L
LDiHKAnalytics
Launch Console

Privacy Policy

Last updated: 20 October 2026

This policy explains which personal data LDiHK processes when you use this website and the analytics console, why, on which legal basis, with whom it is shared and which rights you have. It follows the EU General Data Protection Regulation (GDPR). LDiHK is a prototype created for the EuroTech x Hong Kong Talent Exchange Hackathon 2026 in Munich; it does not provide medical or insurance services and does not share data with insurers.

1. Who is responsible

Controller within the meaning of Art. 4(7) GDPR:
LDiHK
Munich, Germany
Email: contact@ldihk.xyz

For all privacy questions and requests, write to the email address above.

2. What we process and why

2.1 Visiting the website

When you open the website, our hosting providers process technical data your browser sends: IP address, date and time, the page requested, browser and operating system. This is needed to deliver the website and keep it secure (Art. 6(1)(f) GDPR, our legitimate interest in a secure and working service). These server logs are kept by the hosting providers for a short period (typically up to 30 days) and are not combined with other data.

We do not use analytics, advertising or tracking tools, and we set no tracking cookies. Fonts are delivered from our own server. The only third-party content is the feedback form (section 2.6), which loads only on request.

2.2 Your LDiHK-ID

The console works without name, email or password. On your first upload your browser generates a random, anonymous LDiHK-ID. It is the only key to your data: whoever has it can open your console. We store it on our server to assign your data and in your browser's local storage so you stay signed in (technically necessary, § 25(2) TDDDG). We cannot recover a lost ID.

2.3 Your data export and the analysis

You can upload a data export that you requested yourself from YouTube (Google Takeout), Instagram or TikTok. Before upload, your browser removes videos, photos and other media. On our server we extract only:

  • when you watched, searched, liked, commented or viewed something (timestamps), the platform and the type of activity;
  • identifiers of videos and channels (e.g. YouTube video IDs), and your subscriptions (channel IDs and links);
  • titles, search terms, channel names and comment or message texts only as one-way hashes (irreversible fingerprints, used to detect duplicates), never as readable text.

The uploaded archive itself is deleted from storage as soon as the import has finished. From the extracted data we compute usage statistics (daily volume, hour of day, fragmentation, late-night use), comparisons with other people and an indicator of how your usage relates to published research on social media use and depression.

Optionally you can state your age range (5-year steps, never your exact age) and your sex, so you are compared with people like you. You can change or remove both at any time in the console.

Legal basis: your consent (Art. 6(1)(a) GDPR). Because the analysis relates to mental health, we also rely on your explicit consent under Art. 9(2)(a) GDPR, which you give in the consent dialog before uploading. You can withdraw it at any time with effect for the future by deleting your data (see section 5).

The indicator is for self-reflection only. It is not a diagnosis and is not shared with anyone, including insurers.

2.4 Video lengths from the YouTube Data API

To estimate watch time, our server sends the IDs of videos from your history (without your LDiHK-ID or any other information about you) to the YouTube Data API and stores the public length of each video. LDiHK uses YouTube API Services. See the YouTube Terms of Serviceand the Google Privacy Policy. You can revoke access by deleting your data (section 5); Google's security settings page is atmyaccount.google.com/permissions.

2.5 Comparison population

Comparisons use synthetic (computer-generated) profiles and, where available, other users' data, always as aggregates over at least five people. No other person's individual data is ever shown to you, and yours is never shown to others.

2.6 Bug reports and feature requests

Our feedback page uses Google Forms (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The form is only loaded when you click "Load the form here" or open it in a new tab; before that, no data is sent to Google. Once loaded, Google receives your IP address and browser information and may set cookies or ask you to sign in with a Google account. We receive what you enter in the form (and, if the form asks for it, the email address of your Google account) and use it only to fix bugs and plan features. Legal basis: your consent by loading the form (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We delete reports once they are handled, at the latest after 12 months. Please do not enter your LDiHK-ID or health information in the form.

3. Recipients and processors

We use the following service providers, bound by data processing agreements (Art. 28 GDPR):

  • Netlify, Inc. (USA): hosting of the website.
  • Render Services, Inc. (USA; servers in Frankfurt, Germany): hosting of the analytics server.
  • Neon, Inc. (USA; database in Frankfurt, Germany, on AWS): storage of the extracted data.
  • Cloudflare, Inc. (USA; storage location EU): temporary storage of uploaded archives until import.
  • Google LLC (USA): YouTube Data API, see section 2.4 (receives video IDs only).
  • Google Ireland Limited / Google LLC: Google Forms for bug reports, see section 2.6 (only when you load the form).

Where data may be transferred to the USA, the transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We do not sell your data and do not share it with insurers or other third parties.

4. How long we keep data

  • Uploaded archives: deleted right after the import (unused uploads after about 40 minutes).
  • Extracted data, LDiHK-ID, age range and sex: until you delete them with "Delete My Data", which takes effect immediately and permanently.
  • A record of each upload's size and time, without any link to your LDiHK-ID, is kept for up to 100 days to keep storage within its limits.
  • Server logs: see section 2.1.

5. Your rights

You have the right to:

  • access your data (Art. 15 GDPR): everything we hold is visible in your console;
  • rectification (Art. 16) and erasure (Art. 17): "Delete My Data" in the console deletes everything at once;
  • restriction of processing (Art. 18) and data portability (Art. 20);
  • object to processing based on legitimate interests (Art. 21);
  • withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3));
  • lodge a complaint with a data protection supervisory authority, in particular in your country of residence (Art. 77).

Because we do not know who you are, requests by email need your LDiHK-ID so we can find your data. Never send the ID to anyone else.

6. Children

The service is intended for people aged 16 and over. Younger users may only use it with the consent of a parent or legal guardian (Art. 8 GDPR).

7. Security

All connections are encrypted (HTTPS). Uploads go directly into our storage through single-use, time-limited links. Data is stored pseudonymously under the LDiHK-ID, without names, email addresses or account handles. Keep your LDiHK-ID secret like a password.

8. Automated decisions

We make no decisions with legal or similarly significant effects based solely on automated processing (Art. 22 GDPR). The risk indicator is information for you only.

9. Changes

We update this policy when the service or the law changes. The date at the top shows the current version. Significant changes are announced in the console.