Privacy Policy

1. Introduction

Welcome to Phayan (“we,” “our,” or “us”). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Thai alphabet learning service (the “Service”).

By using Phayan, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Personal Information You Provide

When you register for and use our Service, we collect:

• Account Information: Email address, password (hashed), and display name
• Profile Information: Optional avatar/profile picture
• Waitlist Email: If you join the Premium waitlist, we store the email address you provide to notify you when Premium launches
• Feedback: If you submit feedback or bug reports through the Service, we collect the content you provide along with the page URL and your browser user agent

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the Service
• Device Information: Browser type, operating system, device identifiers
• Cookies and Similar Technologies: Authentication tokens, preferences, GDPR region detection, and analytics data
• IP Address: For security, fraud prevention, and GDPR region detection
• Analytics Data: We use PostHog (product analytics), Google Analytics (GA4), and Google Ads conversion tracking to collect usage statistics and measure advertising effectiveness. When enabled, this may include page views, events, and identifiers associated with your session. In GDPR regions, analytics cookies are only set after you provide consent.
• Advertising Data: We use Meta (Facebook) Pixel to measure advertising effectiveness and understand how users interact with our Service. In GDPR regions, the pixel only tracks after you provide consent.

2.3 Learning Progress Data

When you use the lessons, we collect and store:

• Progress: Which levels and rounds you have completed, and which letters and words you have learned
• Answers: Your drill and typing answers, including tone identification results, used to compute your tone accuracy
• Spaced-Repetition State: The review schedule for each letter and word you are learning, including mastery status
• Sync Metadata: A version marker on your progress tree so your devices can merge cleanly

This data is what makes the Service work: the due queue, the tone statistics, and your level unlocks all come from it. It is tied to your account and is included in your data export.

2.4 Error Monitoring Data

We use Sentry to monitor errors and performance issues. When an error occurs, Sentry may collect:

• Error messages and stack traces
• Browser type, operating system, and device information
• Page URL where the error occurred
• Session replays (with all text masked and media blocked) to help reproduce and fix bugs

3. How We Use Your Information

We use the information we collect to:

• Provide the Service: Create and manage your account, store your learning progress, and run the review queue
• Process Payments: Handle subscription payments through Stripe
• Send Emails: Transactional messages (password reset links, account notifications, and billing notices). We do not run a marketing newsletter and never send third-party advertising.
• Improve the Service: Analyze usage patterns, fix bugs, and develop new features
• Security: Prevent fraud, abuse, and unauthorized access using reCAPTCHA, rate limiting, and CSRF protection
• Analytics: Understand how our Service is used via Google Analytics and Meta Pixel to improve user experience and measure advertising effectiveness
• Error Monitoring: Identify and fix bugs and performance issues using Sentry
• Legal Compliance: Comply with applicable laws and regulations

4. Information Sharing and Disclosure

4.1 Service Providers

We share information with trusted third-party service providers who assist us in operating our Service:

Payment Processing

• Stripe: Processes all payments securely. We do not store your credit card details. (Subject to Stripe's Privacy Policy)

In-App Purchases (iOS & Android)

• RevenueCat: Manages in-app subscriptions purchased through the Apple App Store or Google Play. Receives a pseudonymous app user ID and purchase receipt details to validate and restore your subscription. The underlying payment is handled by Apple or Google, not by Phayan. (Subject to RevenueCat's Privacy Policy)

Analytics & Advertising

• PostHog: Product analytics that help us understand how the Service is used and improve it. Processed in the United States. (Subject to PostHog's Privacy Policy)
• Google Analytics (GA4): Collects usage data to help us improve the Service. (Subject to Google's Privacy Policy)
• Google Ads: Measures advertising effectiveness and conversion tracking. (Subject to Google's Privacy Policy)
• Meta (Facebook) Pixel: Measures advertising effectiveness. In GDPR regions, tracking only occurs after consent is granted. (Subject to Meta's Privacy Policy)

Security & Monitoring

• Google reCAPTCHA: Protects against spam and abuse during registration, login, and password reset. (Subject to Google's Privacy Policy and Terms of Service)
• Sentry: Monitors errors and performance. May collect error details, browser information, and anonymized session replays. (Subject to Sentry's Privacy Policy)

Authentication

• Google Sign-In: Optional authentication method. (Subject to Google's Privacy Policy)
• Apple Sign-In: Optional authentication method. (Subject to Apple's Privacy Policy)

Email Services

• Resend: Delivers our emails — transactional messages (password reset and account notifications). We do not send third-party advertising. (Subject to Resend's Privacy Policy)

Infrastructure & Hosting

• Cloudflare R2: Stores uploaded files, including avatars and exported assets. (Subject to Cloudflare's Privacy Policy)
• MongoDB Atlas: Cloud database that stores your account and learning progress data. (Subject to MongoDB's Privacy Policy)
• Railway: Hosts our web application and API server. (Subject to Railway's Privacy Policy)

4.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Requests from law enforcement or government authorities
• Protection of our rights, property, or safety
• Prevention of fraud or security threats

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

5. We Do Not Sell Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We only share data with service providers as described above, who are contractually obligated to protect your information and use it only for the purposes we specify.

We do not use your learning progress or account data for advertising or for training AI models. Your answers, your review queue, and your account stay yours.

6. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit (HTTPS/TLS)
• Password hashing using bcrypt
• Secure httpOnly authentication cookies
• CSRF protection on all state-changing requests
• Rate limiting to prevent abuse
• Content Security Policy (CSP), HSTS, and other security headers to protect against common web attacks

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Your Rights and Choices

7.1 Access and Correction

You can access and update your account information at any time through your account settings, including your display name, avatar, and password.

7.2 Data Deletion

You can delete your account at any time through your account settings. Upon deletion, all your data is permanently and immediately removed from our systems, including your account, learning progress, and review queue. This action is irreversible.

7.3 Data Portability

You can export your data at any time through your account settings. The export includes your account information and your learning progress data in a machine-readable JSON format.

7.4 Cookies

You can manage your cookie preferences through our cookie consent banner or the Cookie Preferences page. You can also control cookies through your browser settings. Note that disabling essential cookies may affect the functionality of the Service. See our Cookie Policy for more details.

8. Learning Data & Audio

Your learning data — completed rounds, drill answers, tone statistics, and the spaced-repetition queue — is stored on your account and synced between your devices when you sign in. It is never published, never shared with other learners, and never used to personalize content beyond your own review schedule.

The audio you hear in the app — letter and word recordings — is served from our content library, which combines openly licensed recordings with synthesized speech. Playing audio does not transmit anything about you beyond the file requested.

Your progress works offline in the browser and merges when you reconnect; the merge is per-round and keeps the highest completion state on each item.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. Our application is hosted on Railway and our database on MongoDB Atlas; uploaded files are stored on Cloudflare R2. The specific storage regions of the production deployment are published here when the deployment is finalized. Some service providers also process limited data in the US (PostHog, RevenueCat, Resend, and Google Analytics).

For users in the European Economic Area (EEA), we ensure appropriate safeguards are in place for international data transfers in compliance with GDPR.

10. Children's Privacy

Our Service is not intended for children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at [email protected].

11. Region-Specific Rights

11.1 GDPR (European Economic Area, UK, Switzerland)

If you are located in the EEA, UK, or Switzerland, you have additional rights under GDPR:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

Legal basis for processing: We process your personal data based on: (a) contract performance - to provide the Service you requested; (b) consent - for analytics cookies and advertising tracking; (c) legitimate interests - to improve our Service, prevent fraud, and ensure security; (d) legal obligation - to comply with applicable laws.

For more information about your GDPR rights, see our GDPR Compliance page.

11.2 CCPA/CPRA (California)

If you are a California resident, you have rights under the California Consumer Privacy Act:

• Right to know what personal information is collected
• Right to know if personal information is sold or shared
• Right to opt-out of the sale of personal information (we do not sell your information)
• Right to deletion of personal information
• Right to non-discrimination for exercising your rights

We do not respond to Do Not Track (DNT) browser signals at this time.

12. Data Retention

We retain your information for as long as:

• Your account is active
• Needed to provide you the Service
• Required to comply with legal obligations
• Necessary to resolve disputes or enforce agreements

When you delete your account, all associated data is permanently removed immediately, including your learning progress, review queue, and user account.

13. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new Privacy Policy on this page
• Updating the “Last Updated” date

Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us: