1. Scope
This Policy applies to the following services (collectively, the "Service"):
- the Future Philosophy website futurephilosophy.wiki (including the www subdomain and the compatibility entry point 124.223.55.2 used by earlier versions of the app);
- the Future Philosophy Android app (package name com.futurephilosophy.app).
This Policy does not apply to third-party websites linked from the Service (such as papers and institutional websites cited on research pages); see Section 10. If we launch membership, paid or similar features in the future, we will update this Policy before the relevant features go live and notify you prominently, and where new processing purposes or sensitive personal information are involved, we will obtain your consent separately.
2. Information we process
1. Server logs generated automatically when you use the Service
When you visit the website, or when the app connects to the network to fetch public content (such as service status and cognition map data), our servers automatically record: IP address, access time, requested URL and method, referring page, browser or client type and version (User-Agent), response status and amount of data transferred.
Purposes: to safeguard network and information security, troubleshoot faults, identify and prevent attacks and abuse, and understand the overall load on the Service. Legal basis: fulfilling the network log retention obligation under Article 21 of the Cybersecurity Law, and necessity for providing the Service. We do not link logs to your identity information, and we do not use them for user profiling or personalized recommendations.
2. Registering and using an account
Registering an account is optional. You can register and sign in with any of the following methods:
- Email address or mobile phone number: we process the email address or mobile phone number you enter and send a 6-digit verification code to it to confirm that it belongs to you. Verification codes are stored only in a keyed-hash form that cannot be reversed, are valid for 10 minutes, and are automatically cleared once used or expired.
- WeChat: after you confirm authorization in WeChat, the WeChat Open Platform provides us with your OpenID for this app, your UnionID (if any) and your WeChat nickname. We use the OpenID / UnionID to recognize the same WeChat identity and use the nickname only as your default nickname; we do not obtain your WeChat profile photo, friend relationships, region or mobile phone number.
When you register and use an account, we also process: the nickname you set, and your account role and status; for your password, only a digest processed with salted PBKDF2, from which no one (including us) can recover your password; the session records generated by each sign-in, including client type (web or app), creation and last-activity times, expiry time, and keyed-hash digests of your IP address and browser identifier that cannot be reversed; security records such as the number of failed sign-in attempts and the frequency of verification code requests; and records of your agreement to the Terms of Service and this Policy (document, version, time, method of consent and page language).
Purposes: to confirm that the contact details belong to you, identify you, keep you signed in, let you view and sign out of signed-in devices, reset a forgotten password, prevent credential stuffing and account theft, and keep proof of which versions of the agreements you agreed to. Legal basis: necessary for concluding and performing the service contract to which you are a party. When you sign in on the website, a necessary cookie named fp_session is set (transmitted only over HTTPS and not readable by page scripts) to keep you signed in; it expires when you sign out or after 30 days. In the app, sign-in credentials are stored in the app's private storage and encrypted with a non-exportable key held in the system keystore.
3. Cloud sync of your personal data (only if you turn it on)
After you sign in, you can turn on cloud sync for a device on the "My Position" page or on your account page. Once it is on, the following records on that device are saved on our servers and merged with those on your other devices that have sync turned on: the focus domains you chose, the knowledge areas you have browsed, the knowledge boundaries you have marked (beacons), and your first answers to knowledge samples (the question, the answer you chose, your confidence level, whether the answer was correct and when you answered). Once the Android app supports sync in the future, they will also include your observation preferences, questions and notes in the app. Each account can store up to about 3,000 records.
Purpose: to let you see the same exploration records on different devices. Legal basis: your consent. You can withdraw it at any time: choose "Stop syncing on this device" on a device, and that device no longer uploads or downloads records; or choose "Delete the cloud copy", and the synced data on our servers is deleted immediately, all devices stop syncing, and the local records on each device are not affected. When you delete your account, the cloud copy is deleted along with it.
4. Information you provide when you contact us
When you email us with a personal information request, complaint or report, infringement notice, correction suggestion or security vulnerability report, we process the contact details and message content you provide only to verify, handle and respond to that matter, and after the matter is resolved we retain them for the period set out in Section 6.
5. Information we do not collect
The Service does not currently provide posting, commenting or payment features. Apart from items 1 to 4 above, we do not collect your name, identity document number, precise location, contacts, photos, biometric information or payment account information, and we do not process any sensitive personal information. We process your mobile phone number only if you choose to register with it or link it to your account.
6. Exceptions to consent
Under Article 13 of the Personal Information Protection Law, your consent is not required to process personal information in circumstances prescribed by law, such as where processing is necessary to conclude or perform a contract to which you are a party, necessary to perform statutory duties or statutory obligations, or necessary to respond to a public health emergency or to protect the life, health and property of natural persons in an emergency.
3. Data stored only on your device
So that you can keep a record of your exploration without registering, the following data is stored only on your device by default; our servers neither receive nor can read it. If you sign in and turn on cloud sync for a device, the records on that device listed in item 3 of Section 2 are synced to our servers.
| Location | Content | How to delete |
|---|---|---|
| Website (browser local storage) | The focus domains you chose, the knowledge areas you have browsed, the knowledge boundaries you have saved, and your answers and confidence levels for knowledge samples. If cloud sync is turned on, it also stores the sync setting and a snapshot of your records as of the last sync. | On the "My Position" page, click "Clear local records" (this also stops cloud sync on this device but does not affect the cloud copy), or clear this site's data in your browser settings. |
| Android app (app-private storage) | Nickname, onboarding completion status, saved items, knowledge areas you have browsed and searched, notes and drafts, cognition profile, knowledge sample answers and local question records. | In the app, go to Me › About & privacy and choose "Clear all local data", or uninstall the app. |
The app has disabled system cloud backup and device-transfer backup, so the data above does not leave your phone through system backups.
4. App permissions, cookies and third-party components
- The Android app requests only the "network access" permission, which it uses to fetch public content. It does not request location, contacts, phone, SMS, camera, microphone, storage, calendar or similar permissions; it does not read device identifiers such as the IMEI, Android ID or MAC address; and it does not start itself in the background or launch, or get launched by, other apps (associated startup).
- The website sets the necessary cookie that keeps you signed in (fp_session) only after you sign in. When you sign in with WeChat, it also sets fp_wechat_state, which is valid only during the sign-in process (it expires within 10 minutes) and is used only to confirm that the authorization request was started from this browser, to prevent forgery. The website does not use third-party analytics, advertising, push notification, map or social sharing components, and it does not load third-party fonts or scripts.
- WeChat sign-in is completed by redirecting you to the WeChat Open Platform authorization page (open.weixin.qq.com); neither the website nor the app embeds WeChat's software development kit or scripts. The authorization page is operated by WeChat and is subject to WeChat's privacy rules.
- The website offers Chinese and English interfaces. On your first visit, the website automatically opens the page in the corresponding language based on the language preference (Accept-Language) that your browser sends with the request; this information is used only for that one-time choice and is not stored. When you click a language switch link on a page, the website sets a cookie named fp_lang that records only the interface language you chose (zh or en), contains no identity information and is kept for one year; you can delete it by clearing your browser cookies.
- The app does not integrate any third-party software development kit (SDK) and uses only official Android development libraries. When you tap an external link in the app, it is opened in the browser on your phone.
If we need to use other cookies or introduce third-party components in the future, we will first update this Policy and list their names, purposes and the information they collect.
6. Storage location and retention periods
- Storage location: all personal information we process is stored within the People's Republic of China and is not provided outside the People's Republic of China.
- Server access logs: kept for no less than six months as required by law and for no more than twelve months, and deleted or anonymized when that period ends.
- Account profile, sign-in methods, password digest, sign-in sessions and consent records: kept until you delete your account. After you submit account deletion, a 7-day cooling-off period starts, and when it ends this data is permanently deleted (see Delete your account for how). If the account is referenced in public content or review records, those records are kept, but the account information is changed to an anonymous state that cannot identify you. Sign-in sessions become invalid when you sign out or when they expire.
- Verification codes: only a digest that cannot be reversed is stored; codes are valid for 10 minutes and are automatically cleared once used or expired.
- Cloud sync data: kept until you delete the cloud copy or delete your account.
- Your messages and the records of how we handled them: kept until two years after the matter is resolved, unless the law requires otherwise.
- Data stored only on your device: controlled by you; see Section 3 for how to delete it.
If we stop operating the Service, we will announce this on the website in advance, stop the related processing, and delete or anonymize the personal information we hold.
7. How we protect information
- All communication by the website and the app is encrypted in transit using HTTPS; the app trusts only system certificates and refuses cleartext connections.
- Public content is served read-only; the write interfaces needed for accounts and personal data sync are opened one by one on an allowlist at the reverse proxy layer, with request rate limits; service programs run under least-privilege accounts with system-level sandbox isolation enabled.
- Passwords, verification codes and sign-in credentials are stored only as digests that cannot be reversed; sensitive operations such as exporting data or deleting your account require that you have recently verified your password or just signed in.
- Access to servers is subject to permission controls; the database is backed up online daily and restore drills are carried out regularly; certificate validity is continuously monitored.
- We have a security incident response plan. If personal information is leaked, tampered with or lost, we will immediately take remedial measures, inform you as required by law of the incident, its possible impact and the measures you can take, and report it to the relevant competent authorities.
No security measure is absolute in an internet environment. If you find a security issue in the Service, please let us know as described on the Security & Vulnerability Reporting page.
8. Your rights
Under the Personal Information Protection Law, you have the following rights with respect to the personal information we process:
- Right to know and decide: to know and decide how we process your personal information, including the right to restrict or refuse processing;
- Right to access, copy and transfer: to access and copy your personal information and, where the conditions are met, to request that it be transferred to a personal information processor you designate;
- Right to correct and supplement: to request correction or supplementation when you find information inaccurate or incomplete;
- Right to deletion: to request deletion where the purpose of processing has been achieved, we stop providing the Service, you withdraw your consent, the processing is unlawful, or in similar circumstances;
- Right to withdraw consent: for processing based on consent, you may withdraw your consent at any time; withdrawal does not affect the validity of processing carried out before it;
- Right to an explanation: to request that we explain our rules for processing personal information.
You can delete data stored on your device yourself (see Section 3). Once you have registered an account, you can do the following yourself on the account page of the website:
- Access and copy: use "Download my data" to get a JSON file containing your account profile, sign-in methods, sign-in sessions, consent records and cloud sync data;
- View and sign out of signed-in devices, and change your password;
- Withdraw your consent to cloud sync: stop syncing on this device, or delete the cloud copy;
- Delete your account: once you submit, you are signed out on all devices immediately; you can cancel by signing in again within the 7-day cooling-off period, and when it ends the account is permanently deleted (see Delete your account).
If you want to delete only some data while keeping your account, you can submit a request as described on the Delete your data page; if you cannot sign in, you can also request account deletion by email, and we will handle it within 15 business days after verifying your identity. Server logs are not linked to your identity. If you want to access or delete logs relating to you, please include in your message the time period of your visits and the IP address you used at that time so that we can locate them.
Please send requests to service@deffuture.com. We will respond within 15 business days after verifying the necessary information. We may refuse requests that are unreasonably repetitive, require excessive technical means, pose risks to the lawful rights and interests of others, or are impractical, and we will explain our reasons.
9. Protection of minors
The Service provides knowledge and research content to the general public and is not specifically directed at children. Children under the age of 14 should use the Service under the guidance of a parent or other guardian, and should obtain the consent of a parent or other guardian before registering an account. The Service does not require you to provide personal identity information. If a guardian finds that we have processed a child's personal information without consent, please contact us as described in Section 12, and we will delete it as soon as possible.
10. Third-party websites
To make sources easy to verify, research and map pages link to third-party resources such as papers, publications and institutional websites. When you visit these websites, their operators process your information under their own privacy rules, which we cannot control and for which we are not responsible. We recommend that you read their privacy policies before visiting them.
11. Updates to this Policy
We may update this Policy in response to changes in laws and regulations or adjustments to the Service. The updated version will be published on this page with its version number and update date. Where there are material changes, such as changes to the purposes or methods of processing or the types of personal information, we will notify you prominently on the website and in the app; where the law requires us to obtain your consent again, we will obtain it before the change takes effect.
12. Contact us
If you have any questions, comments or complaints about this Policy or the protection of personal information, you can contact us as follows:
- Operator
- Nanjing Define Future Technology Co., Ltd.
- Contact email
- service@deffuture.com
If you are not satisfied with our response, or believe that our processing of personal information has harmed your lawful rights and interests, you may file a complaint or report with the competent authorities, such as the cyberspace, telecommunications, public security or market regulation authorities, or bring a lawsuit in a people's court with jurisdiction.