Privacy Policy

1. Who we are

BITS (bits.micropue.com.cn) is a community for sharing, reusing and discovering code snippets. It is operated by MICROPUE — the personal brand behind micropue.com.cn. For any question or request about your data, write to [email protected].

2. What we collect

Account information — your email address, username, nickname and, if you add one, a short bio. Your email address is verified with a one-time code before the account is created.

Authentication data — a hash of your password (scrypt with a per-user salt; your password itself is never stored), the public keys of any passkeys you register (the private keys stay on your device), an encrypted secret if you enable an authenticator app, hashed recovery codes, and — only if you link it — your GitHub account ID and username.

Session and security data — the devices you sign in from (device type, a name derived from the browser's user agent, a randomly generated session token and the sign-in time), your last sign-in time, registration time and account status. These power the devices screen where you can revoke sessions.

Content — the snippets, groups and related metadata (tags, dependencies, visibility) you publish, and your activity on the site such as favorites, follows, feedback and reports.

Short-lived anti-abuse data — one-time email codes, rate-limit counters keyed by IP address and email, WebAuthn challenges and two-factor tickets. These live in memory (Redis) and expire by themselves within minutes; they are not part of your account record.

We do not run analytics or advertising trackers, and we do not sell your data.

3. Cookies

We use exactly one cookie, bits_token, to keep you signed in. It is strictly necessary and is described in our Cookies Policy. We do not use cookies to follow you across other websites, and we store nothing in your browser's local or session storage.

4. Third-party services

A few features are delivered with the help of third parties. We only share what the feature needs:

• hCaptcha — protects the sign-up and sign-in forms from bots. Your request metadata, including your IP address, is sent to hCaptcha to decide whether you are human.
• GitHub — if you sign in or link your account with GitHub, GitHub authenticates you and shares your GitHub ID, username and email addresses (scopes read:user user:email). The public star count shown in the header is read from GitHub's API.
• Email delivery — our SMTP provider delivers verification codes and security notifications to your address, and therefore processes it.
• Icon CDNs (cdn.simpleicons.org, unpkg.com) — catalog pages load brand logos from these public CDNs, which see your IP address and browser headers for those image requests.

Each provider handles data under its own privacy policy.

5. Why we process it

• to provide the service and your account;
• to authenticate you and keep the account secure — password hashing, two-factor authentication, passkeys, session and device management;
• to send transactional email such as verification codes and security notices;
• to prevent abuse, spam and attacks through rate limiting;
• to respond to feedback and reports; and
• to meet legal obligations.

6. How long we keep it

Account data is kept for as long as your account exists. Data held in memory (Redis) expires automatically. When you delete your account we remove your account record and your public content; copies may remain in encrypted backups for a limited period, and we may keep the minimum records needed for security or legal reasons.

7. Your choices and rights

• Access and correct — most of your data is visible and editable in account settings.
• Delete — you can request deletion of your account and data (see Legal Terms, section 8).
• Export — email us to ask for a copy of the data we hold about you.
• Withdraw — you can turn off two-factor authentication, unlink GitHub, remove passkeys or delete the account at any time.

8. Community rules and enforcement

BITS is an open-source code sharing community. Content and accounts must not be used for unlawful activity, malware, spam, harassment, hate, impersonation, or copyright infringement. Reports and feedback are reviewed by administrators, and we may take proportionate action when these rules are broken.

• remove content, or restrict its visibility and searchability;
• limit an account's ability to publish, comment, report, or use community features;
• suspend or permanently terminate accounts for serious or repeated violations;
• preserve the minimum report, moderation and account records needed to handle appeals, prevent abuse, and meet legal obligations.

Enforcement decisions are made by humans; we do not use automated systems to permanently remove content or terminate accounts. If you believe a decision was made in error, contact [email protected] with the content or account concerned. Repeated or serious violations may result in permanent removal from the community.

9. Security

Passwords are hashed with scrypt and a per-user salt, authenticator secrets are encrypted at rest, and your session is carried in an httpOnly cookie that is only sent over HTTPS in production. You can enable two-factor authentication and passkeys, and revoke any device you do not recognise. No system is perfectly secure, so please use a strong password that you do not reuse elsewhere.

10. Children

BITS is not intended for children under 14. If you are under 14, please use BITS only with the consent and supervision of a parent or guardian. If we learn that an account was created by a child under 14 without such consent, we will remove it.

11. Changes to this policy

We may update this policy as the service evolves. The effective date at the top will change, and significant changes will be announced on the site.

12. Contact

[email protected]