Privacy Policy

Thai'd Up is Minnie's Thai course: the learning app at app.thaidup.app and the website at thaidup.app. It is operated by Ghost Works Co., LLC, 22656 Esplanada Circle, Boca Raton, FL 33433, USA("we", "us"). We decide how your personal data is used, which makes us the data controller.

Questions or requests about your data: privacy@thaidup.app.

• We collect what we need to run your lessons: your sign-in, your name, and your progress.
• We don't sell your data, show ads, or use advertising trackers.
• Speaking practice uses your browser's own speech recognition. We never store recordings of your voice.
• You can download your data or delete your account at any time from Settings.

Your account. Your email address, the name or nickname you give us, and how Thai should address you (the polite particle you use: kráp, kâ, or both). We use these to sign you in and to personalize exercises. You sign in with a one-time code we email you, or with a passkey.

Passkeys. If you add a passkey, your device creates a key pair and keeps the private key; Face ID, Touch ID, your fingerprint or your device PIN unlocks it on your device, and we never receive your face, fingerprint or PIN. We store only the public key, the passkey's name, when you added it and when you last used it. You can rename or remove your passkeys in Settings, and they are deleted with your account.

Guest mode. If you start without an account, we create a guest account identified only by a random ID. It has no email or name until you choose to add one.

Your learning. Lessons and sections you finish, XP, streak, words studied, your review schedule, alphabet progress, speaking-practice scores, and your preferences (Thai script, reading mode, audio speed, daily goal, theme). We use this to run the course, show your progress and keep it in sync between your devices.

Microphone and speech. Speaking practice only uses your microphone when you tap to speak and your browser has asked for your permission. Your browser's built-in speech recognition turns what you say into text: in Chrome this is a Google service, in Safari an Apple service, each under its own privacy terms. The app receives the recognized text and works out a score on your device. Where your browser can't recognize speech, the app can record a short clip so you can compare yourself with the model audio; that clip stays on your device. We do not receive or keep audio of your voice. If we ever check speech on our servers instead, we will update this policy and name the provider first.

Daily reminders. Reminders are off until you turn them on. When you do, we store, for each device, the push address your browser gives us (with its encryption keys), your time zone and the reminder time you picked. Your browser's push service delivers the reminder: Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox, Microsoft for Edge on Windows. A reminder carries a short nudge, your current streak and a word of the day; nothing else about you. Turn reminders off in Settings, or block notifications in your browser, and we stop; the stored push address is deleted when you turn them off or delete your account.

Recordings by Minnie. The course audio Minnie and our team record in our recording tool is stored on our servers and played to learners. Learners cannot upload recordings.

Usage and performance. We use Vercel Web Analytics and Speed Insights to count page views and measure loading speed: which pages are visited, the referring site, country, device type and browser. These tools use no cookies, do not follow you across other websites, and are not linked to your account. We remove anything after the "?" in page addresses before it is sent. They also count a few app actions, such as starting a trial, signing up or installing the app, without linking them to you.

Error reports. If the app breaks while you are signed in, it sends us the page it happened on, the error message, technical details about the error and your browser type, linked to your account ID so we can fix it. Email addresses and codes are removed before sending. We keep these reports only as long as we need them to fix problems, and they are deleted with your account.

Emails. We send you one-time sign-in codes. If you email us, we keep the conversation so we can help you.

Payments. When you buy paid access, Stripe processes the payment and collects your card and billing details itself. We never see or store your full card number. We give Stripe your email address so it can send receipts and link your payments to your account. We receive and keep a record of what you bought: the plan, what you paid, the dates and your subscription status. If you redeem a gift code, we record which code and when.

On your device. The app stores your progress, settings and theme in your browser so it works quickly and offline, plus the cookies needed to keep you signed in. These are strictly necessary. We use no advertising cookies and no tracking pixels.

• To provide the service you asked for (contract): your account, progress, sync and paid access.
• Our legitimate interests: keeping the app secure, preventing abuse, fixing errors and understanding overall usage through cookieless analytics.
• Your consent: microphone access (asked by your browser, and you can turn it off at any time), daily reminders (off until you turn them on), and any marketing emails, which we will only send if you opt in.
• Legal obligations: for example, keeping payment records for tax and accounting purposes.

We use a small number of service providers, each under its standard data processing terms, and they use your data only to provide their service to us:

• Supabase: our database and sign-in system. Your account and progress are stored in Supabase's Singapore region.
• Vercel: hosting, analytics and performance measurement, on a global network.
• Resend: delivers sign-in emails.
• Stripe: payments and subscriptions.

Some features use services built into your browser rather than ones we choose: speech recognition (Google in Chrome, Apple in Safari) and the push service that delivers reminders. Those work under your browser maker's own privacy terms.

We don't sell or rent personal data, and we don't share it with advertisers or data brokers.

Your account and progress are stored in Singapore. Some providers above process data in other countries, including the United States. Where data leaves Thailand or the European Economic Area or the UK, we rely on each provider's standard data processing terms, including the standard contractual clauses where the provider offers them.

• Your account and learning data: until you delete your account.
• Guest accounts: until you delete them, from the browser you learn in.
• Error reports: only as long as we need them to fix problems, and always deleted with your account.
• Database backups: deleted data disappears from backups within 7 days.
• Analytics: kept only as aggregated counts that do not identify you.
• Emails you send us: as long as needed to help you, and no longer than 2 years.
• Payment records: as long as tax and accounting law requires, even after you delete your account. Stripe also keeps its own records under its privacy policy.

Under Thailand's Personal Data Protection Act (PDPA) and, where it applies, the EU and UK GDPR, you can:

• Get a copy of your data: Settings > Account > Export my data downloads a file with your account, progress, settings, reminder times, paid access and subscriptions. For anything else we hold about you, such as payment records or error reports, email privacy@thaidup.app.
• Correct it: change your name and particle in Settings > Profile, or ask us.
• Delete it: Settings > Account > Delete my account, or visit the account deletion page, which also works when you can't sign in.
• Object to or restrict how we use it, and withdraw consent you have given.
• Complain to Thailand's Personal Data Protection Committee (PDPC) or to the data protection authority where you live.

Email privacy@thaidup.app for anything you can't do in the app. We reply within 30 days.

Thai'd Up is for learners aged 13 and over. If you are under 13, please don't create an account. If we learn that we hold data about a child under 13, we delete it. Learners under 20 (the age of majority in Thailand) need a parent or guardian's permission to buy anything.

Data is encrypted in transit. Our database checks every request so each account can only read its own data, and staff access is limited to what their work needs. We never store passwords: you sign in with a one-time code or a passkey, and a passkey's private key never leaves your device. If a data breach puts your rights at risk, we will notify the PDPC within 72 hours and tell you directly when the law requires it.

When we change this policy we update the date at the top. If a change matters to how your data is used, we'll tell you by email or in the app before it takes effect.

Ghost Works Co., LLC, 22656 Esplanada Circle, Boca Raton, FL 33433, USA. Email: privacy@thaidup.app.