1. Scope
This policy explains how PCafe (“we”, “us”), based in Hong Kong, China, collects, uses and protects personal data when running https://p.cafe, the account dashboard and the private npm registry. We handle personal data under Hong Kong’s Personal Data (Privacy) Ordinance. Where the law that applies to you (such as the EU General Data Protection Regulation) gives you more rights, we respect those too.
2. Data we do not collect
The open-source edition, the command-line tool and exported presentation HTML do not collect or send back any data. The presentations you make on your own machine never pass through our servers.
3. Data we collect
| Category | What | Why |
|---|---|---|
| Account | Email, sign-in credentials stored in hashed or encrypted form, sign-up and sign-in times | Signing in, password recovery, transactional email |
| Orders and licences | Plan, order number, subscription status, licence period | Issuing and managing Pro licences, refunds and support |
| Access tokens | Only a one-way hash, the first few characters, creation and last-used times | Verifying private npm registry requests; the full token is shown once when created |
| npm registry request logs | Time, IP address, package and version requested, result status | Rate limiting, preventing abuse, troubleshooting; tokens are never logged |
| Email with us | What you send us | Answering your questions |
Payment details such as card numbers are collected and processed directly by Dodo Payments. We never receive or store them.
4. Cookies
The website does not use analytics, advertising or cross-site tracking cookies. The account dashboard only uses the cookies needed to keep you signed in. If we add analytics in the future, we will update this policy first.
5. Legal bases
We process data to perform our contract with you (providing your account and Pro licence), to meet legal obligations (such as tax and accounting records), and for our legitimate interests (preventing abuse and keeping the service secure).
6. Who we share data with
We do not sell personal data. We share it only as needed to provide the service, with these providers:
- Dodo Payments: checkout, payment, tax, invoices and refunds;
- Cloudflare: website hosting, running the account dashboard, database and file storage;
- Our transactional email provider: sending verification, password-recovery and order emails.
These providers may process data outside Hong Kong. We require them to process data only to provide their service and to keep it reasonably secure. We may also disclose data to authorities when the law requires it.
7. How long we keep data
- Account data: until you delete your account.
- Order and payment records: 7 years, as tax and accounting rules require.
- npm registry request logs: 30 days.
- Email with us: up to 2 years after the issue is resolved.
8. Your rights
You can ask to access, correct, delete or export your personal data, and to object to or restrict some processing. Email support@p.cafe and we will reply within 30 days. When you delete your account, we delete your data except order records we must keep by law; any active Pro licence ends with the account.
9. Security
Access tokens are stored only as hashes, sign-in credentials are stored securely, all traffic uses HTTPS, and admin access is restricted and logged. No system is perfectly secure. If a security incident may affect you, we will tell you promptly.
10. Children
The service is not meant for children under 16, and we do not knowingly collect their personal data.
11. Changes to this policy
We may update this policy and will update the date on this page. For material changes, we will notify you by email or on the site.