Privacy Policy

1. Commitment to Privacy-First Architecture

We fundamentally believe that user data belongs to the user. Our primary architectural philosophy across all software tools is client-side sovereignty and ephemeral data handling:

• FairDraw (fairdraw.daocongthanh.com): An ephemeral live event lucky draw platform. Collects zero emails, phone numbers, or passwords. Backstage PINs are salted and hashed client-side via the Web Cryptography API (SHA-256). All event rooms and participant records are automatically deleted after 7 days via automated Cloud Functions. Stage displays are 100% ad-free.
• Pure QR / QR Code Studio (qr.daocongthanh.com): Operates 100% inside your browser using HTML5 Canvas and SVG technologies. Texts, URLs, contact cards, and logos you encode never touch our servers. No analytics tracking or URL redirection is used.
• Velox - Racquet Rally Cut (velox.daocongthanh.com / Mobile App): Video playback, trimming, and scoreboard overlays are executed completely offline on your physical device. Videos are only uploaded to cloud vision models when you explicitly trigger automated AI rally recognition, and are processed transiently without unauthorized permanent retention.
• Thanh's String Elongation Lab (strings.daocongthanh.com): A static scientific visualizer. No personal data, telemetry, or user accounts are required or collected.

2. Third-Party Advertising & Google Consent Mode v2 Disclosures

This website and its affiliated mobile properties use Google AdSense and Google AdMob, third-party advertising services provided by Google LLC ("Google"). To maintain strict compliance with privacy regulations while honoring our zero-cookie-banner architecture, please note:

• Google Consent Mode v2 & Certified CMP Integration: This website deploys Google Consent Mode v2 with privacy-first default storage permissions (ad_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied', wait_for_update: 500). Google AdSense manages user consent preferences via certified Consent Management platforms (including the Google Privacy & Messaging GDPR framework in the European Economic Area) and delivers appropriate advertising in strict accordance with GDPR and the ePrivacy Directive.
• Third-party advertising vendors may receive non-personally identifiable technical telemetry (such as browser dimensions and IP address for geolocation/anti-fraud validation) strictly necessary for delivering contextual ads.
• Users may opt out of personalized advertising by visiting Google Ads Settings.
• Alternatively, users can opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info or Your Online Choices.

3. Cookieless Web Analytics (Google Analytics 4)

We utilize Google Analytics 4, a web analytics service provided by Google LLC, operated in a strictly 100% cookieless mode:

• Zero Cookies Stored: Initialized with client_storage: 'none', completely blocking Google Analytics from writing or reading _ga or _gid cookies. Your browser's document.cookie remains entirely empty.
• Edge IP Anonymization: IP addresses are anonymized at edge gateways and never written to disk or exposed in analytics reporting.
• Zero Advertising Signals: Google Signals (allow_google_signals: false) and ad personalization signals are disabled, with restricted data processing enforced.
• This configuration provides aggregated traffic volume (pageviews, general geographic region, screen size) to help us improve site performance while respecting your absolute right to digital privacy.

4. Log Files & Web Hosting Infrastructure

Like most websites, our hosting provider (Google Firebase Hosting) may automatically record standard web server log entries when you visit. These logs may include your Internet Protocol (IP) address, browser type, Internet Service Provider (ISP), referring/exit pages, operating system, date/time stamp, and clickstream data. This information is used strictly for analyzing technical infrastructure performance, diagnosing server errors, and securing our systems against denial-of-service attacks. These server logs are not linked to any personally identifiable information.

5. General Data Protection Regulation (GDPR) Compliance

If you are a resident of the European Economic Area (EEA), you possess specific data protection rights under the GDPR. Because our core tools do not collect personal identities or store account profiles, we process minimal data. Nevertheless, you have the right to:

• The right to access, update, or delete the information we have on you.
• The right of rectification (to correct inaccurate or incomplete data).
• The right to object to our processing of your personal data.
• The right of restriction (to request that we restrict the processing of your personal information).
• The right to data portability.
• The right to withdraw consent at any time where we relied on your consent to process your information.

6. California Consumer Privacy Act (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal information:

• Right to Know: You may request disclosure of what personal information is collected, used, or shared.
• Right to Delete: You may request the deletion of personal information collected from you.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal data. To opt out of third-party cookie sharing for cross-context behavioral advertising, configure your browser settings or visit the Network Advertising Initiative opt-out page.
• Right to Non-Discrimination: We will not discriminate against you in pricing, service quality, or access for exercising any of your privacy rights.

7. Children's Privacy (COPPA)

Protecting the privacy of children is of paramount importance. Our website and utilities are designed for general audiences and do not knowingly collect or solicit any personal information from children under the age of 13.

8. Updates to this Policy

We may update this Privacy Policy periodically to reflect changes in our operational practices, new features in our software ecosystem, or regulatory requirements. Any modifications will be posted directly on this page with an updated timestamp.

9. Publisher Identity & Inquiries

For any questions or notices regarding this Privacy Policy or our software practices: