This Privacy Policy explains how Cibo (cibo.hk) collects, uses, retains and protects data.

1. Data Sources

Cibo processes data that comes entirely from publicly disclosed information:

Allotment profiles: derived from CCASS allotment-list files publicly disclosed by share registrars (such as Tricor, Computershare, etc.). The ID numbers in those files are masked (e.g. 31010263****) and contain no information that can directly identify an individual; the allotment-result announcements provide aggregate statistics such as the number of valid applications, number of successful applicants and subscription multiples for each tier.
Other public data: HKEXnews announcements, prospectuses, allotment-result announcements and other publicly disclosed documents.

2. Personal Information in Public Data

CCASS allotment lists

Only the format features of masked ID numbers are extracted for classification and aggregate statistics. We do not store names, full ID numbers or any individual records; only aggregate statistics (counts, proportions and distribution histograms) are retained.

FAFA internal orders

Names, ID numbers, ID types, client types, broker numbers and raw channel strings are not stored; securities account numbers are stored only as a SHA-256 prefix (16 hex characters) hash, used as a stable deduplication key and never displayed; only client number and business fields such as subscription amount, quantity and fees are retained.

3. Inference Method

The region, province, gender and age attributes in the allotment profiles are inferred from the format features of masked ID numbers and are not real personal data:

ID type recognition: matching the ID-number format with regular expressions (length, letter prefix, check digit, etc.).
Region inference: Mainland, Hong Kong, Taiwan and Macau IDs are recognised directly by format; other countries/regions are inferred by looking up the passport-prefix letters.
Province inference (Mainland IDs only): based on the first 2 digits mapped to GB/T 2260 administrative-division codes.
Gender inference (Mainland IDs only): 17th digit odd = male, even = female.
Age inference (Mainland IDs only): age = year − birth year in digits 7–10 of the ID.
Hong Kong ID issue era: inferred from the historical allocation pattern of the leading letter.

The above inferences may carry recognition bias and statistical error.

4. Data Use

Aggregate statistics are used only for statistical research, IPO data analysis and internal risk/pricing reference.

5. Accounts and Community Features

Some personalised features of the Site (watchlists, preferences, community notes, etc.) require sign-in. Sign-in, registration and community features are provided by the pcell.si operations team; the Site does not itself collect or store your account information.

Email registration / sign-in: the username, nickname, email and password you provide are collected, stored and processed by pcell.si.
Google sign-in: if you choose “Continue with Google”, you will be redirected to Google to authorise; Google may provide pcell.si with basic information such as your email, name and profile picture.
GitHub sign-in: if you choose “Continue with GitHub”, you will be redirected to GitHub to authorise; GitHub may provide pcell.si with basic information such as your email, username and profile picture.
Passkey sign-in: if you choose “Sign in with passkey”, you will be authenticated using a passkey saved on your device or browser without a password; authentication is completed by pcell.si, and the Site only receives the sign-in credential and does not store the passkey.
Data flow: after sign-in, the Site only receives and verifies the sign-in credential issued by pcell.si to recognise your sign-in state; the Site does not store your password and does not keep your personal account profile on its own servers.
Account data policy: for the collection, use, retention and deletion of account and community data, see pcell.si’s Privacy Policy (https://pcell.si/privacy) and Terms of Service (https://pcell.si/terms).

6. Cookies and Analytics

The Site uses Cloudflare Web Analytics to collect anonymous usage statistics (such as page views, referrers and device types) to understand usage and improve the service. These statistics are not used to identify individuals.

7. Retention Policy

For public data: only aggregate statistics are retained; raw data that could directly identify individuals is not retained. For account data: handled by pcell.si under its own privacy policy; the Site does not retain it.

8. Legal Basis

Data processing complies with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong; the data processed is publicly disclosed and masked. Account data is handled by the pcell.si operations team in accordance with the laws of its jurisdiction.

9. Your Rights

You have the right to access and correct relevant data; for account data, please exercise your deletion and correction rights through pcell.si. If you have any questions, please contact us at cibo@fafa.hk.

10. Disclaimer

All content on the Site is for information reference only and does not constitute investment advice; see the Disclaimer page.

Past IPOs