Privacy Policy

ThaiYHub is the data controller for the Sites. For any question or request about your personal data, contact us at thaiyhub@gmail.com.

When you create an account or sign in:

• Your email address and, if you sign up with email, your password stored only as a secure one-way hash. We never see or store the password itself.
• If you sign in with Google: your name, email address and profile photo from your Google account.
• Sign-in records kept by our sign-in provider for security, such as when you signed in and from which IP address.

When you contribute:

• The series, cast, pairs, images and edits you submit, and a history of who changed what and when.
• Your display name and profile photo, shown publicly as a contributor credit on the series you've helped with. Accounts without a name are shown as "A contributor". Your email address is never shown.

When you visit the Sites:

• Cookies that keep you signed in. We don't use advertising or tracking cookies.
• Anonymous visit statistics (pages viewed, the site that sent you, country, and device and browser type) and page loading speed. These are collected without cookies and don't identify you.
• Error reports when something breaks: the error, the page address, and the browser and device type. They don't include your IP address or cookies.
• Drafts of forms you haven't sent yet, kept only in your own browser so you don't lose your work.
• Technical logs kept briefly by our hosting provider, such as IP addresses and the pages requested, for security and troubleshooting.

• To run your account and let you contribute (needed to provide the service you asked for — PDPA section 24(3)).
• To credit contributors, review submissions and keep the information accurate (our legitimate interest in running a reliable, fan-built database — section 24(5)).
• To keep the Sites secure, prevent spam and abuse, and fix errors (legitimate interest).
• To understand which pages are useful and keep the Sites fast (legitimate interest, using anonymous statistics only).
• To send emails you need, such as sign-up codes and password resets (needed to provide the service).
• To comply with the law and lawful requests from authorities (legal obligation — section 24(6)).

We don't sell your personal data, show ads, or use your data for marketing.

Without an email address you can't create an account, but you can still use everything else on the Sites.

We use trusted service providers to run the Sites. They process data only on our behalf, under their data protection terms:

• Supabase — database, sign-in and image storage (servers in Singapore).
• Vercel — hosting, anonymous visit statistics and speed measurements (servers in Singapore, with a worldwide delivery network).
• Google — sign-in, only if you choose "Continue with Google".
• Sentry — error reports (servers in the United States).
• Our email delivery provider — to send sign-up codes and password-reset emails.

Your display name, profile photo and contributions are public on the Sites. We may also disclose data when the law requires it, or to protect the rights and safety of our users or others.

Our providers store data in Singapore, the United States and other countries. When personal data is sent abroad, we rely on our providers' data protection safeguards, such as standard contractual clauses, as the PDPA requires.

• Account data: for as long as you have an account. If you ask us to delete it, we do so within 30 days.
• Contributions: series information is shared by the whole fan community, so it stays on the Sites after your account is deleted. Your name and photo are removed from it, and the change history keeps only an anonymous account number.
• Error reports: deleted automatically within 90 days.
• Hosting and sign-in logs: kept for a short time, as set by our providers.
• Visit statistics: kept only as anonymous totals.

Under the PDPA, you have the right to:

• access and get a copy of your personal data, and know how we got it;
• receive your data in a common electronic format, or have it sent to another service;
• correct data that's wrong or incomplete;
• have your data or your account deleted;
• have the use of your data restricted;
• object to how we collect, use or disclose your data; and
• withdraw any consent you've given, at any time.

To use any of these rights, email thaiyhub@gmail.com from the address you use on the Sites. We'll reply within 30 days. If you think we've mishandled your data, you can also complain to the Office of the Personal Data Protection Committee (PDPC).

We only use the cookies needed to keep you signed in. They're set when you sign in and removed when you sign out. Visit statistics and speed measurements don't use cookies.

Form drafts are kept in your browser's storage on your own device. Clearing your browser data removes them.

All connections to the Sites are encrypted (HTTPS), access to the database is restricted, passwords are stored only as secure hashes, and only the team running the Sites can see account data. No system is perfectly secure: if a breach ever puts your data at risk, we'll tell you and the authorities as the law requires.

The Sites are for a general audience. You should be at least 13 to create an account, and if you're under 20, please ask a parent or guardian before signing up. If you believe a child has given us personal data without permission, contact us and we'll delete it.

We may update this policy. The date at the top shows when it last changed, and we'll post a notice on the Sites about important changes.

ThaiYHub — email: thaiyhub@gmail.com