Privacy Policy

1. Scope and Principles

1.1 This Privacy Policy (the “Policy”) applies to the BTC.com Museum website (the “Website”), a free online museum open to the public.

1.2 The Website consists principally of static pages. No registration or login is required and no user accounts exist.

1.3 The Museum does not currently create identifiers designed to identify individual visitors, does not display advertising, and does not carry out user profiling.

1.4 Non-essential analytics cookies are set only after the user’s consent has been obtained.

1.5 The Museum is guided by the principle of data minimisation and seeks to process only such information as is reasonably necessary for the purposes described in this Policy.

1.6 The technical descriptions in this Policy reflect the configuration of the Website as at the “Last updated” date. They are intended to help users understand how information is handled and do not constitute a guarantee of any technical parameter. The features and technical configuration of the Website may change as operational needs require, and this Policy will be updated from time to time. The processing of data by third-party services is governed by their own terms and privacy policies and is not entirely within the Museum’s control.

2. Cookies and Browser Storage

2.1 Language cookie (NEXT_LOCALE): values are zh, zh-hant, en, es, pt-br, ja and ko. It is set only when a language is chosen in the language menu, is session-level, is readable only by the Website, is strictly necessary, and is not used for tracking.

2.2 localStorage item “btc-consent”: stores only the user’s choice and the date on which it was made. It is not sent to the server, and the question is asked again after one year.

2.3 sessionStorage: records the reading position when the language is switched. It is deleted once the new page is displayed, is retained for a maximum of 10 seconds, and is not sent to the server.

2.4 Other than strictly necessary cookies and browser storage, non-essential cookies are, in principle, set only in accordance with the user’s choice.

3. Analytics

3.1 The Website uses Google Analytics 4 (“GA4”) for visit statistics.

3.2 Before consent is given, the Website does not set analytics cookies; GA4 may at that stage receive requests that contain no cookie identifiers, for aggregate statistics.

3.3 After consent is given, cookies including _ga are set in order to distinguish new from returning visitors and to link pages viewed within a single visit.

3.4 The data sent comprise: the page URL, dwell time and scroll depth, device and browser information, and on-site actions such as a gallery being opened, a video being played, and the category of a guide answer.

3.5 The Website is designed not to send content typed by the user (including guide questions and form content) to GA4, with the exception of glossary search terms.

3.6 Google receives the IP address, from which GA4 infers an approximate country or city; according to Google, GA4 does not log or store IP addresses.

3.7 Advertising features and Google signals are disabled. Google’s processing of the data is governed by its own terms and privacy policy.

3.8 A user may change this choice at any time via “Cookie settings” at the bottom of each page. After consent is withdrawn, the Website stops setting analytics cookies and, to the extent technically feasible, deletes those already set.

4. Information You Provide

4.1 Submissions: where a user makes a submission by email to editorialoffice@btc.com, the Museum receives the email address, byline, affiliation (if any) and the submitted content, which are used for review, contact and attribution. If a submission is published, the byline and affiliation are displayed publicly; the email address is not.

4.2 Corrections: the content of the correction, evidence links and a contact email address (optional on the online form, where available) are used solely for the purpose of that correction.

4.3 The glossary “contribute entry” function opens the user’s own email client; the Website does not store the content of those fields.

5. Online Guide

5.1 Question matching runs in the user’s browser.

5.2 Each typed question is sent together with the language and the match result, in order to check the quality of answers and to make improvements.

5.3 Where a user clicks a recommended question, nothing is sent.

5.4 The Museum uses automated means to attempt to remove email-like and telephone-like strings, and truncates the text to 200 characters. The Museum does not intentionally store the IP address or intentionally link the record to any particular person. Automated removal may not identify all personal information, so please do not enter personal information into the guide.

5.5 Where the “leave this question for us” function is used, the question, the language and the page are sent.

5.6 Where a user gives “helpful / not helpful” feedback, the following are sent: which answer, whether it was helpful, the question, the language and the page. The Museum does not actively collect any name, email address or IP address through this feature.

6. MCP Interface

6.1 The MCP interface is made available for AI assistants such as Claude and ChatGPT.

6.2 The Museum generally receives only search terms and entry IDs; it does not obtain conversations between a user and the assistant.

6.3 The Museum keeps daily statistics of call counts, latency, whether results were found, the self-reported client name, and the entry IDs retrieved.

6.4 Search terms are stored together with whether a result was found and the top entry. Before storage, the Museum attempts to remove email-like and telephone-like strings and truncates the text to 200 characters.

6.5 The Museum does not record IP addresses in MCP call records; infrastructure-level logs are handled in accordance with clause 7.2.

7. Technical Data and Security

7.1 IP-based rate limiting is applied to write interfaces; the related counts are generally deleted after approximately 60 seconds.

7.2 Server and CDN logs may record the IP address, URL, time and browser information for troubleshooting, security, abuse prevention and aggregate traffic statistics, and are generally kept for no longer than 13 months, save where a longer period is required to comply with law or to handle security incidents or disputes.

7.3 The Website uses a CDN and a web application firewall (WAF), provided by Amazon Web Services, to identify and block malicious or abnormal requests; this involves processing the IP address and request information (such as the URL, time and browser information).

7.4 Fonts are currently self-hosted; no requests are made to third-party font services.

7.5 YouTube videos display only a locally hosted cover image and a play button. The YouTube player is not loaded before the user clicks. After the user clicks, the player loads from youtube-nocookie.com, Google receives the IP address and browser information, and may set cookies or local storage under Google’s privacy policy.

7.6 Front-end error reports are designed to send only the error message and the page path without the query string, to contain no cookies or user input, and to be merged per error. The Museum does not intentionally collect IP addresses through error reports.

7.7 The Museum applies reasonable security measures appropriate to the nature of the Website. However, no method of transmission or storage over the internet is completely secure, and the Museum cannot guarantee that information will not be subject to unauthorised access, disclosure or loss. Where a data security incident must be handled or notified under law, the Museum will act in accordance with applicable law.

8. Purposes and Legal Bases

8.1 Necessity for the purpose of providing the Website and the features requested by the user.

8.2 Consent, in respect of analytics cookies and video playback.

8.3 Legitimate interests, in respect of security, abuse prevention and the improvement of the exhibits.

8.4 Compliance with legal obligations.

9. Service Providers

9.1 Amazon Web Services: servers, database, file storage, CDN and web application firewall.

9.2 Google: analytics (Google Analytics); mailbox (Google Workspace).

9.3 YouTube (Google): videos.

9.4 These providers process data under agreements with the Museum or under their own privacy policies. The Museum may also use other technical service providers to operate the Website and will update this Policy from time to time. Save as described in this Policy, or where required by law, requested lawfully by law enforcement or regulatory authorities, or necessary to protect the legitimate rights of the Museum, users or the public, the Museum does not provide visitor data to other parties.

10. International Transfers

10.1 Data may be processed outside the user’s country, including by the providers listed above.

10.2 Appropriate safeguards are applied as required by applicable law.

11. Retention

11.1 General retention periods are set out in the table below:

Rate-limit counters: 60 seconds

Server and CDN logs: Up to 13 months

GA4 data: Automatically deleted after 14 months

_ga cookie: Up to 2 years; withdrawable via “Cookie settings”

Guide questions and MCP search terms: Generally deleted after 90 days

MCP call statistics: Kept per day; contain no personal data

“Leave this question for us” messages and answer feedback: Kept as working records for improving the Q&A; not linked to persons

Submissions and corrections: Kept as part of the collection archive unless deletion is requested

Error reports: Deleted within a reasonable period after the issue is resolved

Cached third-party public data: Values only; contain no visitor information

11.2 The periods in the table above apply in ordinary circumstances. Information may be kept for longer where required to comply with law, to handle disputes or security incidents, or owing to technical backup cycles; information in backups will be overwritten or deleted in the normal backup cycle.

12. What We Do Not Do

12.1 We do not sell, rent or exchange personal information.

12.2 We do not display advertising and do not engage in third-party marketing.

12.3 We do not use our analytics to carry out cross-site tracking.

12.4 Advertising features and Google signals are disabled in our analytics configuration.

13. Your Rights

13.1 A user may request access to, correction of, or deletion of information that the user has submitted by writing to editorialoffice@btc.com and identifying the relevant submission or correction. The Museum may need to verify the requester’s identity and will respond within a reasonable period in accordance with applicable law. Information that has been published as part of the collection archive or must be retained by law may not be capable of complete deletion.

13.2 Consent may be withdrawn at any time via “Cookie settings”.

13.3 Where applicable law, such as the EU General Data Protection Regulation (GDPR) or the Singapore Personal Data Protection Act (PDPA), provides further rights, such requests will be handled accordingly.

13.4 Users in the EU, the EEA and the United Kingdom may lodge a complaint with their supervisory authority.

14. Children

14.1 The Website is not directed at persons under the age of 13.

14.2 Please contact us if information relating to such a person should be deleted.

15. Changes and Operating Arrangements

15.1 The Museum may amend this Policy from time to time. In the event of material changes, the “Last updated” date will be updated, and notice may be given by such means as the Museum considers appropriate, such as an announcement on the blog page.

15.2 If the operation of the Website is adjusted or transferred to another entity, information may be transferred to the successor; the Museum will require the successor to handle such information in accordance with this Policy or with a standard of protection no lower than this Policy.

16. Language

16.1 This Policy is made in Chinese and English. In the event of any inconsistency, the English version prevails.

16.2 The governing law and dispute resolution provisions of the Terms of Use apply to this Policy.

17. Contact

17.1 Questions regarding this Policy may be addressed to editorialoffice@btc.com.