Hong Kong Law Ordinance 香港法例 (Legal-libApp) privacy

Applies to the Hong Kong Law Ordinance mobile app for iOS and Android (repository name Legal-libApp, bundle id com.hklegal.library): an offline-first, bilingual reader for Hong Kong legislation. The “Privacy policy” row in the app’s Settings → About opens this section.

This service is operated by llab08, Hong Kong, and these terms are governed by the laws of Hong Kong. The section below explains this product’s data handling and current availability.

Summary

Unless you choose to sign in, the app collects no personal data. Sign-in is optional and is never used for advertising or tracking. The app shows no advertising and loads no analytics, crash-reporting or tracking library. It is ad-free by design: it contains no ad SDK.

Data kept on your device

Your settings (language, theme, font size), bookmarks, recently viewed documents, search history, the downloaded legislation library and a record of which data version was downloaded and when are stored only on your device. None of it is uploaded, including when you sign in. “Clear Data” in Settings, or uninstalling the app, erases all of it.

Optional sign-in

You can use the app without an account. If you choose “Continue with Google” or “Continue with Apple” in Settings → Account, you sign in through our own authentication server at supabase.llab08.com with your shared llab08 account, the same one used by other llab08 apps; Google or Apple handle their part of the sign-in under their own privacy policies. We receive the name, e-mail address and account identifier the provider shares; Google also supplies a profile picture link, which is stored with the account. We never see your password. Apple shares your name only the first time you sign in, and if you choose Hide My Email we receive an Apple relay address instead of your own. We use what we receive only to operate that account: to recognise you when you sign in, to show which account you are signed in to, and to carry out a deletion you ask for. Because none of your reading data is uploaded, signing in adds no other feature in this app at present and syncs nothing between devices.

The sign-in session is kept in your device’s secure storage (the iOS Keychain; Keystore-backed encrypted storage on Android). Settings → Account → Sign out removes it from this device; signing out does not delete your shared llab08 account. “Clear Data” clears the reading data listed above, not your sign-in session. On iOS, Keychain entries can survive uninstalling the app. Uninstalling does remove the installation marker the app keeps in local app storage (“Clear Data” does not), so on the first launch after a reinstall the app finds no marker and clears its own old sign-in entries from the Keychain, trying again on a later launch if that fails.

Our authentication server records your IP address and user-agent string at sign-in and whenever the app refreshes your session, for security and operations. Request logs on the login server and its gateway are deleted before they are 90 days old, sign-in audit entries once they are 90 days old, and the address and user-agent stored with your sign-in session 90 days after the session was last refreshed. You can ask us to delete entries about you sooner (see below).

Deleting your Hong Kong Law Ordinance 香港法例 account

This is how to delete the account you use in Hong Kong Law Ordinance 香港法例, the app published by llab08, and what happens to your data. Deletion removes only your Hong Kong Law Ordinance account; other llab08 apps keep theirs.

In the app. While signed in, open Settings → Account → Delete account. This option is being added to the app; until your version has it, use the e-mail route below. Once it is available, if you signed in with Apple, you must confirm with Apple first and we ask Apple to revoke the app’s Sign in with Apple tokens before deletion; if that fails, nothing is deleted.

Without the app. You can also ask for deletion without installing or opening the app: e-mail hello@llab08.com from the address on the account, with the subject “Delete Legal-lib account”. If you used Apple’s Hide My Email, write from your own address and give the relay address on the account. Before deleting anything we send a confirmation to the address on the account (the relay address, for Hide My Email), and only a reply to it counts, so knowing the address is not enough. We then delete the same account record as the in-app option, and a two-year block on creating a new account applies (see below). An e-mail request cannot revoke Apple’s tokens for you; to withdraw that access, stop using Sign in with Apple for Hong Kong Law Ordinance in your Apple account settings. If you used Hide My Email and our confirmation does not reach you, check in Apple’s Hide My Email settings that the relay address still forwards to your inbox and write to us again, or use Settings → Account → Delete account once your version of the app has it; that route needs no e-mail.

What is deleted:

• Your Hong Kong Law Ordinance account record: the entry that marks you as having an account in this app and links it to your shared llab08 sign-in. The name, e-mail address, provider account identifier and any profile picture link are held on the shared sign-in itself, which is covered below.
• If you signed in with Apple and delete in the app, the app’s Sign in with Apple tokens, which Apple revokes at our request.

What is kept, and for how long:

• Your shared llab08 sign-in, which other llab08 apps use, and your data in those apps, so they keep working. Its name, e-mail address, provider account identifier and, for Google, profile picture link stay until you ask us to erase it, as set out in the company-wide retention and erasure information.
• A block record: for two years, a new Hong Kong Law Ordinance account cannot be created with the same llab08 sign-in, Apple or Google account, or e-mail address. For this block we keep only keyed one-way hashes of those identifiers, not the identifiers themselves; the hashes are used only for this product’s block and are erased automatically after two years.
• Authentication logs on our login server and its gateway (IP address and user-agent string, recorded at sign-in and session refresh). Sign-in audit entries are deleted once they are 90 days old, request logs before then, and the address and user-agent stored with a sign-in session 90 days after that session was last refreshed (details under Optional sign-in); we delete the entries about you sooner when you ask.

Reading data. Your bookmarks, history and settings are only ever on your device, so account deletion does not affect them. Settings → Clear Data, or uninstalling the app, removes them.

Write to hello@llab08.com for any other request under Hong Kong’s Personal Data (Privacy) Ordinance: to see or correct your data, to have authentication log entries about you deleted, or to erase the remaining shared llab08 sign-in across products.

Downloading the legislation library

Apart from optional sign-in (above), the app connects to the internet for one purpose: fetching legislation data from our content delivery network (cdn.llab08.com, served by Cloudflare from storage we operate on Cloudflare R2). This happens when you download or update the library from Settings (“Check for Updates”, “Download All Assets”) and when you open a document that is not yet stored on your device. A fresh install downloads six compressed collection bundles and a manifest; later updates fetch only the files that changed. The app has no background communication: a sign-in session is refreshed only while the app is open. Library download requests carry no personal information, no device identifiers and no analytics. Cloudflare may keep short-lived standard server logs (IP address, time, file requested) under its own privacy policy; we do not use them to identify anyone.

Legislation content

The legislation text is © The Government of the Hong Kong Special Administrative Region, reproduced from Hong Kong e-Legislation (Department of Justice) as published through DATA.GOV.HK under its Terms and Conditions of Use. The app is not an official government product; for authoritative versions consult elegislation.gov.hk.

Children

The app is suitable for all ages and collects no data from anyone, including children, unless they choose to sign in.

Contact: hello@llab08.com · Updated 4 November 2026 · All privacy notices