment and variant, with assignments potentially retained in browser storage. Active experiments and actual collection depend on configuration; a code capability does not mean every feature is enabled.
Site search logging is off by default. Only when SEARCH_LOG_ENABLED=1 and storage is available are up to 1,000 queries of at most 80 characters and their timestamps retained to identify content gaps. Do not enter personal or sensitive medical information.
2. Third-party services
2-1 Google Analytics 4
For eligible reader visits, the Site loads Google Analytics 4 (measurement ID: G-0ZKDQP9DNH) for page and interaction events. Its default Consent Mode v2 configuration grants analytics_storage, functionality_storage and security_storage, and denies ad_storage, ad_user_data and ad_personalization. This technical configuration is not a statement that a user has explicitly consented. The Site does not run personalized advertising.
GA4 uses first-party _ga (distinguishing users) and _ga_<ID> (session state) cookies. Google documents a two-year default lifetime, subject to configuration. These are analytics identifiers; the service should not be described as entirely cookieless or unidentifiable.
Google documentation: GA4 cookie usage and Google Privacy Policy. Microsoft Clarity is not currently enabled; this page will be updated if that changes.
2-2 Vercel Web Analytics and Speed Insights
The Site loads these services for eligible visits. Web Analytics measures page visits and Speed Insights measures performance; actual storage depends on Vercel project settings. Their documentation describes Web Analytics as cookieless and Speed Insights data points as not associated with individual visitors or IP addresses. This does not mean platform security and request logs never process IP addresses.
Service documentation: Web Analytics privacy and Speed Insights privacy.
2-3 Google Search Console / Bing Webmaster
These services verify ownership, submit sitemaps and report search performance supplied by search engines. They are not additional per-visit tracking scripts installed on the Site.
2-4 Fonts and external resources
Fonts are loaded from Google Fonts; CSS is served from the Site at /assets/app.css. Some tools may load external code modules, whose providers can process IP and request information when contacted.
3. Telemetry opt-out and browser controls
Reader telemetry excludes Preview, administrative activity, recognizable automation, DNT/Global Privacy Control and the Site opt-out preference. You can also install the Google Analytics opt-out add-on. Blocking third-party cookies alone does not necessarily block first-party analytics cookies.
Clearing cookies, localStorage or offline caches removes preferences and local data from that browser and may also remove the opt-out preference. It does not delete data already sent to servers or third parties. Retaining the opt-out preference or using browser DNT/Global Privacy Control continues to express a telemetry opt-out.
4. Your rights
To ask about, access, correct, delete or stop processing data relating to you, use the contact details below. Applicable rights and identifiable data depend on relevant law and how each service processes data. Clearing browser data is not a server deletion request.
5. Children’s privacy
The Site is intended for general adult readers and does not actively request personal data from children under 13. Guardians who believe a child’s data may have been collected in error can contact us below.
6. Policy updates
This policy may change as services and technology change. Material updates will be announced on this page.
7. Contact
For privacy or data-processing questions, use the contact email. Do not send passwords, credit card details or unnecessary sensitive medical information.