Privacy Policy
Last updated 2026-08-26
This policy covers fulinlabs.com, the site you are reading. The products linked from here — HSK Studio, ShortLink, SchedulePost and Fulin Flashcard — run on their own subdomains and have their own policies.
There is no account to create, no form to fill in, and nothing to sign up for on this site. It is a blog and a set of project pages.
What is collected
Self-hosted analytics, so I can tell which articles are read and which links are followed. For each page view it records:
- the page path, and the site you arrived from, if any
- campaign parameters in the URL (
utm_*) when a link carries them - your screen size, used only to tell a real browser from an automated one
- the time of the visit
- device type, browser and operating system, worked out from the User-Agent your browser sends with every request
Three named events are also recorded: that an article was read (60 seconds on the page and scrolled at least halfway), that a link out to one of the products was clicked, and that a project page was left within five seconds.
JavaScript errors are reported so I can fix them. An error report contains the message, the script it came from, and a stack trace.
What is not collected
- No cookies. The site sets none, which is why there is no cookie banner.
- No third-party trackers, fonts, or embeds. The
Content-Security-Policy this site serves is
default-src 'self'— your browser is not permitted to contact any other host while you are here. That is enforced by the browser, not merely promised. - No IP address is stored. Your IP necessarily reaches the server to deliver the page, and it is used in memory to rate-limit abuse, but it is never written down. No table in the analytics database has a column for it.
- No name, email, or account, because there is nothing here to sign in to.
- No location beyond country, and in practice not even that: country is read from a header the hosting provider would have to set, and the analytics host does not set one.
What is stored in your browser
Two random identifiers, so returning visits can be counted without knowing who you are:
_o_vidinlocalStorage— a random string, kept between visits_o_sidinsessionStorage— a random string, discarded when you close the tab
Neither is derived from anything about you: they are random values, not a fingerprint. Clearing site data for this domain removes them, and a fresh one is generated on your next visit. If your browser blocks storage, the site works normally and the id lasts only for that page load.
The free tools
The text analyser and the flashcard calculator run entirely in your browser. Whatever you paste into them is never sent anywhere — there is no network request behind either one.
Who else sees this data
Nobody. It is not sold, shared, or used for advertising. Two companies necessarily handle the traffic in order to serve it: Vercel hosts the site, and Railway hosts the analytics server the measurements are stored on. Both are infrastructure providers acting on my behalf, and neither is given the data for their own purposes.
Opting out
Any content blocker that blocks /a.js stops the measurement
entirely, and the site is fully functional without it. Browsers that send
Do Not Track are not treated differently, because the signal is not
honoured consistently enough anywhere for that to be a meaningful promise.
Your rights
The honest position: because nothing collected identifies you, I cannot look up "your" data to show or delete it — there is no name, email, or address attached to any of it, only a random id your own browser holds. Clearing site data is the complete deletion, and you can do it without asking me. If you have a question about any of this, write to hello@fulinlabs.com.
Changes
If what the site collects changes, this page changes with it and the date at the top moves. There is no mailing list to notify, so the date is the only signal — it is worth checking against your own expectations rather than trusting that nothing moved.