A little transparency.

This policy explains how baishiki.com, operated by Tei Baishiki, handles information when you browse, contact us, or use the member area. For privacy questions, use our Contact form.

What we collect and why

Contact messages

The form requires your name, email, phone number, and message. These details are emailed to the site operator so we can reply. Your email becomes the Reply-To address. The site does not store a separate message copy in its database. Correspondence remains in the email account until removed according to our correspondence and record needs. Please avoid sending passwords or other sensitive information.

Google sign-in and invitations

Google verifies your identity using your profile and verified email. We store your email, display name, Google account identifier, role, approval status, last login time, and workspace preferences (navigation pinning and collapse state, time zone, light or dark appearance, and Green or Blue color theme). Workspace preferences are stored with your account, not contact-form data. We do not receive your Google password or request access to Gmail, Drive, or contacts. Administrators manage approved users and domains, and access requires both an enabled user and an enabled domain.

Security and spam protection

Cloudflare hosts the site and its access database. Hosting and security services receive technical request information, such as IP addresses, browser information, and diagnostic data, to deliver and protect the service. The site temporarily stores hashed request identifiers and counts to limit abuse. We also retain records of logins and administrative access changes. IP limit breaches and temporary lockouts can trigger email notifications to the Super Admin. Notification records contain event types, times, limit thresholds, and shortened hashed references, not raw IP addresses or contact-form contents. The site retains sent notification metadata for 30 days and pending metadata for up to seven days, with delivery retried every five minutes. Email copies remain in the Super Admin mailbox until removed. The administrator Security Monitor records event types and times for up to 30 days, including application-setting changes, denied sign-ins, denied contact verification, rate limits, mail delivery errors, access changes, and session revocations. It does not record contact-form fields or messages.

With your permission, our contact form loads Google reCAPTCHA v3 when you submit. Google uses information such as your IP address, browser and device information, and interaction signals to assess whether a request is automated. A verification token is sent to our server and checked with Google. We check the score, action, and site hostname before emailing your message. Google verifies token expiry and single use. Your contact fields and message are not included in the server’s reCAPTCHA verification request. reCAPTCHA uses browser storage, including its _GRECAPTCHA cookie. Google’s Privacy Policy and Terms of Service apply.

Cookies and your choices

Essential cookies support Google sign-in and remember your privacy choice. Google reCAPTCHA is loaded only after you allow it and submit the contact form. Choose “Essential only” to browse and sign in without loading the form’s reCAPTCHA scripts; the contact form requires permission to load reCAPTCHA. Use at any time to change your choice. Withdrawing permission stops future loading and reloads a page if Google’s scripts have already loaded. It does not erase information already sent to Google or delete cookies held on Google’s domains.

We use no advertising or analytics cookies. Cloudflare’s hosting platform may also provide cookieless measurements of page loading and website performance. Cloudflare describes these measurements and their privacy protections in its performance measurement documentation. For cookie names, purposes, and durations, see our Cookie Policy.

Who receives information

Contact messages are received by Tei through Google Workspace. Google provides sign-in and reCAPTCHA; Cloudflare provides hosting and the access database. Approved administrators can view and manage account and domain access information. Information may be processed in countries other than your own through these providers. We do not sell contact or account information.

Retention and protection

Login-flow state lasts up to ten minutes; sessions expire after eight hours or the configured idle timeout (30 minutes by default). We store the last authenticated activity time to enforce the timeout. Hashed IP attempt counters and temporary lockouts expire after their configured windows and are removed by hourly maintenance. Expired login state and sessions are also removed hourly. Account approvals and security audit records are retained while needed to operate and protect the member area and reviewed when access or deletion requests are received. The site does not keep reCAPTCHA tokens or scores in its database.

The site uses HTTPS, protected server-side secrets, secure sign-in cookies, role-based access, and individual-user and domain checks. No online service can guarantee absolute security.

Access, correction, and deletion

Use our Contact form to ask about information we hold, correct account details, request deletion, or raise a privacy concern. We may need to verify your identity before acting and may retain information needed for security, legal obligations, or ongoing correspondence. Your available rights depend on the laws that apply to you. Google account and provider-held data can also be managed through those providers.

Changes to this policy

We update this page when site features or data practices change. The date above identifies the latest revision.