LionFans LogoLion Fans

Privacy & Data Collection

This page explains what data Lion Fans (lionfans.cc) collects while you use this site, why, and how you can control it. We put what we do not collect first, because that is usually what you actually want to know.

Last updated: 2026-08-22

1. What we never collect or send

  • The social profile or post URL you enter when ordering. That points directly at you. It goes only to our order system to fulfil your order, never to any analytics or advertising tool. Our tracking code uses a parameter allowlist that excludes it, and an automated test fails if anyone adds it to that list.
  • The comment text you enter for comment services. Same as above — used only to fulfil your order.
  • Your name and phone number. Collected at signup, but kept in our own member system. The matching data we send to Meta does not include them.
  • Your password. What we store is a hash, which cannot be turned back into your password. (You type it, it passes through our server, and is hashed there — that is unavoidable for login to work.) It never appears in any analytics tool.
  • Your card number or payment details. Online top-ups are handled by ECPay; you enter payment details on their page. We never see or store card numbers.

2. What we do collect

  • Which pages you view (Google Analytics 4, Meta Pixel, Matomo, Cloudflare) — the page itself, not what you typed.
  • Which buttons and links you click (Google Analytics 4, Matomo) — we record the position label of that button (e.g. “top nav — sign up”), not what you typed. This is not sent to Meta.
  • Key actions you complete — signup, top-up submission, order placed (Google Analytics 4, Meta Pixel). Order events carry the order number and amount.
  • That you logged in (Google Analytics 4 only) — to understand return rates. Not sent to Meta: everyone who logs in has already registered, so it adds nothing for advertising.
  • A random identifier stored in a cookie (Google Analytics 4, Meta Pixel, Matomo) — distinguishes unique visitors from return visits. It contains none of your personal data.
  • Device, browser, operating system, approximate region — region is estimated from IP at city level, not a precise location.
  • Remarketing and ad performance data (Google Ads) — pre-existing ad tracking used to measure Google Ads performance.
  • Page load speed and errors (Cloudflare Web Analytics) — Cloudflare, which sits in front of this site, loads a measurement beacon that reports page performance. It sets no cookie.

3. Data our server sends directly to Meta

In addition to browser-side tracking, at three specific moments — completing signup, submitting a top-up, and successfully placing an order — our server sends an event directly to Meta (a technology called the Conversions API). We do this because ad blockers and browser tracking protection block a significant share of browser-side events, which distorts ad performance measurement.

This happens only at those three moments, not on ordinary page views. What is sent:

  • Your email address, SHA-256 hashed (not the original). Hashing is one-way: the same email always produces the same string, but the string cannot be turned back into the email. Meta compares it against its own hashes to tell whether a purchase came from one of our ads. Your actual email never leaves our server.
  • Your IP address, in full and not masked. This is the item you most need to know about. Meta uses IP to identify visitors; it is the core mechanism that makes server-side events work. Note this differs from Google Analytics, which masks IP before processing.
  • Your browser identification string (User-Agent). Used together with IP to identify visitors. It describes browser and OS versions.
  • Meta cookie identifiers (_fbp and _fbc). The two listed in the cookie section below. They link browser-side and server-side records to the same visit.
  • The full URL of the page you are on. That is, the page you were on when you pressed the button. Meta uses it to tell where on the site the conversion happened.
  • The transaction amount and currency. Only for orders and top-ups. Meta uses it to measure the value an ad produced. Amounts are in New Taiwan dollars.

4. Features we deliberately turned off

Meta Automatic Advanced Matching. Meta's tracking code scans form fields on the page by default, harvesting email, phone, and name. We disabled this in code and instead decide explicitly what to send (the items in section 3). The goal is that “what we send” is something that can be inspected and honestly disclosed.

5. One thing we cannot control

Page content Meta may parse on its own. Meta's dataset settings include a feature that parses the page you are viewing (product names, prices) and returns it to Meta. It is on by default and controlled by Meta's admin settings, not by this site's code — we cannot disable it in code, only in Meta's console.

We list it separately because the previous section is about things we actively turned off, and this is not the same thing. Leaving it out would omit an entire category of data flow we know exists.

6. Cookies

  • _ga, _ga_* — Google Analytics, up to ~13 months, distinguishes unique visitors
  • _fbp — Meta, ~90 days, remarketing audiences and server-side event linking
  • _fbc — Meta, ~90 days, created when you arrive from a Facebook/Instagram link carrying fbclid (ads and organic posts alike)
  • _gcl_* — Google Ads, ~90 days, records ad clicks for conversion measurement
  • _pk_id.*, _pk_ses.* — Matomo (self-hosted at ubt.lionfans.cc), ~13 months / 30 min, unique visitors and session
  • test_cookie and similar — Google ad domains (doubleclick.net), ~15 min, checks whether your browser accepts third-party cookies
  • session — Lion Fans, 7 days, keeps you logged in (required for login)
  • NEXT_LOCALE — Lion Fans, until browser close, remembers your language

This site sits behind Cloudflare for content delivery and protection, which may set functional cookies to identify automated traffic.

7. How to control this

  • Browser settings: block third-party cookies or use private browsing. The third-party cookies this site uses come from doubleclick.net (Google ads) and facebook.com. Note the session cookie is required to log in.
  • Matomo opt-out: Matomo is self-hosted by us. Enable “Do Not Track” in your browser, or email us to stop recording your visits.
  • Google Analytics opt-out: install Google's opt-out browser add-on.
  • Meta ad preferences: adjust in your Facebook ad preferences.
  • Ad blockers: common ad-blocking extensions block the browser-side tracking described here. Note that the server-side events in section 3 are not affected by ad blockers — that is why the technology exists, and we think you have a right to know.

8. Third-party services

This site uses the following third-party services, each with its own privacy policy:

  • Google (Analytics 4, Ads, Tag Manager) — analytics and ad performance
  • Meta (Facebook/Instagram) — ad performance and remarketing
  • Matomo — web analytics. This one is self-hosted by us at ubt.lionfans.cc; the data stays on our own server and is not handed to an outside analytics company.
  • ECPay — online payments; payment details are handled by them
  • Cloudflare — content delivery and protection, and a Web Analytics beacon that reports page performance

9. Contact

Questions about this page, or requests to access, correct, or delete your personal data: [email protected].