Privacy Policyb
About This Policy
muzh.io is operated by its publisher. The publisher will be incorporated as a legal entity in 2026; this notice will be updated when the entity is established. For all inquiries, contact official@muzh.io.
For the purposes of GDPR, CCPA, and other applicable data protection laws, the data controller for muzh.io is its publisher, contactable at official@muzh.io.
This policy explains how muzh.io collects, uses, and protects your data. For publisher identity and disclaimers, see the Legal Notice; for service terms, see the Terms of Use.
What We Collect
Four buckets:
- When you subscribe — Buttondown collects your email address, subscription timestamp, IP address, and the page you subscribed from.
- When you browse — Vercel (site hosting) and Cloudflare (DNS / CDN / Email Routing) record server access logs: IP, User Agent, request path, and timestamp.
- When we measure traffic — Google Analytics 4 (GA4) records pageviews, device information, and approximate geolocation, and sets cookies in your browser; Cloudflare Web Analytics aggregates pageview data without setting cookies; Google Search Console operates only on Google's backend for SEO and runs no scripts in your browser.
- When you contact us — if you email us, we receive the message content and the email metadata (sender, timestamp).
How We Use It
Three things:
- Deliver content — when we publish a new M2 long-form piece or major-event ad-hoc, we send it via newsletter; M1 weekday updates publish on the site, RSS, and X. Newsletter subscription is double opt-in — Buttondown sends a confirmation email, and we do not consider you subscribed until you click the confirmation link.
- Operate the site — error monitoring, performance tuning, and security defense (blocking abusive traffic and bots).
- Understand traffic trends — which topics are trending, the rough geographic distribution of readers, and which links get clicked.
We do not profile individuals, and we do not use automated decision-making (your individual profile does not influence the content or services you see).
GDPR legal basis: under Article 6 GDPR, our lawful bases are (a) consent for newsletter subscription, and (b) legitimate interests for site operation, security, and aggregate analytics.
Third-Party Processors
We share only the data necessary with the following processors. Each has its own privacy policy:
Processor | Purpose | Privacy Policy |
Vercel | Site hosting + server logs | |
Cloudflare | DNS / CDN / Email Routing | |
Buttondown | Newsletter subscription and delivery | |
Google (GA4 + Search Console) | Analytics and SEO insights |
We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising.
Cookies
- muzh.io itself does not set cookies.
- GA4 sets two cookies:
_ga(2 years, used to distinguish unique visitors) and_ga_<container>(2 years, used for session state). GA4 has IP anonymization enabled by default; the data is aggregated and not used to identify individuals.
- Embedded third-party content (such as X post embeds) may set its own cookies, governed by that provider's policies.
- During launch v1.0, we do not display a cookie consent banner. If you do not want GA tracking, install the Google Analytics Opt-out browser extension or disable third-party cookies in your browser.
- EU/EEA visitors: GDPR generally requires consent for analytics cookies. During launch v1.0, GA4 currently fires for all visitors; we are evaluating a cookie consent banner. In the meantime, EU/EEA visitors who do not consent to analytics tracking should opt out via the methods above.
Data Retention
- Subscription records (in Buttondown) — retained until you unsubscribe. After you unsubscribe, Buttondown keeps an unsubscribed status record (your email and unsubscribe status) so we do not accidentally re-subscribe you.
- Server logs (Vercel + Cloudflare) — retained per each provider's default, no longer than 90 days.
- GA4 data — Google's default of 14 months.
- Email correspondence — retained for 1 year after the matter is resolved, for follow-up and dispute purposes.
International Transfers
Vercel, Cloudflare, and Google operate primarily from servers in the United States. If you are in the EU, UK, mainland China, or elsewhere, your data crosses borders to the United States. For EU users, the transfer relies on Standard Contractual Clauses (SCCs).
Your Rights
Wherever you are:
- Unsubscribe — every newsletter email contains an unsubscribe link that takes effect immediately.
If you are a resident of the EU, EEA, or UK, you have the GDPR rights to access, delete, object to processing, restrict processing, request data portability, withdraw consent, and lodge a complaint with your national Data Protection Authority (DPA).
If you are a California resident, you have the CCPA / CPRA rights to know, delete, correct, and limit the use of sensitive information. We will not discriminate against you for exercising your rights. We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising.
Global Privacy Control (GPC): some browsers send GPC signals as a "do not sell or share" opt-out. Because muzh.io does not sell or share your personal information for cross-context behavioral advertising in the first place, GPC signals have no further effect on our processing — your data is not in any sale/share flow to begin with.
To exercise any right, email official@muzh.io. We will respond within 30 days (extendable to 60 with notice if necessary).
Children's Privacy
muzh.io is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and discover that your child has submitted data to us, email official@muzh.io and we will delete it.
Changes to This Policy
We may update this policy. Material changes (affecting how data is used or your rights) will be communicated via an ad-hoc newsletter notice; non-material updates simply change the
last_updated date at the top of this page.Contact
For privacy matters, email official@muzh.io. Other contact channels are listed in the Legal Notice.
In compliance with the U.S. CAN-SPAM Act (16 CFR §316.5), every newsletter email contains a valid physical mailing address in its footer (auto-injected by Buttondown).
In the event of any discrepancy between the English and Chinese versions of this policy, the English version prevails.
Loading...