Privacy Policy

Updated 22 October 2026 · Towards China

Who is responsible

This notice applies to towardschina.co.uk. Towards China is the publication name. Its adult publisher and data controller is Donato Bilancia, based in the United Kingdom. The contact for personal-data matters is info@towardschina.co.uk. Anny is the student editor; her private contact details are not used for privacy requests.

“We” means that adult publisher operating Towards China. The controller decides why and how personal information is used. The notice covers website readers, account holders and people who contact us; newsletter subscriptions use the separate opt-in and email-confirmation arrangements described below.

What the reading list does — and does not do

We save an article only when you choose “I’ve read this!”. The list records an article ID and marking time, not how far you scroll, how long you read, your location or an assessment of your interests. Surprise me randomly chooses from articles you have not marked; it does not score your personality or make decisions with legal or similarly significant effects.

For guests, the list uses local storage under towards-china.read.v1. It is not saved to a Towards China account or silently uploaded when you sign in. Guest and account lists stay separate, including on shared devices. A guest list cannot be recovered by the publisher after you clear that browser’s storage.

When signed in, your account shelf is private to your account and follows you when you sign in on another device. It is not displayed to other readers. Authorised administrators can access stored site data where necessary to operate the service or deal with your request; “private” does not mean invisible to the publisher.

Tap the panda again to unmark an article, or use Clear on My read articles. Clearing the account shelf removes its saved entries; clearing a guest shelf affects only that browser. To delete an account or request an export or erasure, contact the adult publisher. The account reading list is included in the site’s WordPress export and erasure tools.

Accounts and signing in

Registration needs a username and email so we can create the account and send essential access or recovery messages. Passwords are stored as protected hashes rather than readable passwords. Please use a username that does not reveal your school, home address or private contact details. Other readers do not receive access to your email or reading shelf through these features.

Google sign-in is optional and is provided through Nextend Social Login. Google authenticates you and returns basic identity information, including your email and a Google account identifier, so we can recognise or create your reader account. Its basic profile response can also include a name and photograph; this site is configured not to retain Google profile names or photographs or keep access tokens in your account for later use. Temporary information needed to complete an authentication attempt has a configured one-hour expiry and is cleared when the completed flow no longer needs it. We never receive your Google password and do not request access to your inbox, contacts, Drive files, birthday, address or telephone number.

The email and provider identifier support account sign-in and linking. They are used to provide the optional account service you request, on the same legitimate-interests basis as the reader account, and retained while that account/link remains in use. To ask us to disconnect Google, delete the account or export its data, contact the adult publisher at info@towardschina.co.uk. Please make sure you have another way to sign in before disconnecting. Deleting or disconnecting a Google connection is separate from clearing your reading shelf or unsubscribing from a newsletter.

Your marked-article list is stored by Towards China, not sent to Google as a reading profile. The Google sign-in choice is separate from newsletter opt-in. Visiting Google also involves its own processing and Google Privacy Policy; article reading does not require a Google account.

Newsletter choices

To avoid repeating the homepage newsletter invitation, we check the active newsletter membership of your signed-in account. Without sign-in, this browser can remember a completed email confirmation or your choice to close the invitation in towards-china.newsletter-prompt.v1 local storage. This contains only the type of preference and an expiry time, not your email, subscriber ID or reading history. It stops being used after 180 days and is removed when next read after expiry, or you can clear this site’s browser storage sooner. A newsletter unsubscribe on this browser clears the remembered confirmation. This display preference does not subscribe or unsubscribe you, grant Statistics consent or change your email preferences. The full form remains available on the Newsletter page.

The newsletter form and one-off welcome automation are enabled on our website. MailPoet is reviewing our new sending account, so its delivery to newsletter contacts is temporarily paused by the provider. Real inbox and subscription-flow checks remain outstanding. You join the mailing list for editions only after confirming your email address.

When subscriptions open, newsletter opt-in will be separate from account registration and contacting us. We will explain which emails you are requesting and ask you to confirm your email address. Every marketing email will have an unsubscribe link. Unsubscribing stops newsletter delivery; it does not delete a separate website account or reading shelf. Essential account and password-recovery messages are different from newsletters.

MailPoet is installed on our website to administer the prepared list and email templates. The prepared sender and reply-to address are info@towardschina.co.uk. MailPoet Sending Service, part of Automattic, is now connected to this site. Its account approval and real delivery checks remain outstanding. The local form and welcome automation are configured; the provider’s review still prevents delivery to newsletter contacts. When newsletters are sent, recipient addresses, message content and delivery information pass through that service. MailPoet’s data-handling information describes email delivery and encrypted backups in the United States, account hosting in Germany, and automatic removal of sending-service email logs after three months. These provider records are separate from records stored on our website. Before opening subscriptions, we will confirm the applicable processing agreement and safeguards for transfers outside the UK and countries with adequacy coverage. Contact the adult publisher for the arrangements relevant to a data request. Individual open/click tracking, newsletter tracking cookies, subscriber timezone collection and plugin usage reporting are disabled. Necessary confirmation, delivery and unsubscribe records still use information.

Optional audience statistics

With your consent to Statistics, Independent Analytics helps us understand which pages people use, how they reach the magazine and whether it works well on different devices. It records page views, visit times and duration, referring sources, browser and device categories, and approximate country, region and city. Location is inferred from connection information, can be wrong and is not GPS or a home address. Visits to the temporary Coming Soon page can also be counted if you allow Statistics.

The plugin uses an IP address and browser user-agent to derive approximate location and a salted, one-way browser identifier. The analytics tables do not retain the raw IP address, and we have configured the identifier salt to change daily. These limited identifiers and visit records are handled as potentially personal information, rather than assuming that a hash makes every record anonymous. We do not attach names, email addresses, Google identities or private reading shelves to statistics. Signed-in administrator visits are excluded. We do not use these statistics for advertising, individual decisions or tracking across websites.

Our basis for optional audience statistics is your consent. The script is blocked until you allow Statistics. Leave Statistics switched off to refuse, or use the Privacy preferences section on this page to change or withdraw consent. Changes apply immediately in this browser; withdrawal stops subsequent collection and does not undo earlier lawful processing. The magazine and browser reading shelf work either way. Complianz remembers the choice in necessary first-party consent cookies until the choice expires or you clear them. We also respect supported Do Not Track and Global Privacy Control signals.

Independent Analytics creates and stores statistics in this website’s WordPress database on Hostinger. The plugin downloads a location lookup database; visitor IP addresses are not sent to a separate geolocation lookup service. Optional vendor email, site-scan registration and telemetry have not been enabled. Authorised administrators can view the statistics; reader accounts cannot. Automatic pruning is set to one year, scheduled through WordPress, with older records removed on the next successful scheduled run. Recovery copies follow the hosting backup cycle explained below. Google Analytics is not enabled.

You can contact info@towardschina.co.uk about a statistics or consent concern. Because we do not keep names or raw IP addresses in these analytics tables, we may be unable to locate an earlier visit from a name alone, and we will not collect extra identifying information merely to identify it. The Cookie Policy explains the controls and other storage.

Share buttons pass the article title and URL to the app or service you choose, such as WhatsApp or your device’s sharing tool. They do not pass your saved reading list. Links to other websites are governed by those websites’ policies after you follow them. Any future embedded service that collects data must be assessed and explained before it is loaded.

Keeping accounts and forms safe

Cloudflare, Inc. provides Turnstile checks on sign-in, registration and password-recovery forms, and on newsletter forms if these are opened. Its check processes technical signals such as an IP address, browser information and the site being accessed. It helps distinguish people from automated abuse; we do not send your password, email address or reading shelf as part of our verification request. Our lawful basis is legitimate interests in protecting reader accounts and the service.

Cloudflare processes signals on our behalf to provide the check and also acts as a controller when improving its bot detection. Its Turnstile Privacy Notice and Privacy Policy explain those roles, international processing, retention criteria and rights. We have not independently verified a fixed deletion period for all of its security signals. The verification token expires after five minutes and can be used once; that is not a deletion deadline for every supplier record. Contact the adult publisher for help with a check or a data request.

The website firewall examines technical requests for signs of abuse. Its local security logs use masked IP addresses and are configured for rolling deletion after 30 days. They are not a record of your saved reading shelf. A specific investigation extract may be kept under the incident and closure criteria described under Hosting records.

Local sign-in protection counts unsuccessful attempts and can temporarily block further attempts from the same connection: five attempts in a 15-minute window normally trigger a 30-minute lock, with a longer lock for repeated failures. Temporary counters and locks are cleared by the plugin’s routine cleanup after their configured periods; expired values may remain until that cleanup runs. We do not keep its separate indefinite username/IP lockout-history log or use a cloud login-monitoring subscription. Anonymous counts of recent failures are used for security administration.

Who may handle the information

The adult publisher and authorised administrators handle reader administration and correspondence. Hostinger provides website hosting and Hostinger Mail receives messages addressed to info@towardschina.co.uk. Email-delivery providers and authorised mail applications used to receive, read and reply to messages may also handle their contents and technical metadata. This describes their role; we do not publish private mailbox addresses. You can ask the adult publisher which service handles your correspondence.

MailPoet processes prepared newsletter records within the website and also keeps a local administrative record corresponding to a WordPress user account. This is not newsletter consent. Google authenticates optional sign-ins under its own privacy terms. Following a sharing link or sending mail through your own email provider also involves that service’s processing.

We do not sell reading lists or use them for behavioural advertising. Information may be disclosed to a competent authority or a professional adviser when required by law or necessary to resolve a specific security incident or legal matter. Private reader-data administration is the adult publisher’s responsibility.

In Hostinger Mail’s published standard, Spam and Trash messages are automatically deleted after 30 days. This is a folder-specific rule, not a 30-day limit for messages still in the inbox or sent folder. Correspondence needed for an open request or correction follows the criteria in the table above. Deleting from a mail application may leave a server copy, so an erasure request must consider the copies actually used to handle the message.

Where information is stored and backups

The website uses Hostinger Premium Web Hosting. The server is in the Netherlands and hosting backups are stored in Lithuania. Both countries are in the European Economic Area and have UK adequacy coverage for transfers of personal information. Those are the website and backup locations; they do not mean every supplier processes only in those countries.

Hostinger’s data processing addendum describes its processing obligations, support/subprocessors and applicable international-transfer arrangements. Where required, those arrangements include contractual safeguards for transfers outside countries with UK adequacy coverage. A safeguard is an agreement intended to protect information when a provider handles it abroad. Google and email services can also involve processing in other countries. Contact info@towardschina.co.uk for details or a copy of the safeguards applicable to a particular use.

Hosting records

IP addresses, requests and error/security records help deliver the site, diagnose faults and investigate abuse. Hostinger handles them under the terms for operating and protecting the hosting service. A single deletion period covering all web-access, error and security logs has not been verified. A seven-day dashboard filter describes what a view shows, not when every underlying record is erased.

The provider’s DPA covers processing during the hosting agreement and describes deletion 30 days after the processing agreement ends, subject to the particular service terms and legal requirements. That is an end-of-service provision; it is not a claim that routine logs are deleted every 30 days while this website runs. For an extract we keep to investigate an incident, the concrete rule is to retain only the evidence needed until that case and necessary follow-up are resolved, then delete ordinary investigation copies within 30 days of closure. A continuing legal or safeguarding need must be recorded and reviewed rather than used to keep everything indefinitely.

Recovery backups

The standard Premium service provides weekly recovery copies. Older copies are removed as the provider’s rolling backup cycle expires. Removing an account or reading entry from the live website does not immediately remove it from an earlier recovery copy. Backups are for restoring the service, not for advertising or routine access to deleted reading lists.

If a backup is restored, relevant account or reading-list deletions must be reapplied before that information returns to normal use. A specific preserved copy needed for an incident or legal matter follows the documented case criteria above. Reader accounts and saved reading entries have no automatic inactivity expiry; you can remove them using the controls or ask us to erase them.

Young readers

The magazine is designed mainly for teenagers. You do not need to give us a date of birth, school, home address or live location to read articles or use the existing registration fields. We keep the explanations clear and the reading list under your control. If a privacy choice is confusing, ask the adult publisher or a trusted adult before sharing information.

Where an optional online feature relies on a child’s consent, UK children aged 13 or over may give their own consent; younger children need appropriately verified parental consent. Newsletter signup asks you to confirm that you are 13 or over. This is a self-declaration, not verified age or parental consent. If you are younger, ask a parent or carer to subscribe using their own address instead of entering your own. Any future consent-based feature for younger children needs appropriate parental-consent arrangements; a privacy notice alone does not provide them. A parent can help a child raise a concern, while the child’s own rights and privacy remain respected.

Your choices and rights

Depending on the processing and applicable law, you can ask for access, correction, deletion, restriction or a portable copy of your information. You can withdraw consent to a consent-based use at any time. Withdrawing it does not make the earlier use unlawful.

You can object to processing based on legitimate interests. Contact the adult publisher and explain which use concerns you. We will consider the request and stop the use unless there is a lawful reason to continue. For newsletter marketing, unsubscribe or tell us to stop.

Use the contact above for an account export, erasure request or privacy complaint. We will acknowledge a privacy complaint within 30 days and investigate without undue delay. Data-rights requests are normally answered within one month; lawful extensions or identity checks will be explained. Browser-only guest data must be cleared on the device that holds it because it is not in your account.

If you remain concerned, you can complain to the UK Information Commissioner’s Office, telephone 0303 123 1113. You do not have to wait for us to finish before contacting the regulator.

Changes to this notice

We review this notice when the site’s data uses change. A new provider, external login, newsletter or analytics arrangement must be reflected before it collects data. Material changes will be clearly explained; they will not be treated as blanket consent from readers.

Read our About page, Editorial Policy, Corrections Policy, Privacy Policy and Cookie Policy.