Last Updated: September 19, 2026 · Version 3.0

Efunction (Easy Function Plotter) — Privacy Policy

This Privacy Policy is issued by Data Network Technology Lab, Hong Kong SAR ("we", "us") and applies to your use of the Efunction plotting application and its cloud-save service (the "Application"). It is prepared in accordance with the Personal Data (Privacy) Ordinance of Hong Kong (Cap. 486, "PDPO") and its six Data Protection Principles, together with the EU General Data Protection Regulation (GDPR), and takes into account multi-regional data-protection requirements.

1. Introduction and Data Controller

1.1 The Application is a mathematical function plotting tool that offers two ways of keeping your work — local saving and cloud saving — while every drawing feature remains fully available without an account. For the limited processing described below, we are the data controller (GDPR Art. 4(7) / data user under the PDPO).

1.2 We follow the principles of data minimisation and local first: if you never use the cloud-save feature, the Application does not transmit any personal data to our servers.

2. Information We Process

2.1 Locally stored information (no sign-in required). To improve your experience, the Application uses your browser's localStorage to keep:

Function expressions you enter and related settings (colour, name, visibility)
The schemes (worksheets) you create, including their names and parameter settings
Canvas zoom level, pan position and axis ranges
Theme preference (classic / dark / light) and language preference
Feature toggle states (intersections, derivative display, parameter sliders) and interface mode

This data remains on your device only. We cannot access it and never upload it.

2.2 Account information (collected only when you register or sign in). When you create an account or sign in to use cloud saving, we process the minimum necessary information:

Your chosen account identifier (internally named qq)
A salted hash of your password (PBKDF2-SHA256, 210,000 iterations — we never store your plain-text password)
A login token and its expiry time
Captcha verification records, used to prevent automated abuse and brute-force attacks

We do not ask for your real name, phone number, email address, identity documents or any other identifying information.

2.3 Cloud-saved scheme data (uploaded only on your request). When you press "Cloud Backup", the schemes you tick are uploaded and stored on our servers so that you can restore them on any device. The uploaded content is limited to: scheme name, function expressions, colour and visibility settings, parameter settings and axis ranges.

The Application never uploads your local data automatically; every upload is triggered manually by you and confirmed before it is sent.

2.4 What we do not collect. We do not collect your browsing history, device fingerprints, precise location, contacts, photo library, clipboard content or any other information unrelated to plotting, and we never use data for advertising or profiling.

Local by Default

Cloud is Opt-in

No Tracking

Hashed Passwords

3. Purposes and Legal Bases

3.1 Purposes. Account information is used to authenticate you, keep you signed in and protect the service; cloud-saved schemes are used to store and restore the worksheets you chose to back up; locally stored data is used to restore your previous working state and remember your preferences.

3.2 Legal bases under GDPR Art. 6.

Performance of a contract (Art. 6(1)(b)) — processing strictly necessary to provide the account and cloud-save service you requested;
Consent (Art. 6(1)(a)) — by registering an account and pressing "Cloud Backup" you consent to the corresponding processing, and you may withdraw that consent at any time;
Legitimate interests (Art. 6(1)(f)) — keeping the service secure and preventing abuse, for example captcha and token validation.

3.3 Under PDPO Data Protection Principle 1, the data we collect is necessary, adequate but not excessive, and directly related to the purposes for which it is collected.

4. Cloud Saving and Accounts

4.1 Cloud saving is entirely optional. You may use local saving indefinitely, free of charge, without registering or providing any personal data.

4.2 You can sign out at any time in the Application, and you can request deletion of your account and all cloud-saved schemes at any time (see section 11).

4.3 Because passwords are stored as one-way hashes, we cannot recover your password. If you forget it, it can only be reset.

4.4 We do not use your cloud-saved schemes for any other purpose, and we never sell, rent or share them with third parties.

5. Cookies and Tracking

5.1 The Application does not use cookies or third-party tracking technologies, and does not set persistent identifiers for tracking. Your signed-in state is maintained by a token held in your browser's local storage.

5.2 We do not use Google Analytics or comparable analytics services.

6. Third-Party Services and Cross-Border Transfers

6.1 Mathematics and input. The Application uses the open-source Math.js and MathLive components (shipped with the Application, or in some builds loaded through a CDN). These components run locally in your browser and do not receive your personal data.

6.2 Cloud service backend. The APIs used by cloud saving are operated by us on DNT Group servers. When you use a cloud feature, the relevant data is transmitted to that server.

6.3 Cross-border transfer. Our servers may be located in a different jurisdiction from you. Where a cross-border transfer occurs, we apply appropriate safeguards under Chapter V of the GDPR and PDPO Data Protection Principle 3, including Standard Contractual Clauses or reliance on an adequacy decision. By using a cloud feature you acknowledge and agree to such transfer.

6.4 We do not sell or share your personal data with any third party, except where compelled by mandatory law or by a lawful order of a competent authority.

7. Data Retention

7.1 Local data exists only for as long as you keep it and can be cleared at any time through the Application or your browser settings.

7.2 Account and cloud-saved schemes are retained for as long as your account exists. When you delete an account or a specific cloud scheme, we remove the corresponding data from live systems — and from backups within a reasonable period, normally no longer than 30 days.

7.3 Records that must be retained for legal, tax or security-audit reasons are deleted once the statutory retention period expires.

8. Data Security

8.1 Password protection. Passwords are stored as salted PBKDF2-SHA256 hashes with 210,000 iterations; your plain-text password cannot be reconstructed from what we hold.

8.2 Transmission protection. Cloud features are transmitted over HTTPS, and tokens are validated as SHA-256 digests with a limited lifetime.

8.3 Access control. Server data is accessible only to authorised personnel on a need-to-know basis and under controlled conditions.

8.4 The security of locally stored data depends on your device and browser settings. We recommend keeping your system updated and using a screen lock.

8.5 Although we apply reasonable technical and organisational measures (PDPO Data Protection Principle 4), no system can guarantee absolute security. If a personal data breach affecting you occurs, we will notify you and the relevant supervisory authority in accordance with applicable law.

9. Children's Privacy

9.1 The Application is not directed at children under 14 (or the corresponding age in your jurisdiction), and we do not knowingly collect personal data from them.

9.2 If you are a minor, please use the cloud-save feature only with the consent and guidance of a parent or guardian. If we learn that we have collected a child's personal data without the required consent, we will delete it as soon as practicable.

10. Your Rights

10.1 You have full control over your data, including the rights to: view, modify or delete saved functions and schemes; decline to restore your previous working state; clear all local data; sign out; and delete your account together with all cloud data.

10.2 Under sections 18 and 22 of the PDPO and Articles 15–22 of the GDPR, you also have the rights of access, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent, and the right to lodge a complaint with the Hong Kong Privacy Commissioner for Personal Data or your local supervisory authority (GDPR Art. 77).

10.3 To exercise any of these rights, please contact us using the details in section 14. We will respond within a reasonable period, normally within 30 days.

11. Deleting Accounts and Cloud Data

11.1 You can delete an individual cloud scheme inside the Application, or request deletion of your entire account.

11.2 Deletion requests are carried out after identity verification. Deleted data cannot be recovered, so please export a local backup JSON file first using the "Local Backup" feature.

11.3 Deleting your account does not prevent you from continuing to use the Application in local mode.

12. Multi-Regional Compliance

12.1 Beyond the PDPO and the GDPR, this policy is designed to be compatible with data-protection requirements in Mainland China, Singapore, Japan, Korea, the United States and other major jurisdictions, based on data minimisation and local-first processing.

13. Policy Updates

13.1 We reserve the right to amend this policy in accordance with applicable law. The revised version will be posted on the official website with a new effective date, and we will give prominent notice if a change materially affects your rights.

13.2 Continued use of the Application constitutes acceptance of the updated policy. If you do not agree, you may stop using the Application and delete your account and local data.

14. Contact

If you have any questions, access requests or complaints regarding this Privacy Policy or your rights, please visit https://dnteam.top