Privacy note
H3X Search has no accounts, logins or profiles. To work, it processes what you search for and a code derived from your IP to limit searches. Here is everything that happens, in plain words.
Updated
When you search
- Your search term goes to our server, which queries Xianyu listings with it.
- Results and translations are cached on the server for a while so the same search isn't repeated. The cache doesn't record who searched.
- Translation: listing titles and, if you turn translation on, your search term are sent to third-party machine translation services (such as Google's and MyMemory).
- Exchange rate: the server queries public currency services to convert yuan to reais. Nothing about you is sent.
Your IP and the search limit
There is a per-person search limit so nobody exhausts the service. To count, the server turns your IP into a keyed hash and stores only that code and the day's count. Previous days' counts are deleted. The IP itself isn't stored in that record.
Listing images
Photos are loaded by your browser straight from the marketplace's image servers, which therefore receive the request (including your IP), as with any site showing images hosted elsewhere. The site asks your browser not to send the referring page.
Cloudflare
The site runs on Cloudflare. Against bots we use Cloudflare Turnstile (an automatic check in your browser when the search page loads) and Bot Fight Mode, which analyse technical signals from the browser and connection. Cloudflare also keeps technical request logs, which can include the requested address (and so the search term), for a limited time. See Cloudflare's privacy policy.
In your browser
The site stores in your browser's local storage two preferences (your language and whether search translation is on) and the search session token, which lasts 2 hours, only works from your connection and spares you the anti-bot check on every reload. Listings you save to your bag stay only on this device, in the browser's storage, and are never sent to the server (not even when you share the bag: the link carries the items after the “#”, which browsers don't send). Notes, named bags and saved searches also stay only on this device; to show how many listings of a saved search are new, the site asks the server for the same search only in the copy it already keeps (at most 5 per visit, without searching the source again and without storing anything about you). There are no tracking cookies or ads. The site counts usage events anonymously (visits, searches, clicks on “Sign up” and “Buy”, bag usage, and how the anti-bot check went, in the browser and when the server confirmed it), each with only the language, the partner, the device type (phone or computer) and whether the browser runs inside an app: no IP and no identifier of yours. For the “Trending in the last 24h” lists, searches that return results also keep the search term, and a click on “Buy” keeps the (public) listing clicked, together with a code that changes every day and differs for each term and listing: it only counts how many different people searched or clicked, cannot be traced back to your IP and does not link one of your searches to another. Only what at least 3 different people searched or clicked is shown. Cloudflare may set technical security cookies related to bot protection.
When you click Buy on Hubbuy
You leave H3X Search for Hubbuy, which has its own privacy rules. The link carries H3xCN's invite code (see Disclosure).