Privacy Policy

Who we are

Thai Script Master is an interactive Thai-language learning web app operated by an individual developer. Throughout this policy, “we”, “us”, and “our” refer to the operator. The service is reachable at www.thaiscriptmaster.com.

Information we collect

You provide directly

• Account information. When you sign up with email and password, we store your email address and a salted password hash (handled by our auth provider, Supabase).
• Social sign-in. When you sign in with Google or Facebook, we receive your name, email, and profile picture from that provider. We do not receive your password.
• Learning data. Lessons completed, drill answers, streaks, spaced-repetition state, settings, and any notes or custom lists you create.
• Optional signup answers. On the “About you” step of setup we ask two optional questions: whether you live in, visit, or have not yet been to Thailand, and how you found the site. If you answer “a language school” or “a tutor” you may also name which one, in up to 80 characters. Every one of these is optional and skippable, none of them is ever shown publicly, the school or tutor name is never included in any total or chart, and we do not ask at all if you have opted out of analytics — that step is not shown to you.
• Feedback you send. If you use the Feedback link we store what you write, whether you consented to it being shown publicly, the display name you chose (never your email address), the page you were on, and your browser’s user-agent string. Nothing is published until a person reads it, nothing is published without your consent, and you can withdraw that consent at any time.

Collected automatically

• Anonymous identifier. Even before you sign in we generate a random ID stored in your browser so we can attribute learning activity to a single visitor. This is not linked to your real identity until you create an account.
• Usage and product analytics. Page views, button clicks, lesson completions, drill outcomes, error events, and similar events; the page URL; rough device class (mobile vs desktop); and a coarse country-level location derived from your IP address. We do not store full IP addresses.
• Technical data. Browser type and version, screen size, language, referrer URL, and timestamps.

How we use your information

• To provide the learning app and sync your progress across devices.
• To improve content, fix bugs, and measure which lessons work.
• To prevent abuse and keep the service secure.
• To send transactional email (account confirmation, password reset). We do not send marketing email.

We do not sell your personal information. We do not run third-party advertising on the site, and we do not allow advertising trackers to load by default — under Google’s Consent Mode v2 our default is ad_storage: denied, ad_user_data: denied, ad_personalization: denied.

Third-party services we use

Some processing happens on our behalf by service providers. They only see the data they need to do their job.

• Supabase — authentication, database, and file storage.
• Vercel — application hosting, edge networking, and Vercel Analytics.
• Google Cloud Text-to-Speech (Chirp 3 HD) — Thai audio generation. Generated audio is cached on our servers; your identity is not sent to Google with these requests.
• Google Analytics 4 — aggregate product usage metrics. IP addresses are anonymized before storage.
• Microsoft Clarity — anonymized session replay and heatmaps to debug UI issues. Clarity automatically masks text inputs and sensitive form fields.
• Google and Meta (Facebook) — only when you choose to sign in with their respective accounts; they confirm your identity to us.

Cookies and similar technologies

We use a small number of first-party cookies and localStorage entries:

• Authentication cookies set by Supabase to keep you signed in.
• Preferences stored locally — dark mode, romanization choice, audio settings, dismissed prompts.
• Anonymous analytics ID stored locally so that repeat visits from the same browser are counted as one visitor.
• A submission cookie (ts_visitor), set only if you send feedback or answer a signup question without an account. It holds one random value, it is not readable by scripts on the page, it is never joined to analytics and it is never sent to anyone else. Its whole purpose is so that the message you sent is provably yours and can be withdrawn or erased from this browser without you having to create an account.

You can clear these at any time through your browser. Doing so will sign you out and reset locally stored learning progress that has not been synced to your account. Clearing the submission cookie also gives up the one-press erasure above — email works instead, and still needs no account.

Your choices

• Opt out of analytics. Settings → Privacy lets you switch off product-analytics collection for your account. The flag is stored on your profile and respected on every device you sign in from.
• Sign out. Sign out at any time from Settings. Your locally stored progress remains on the device unless you explicitly clear it.
• Delete your account. Email pjeide@gmail.com from your account email and we will delete your account and associated data within thirty (30) days. Cached audio files keyed only on the Thai phrase (and shared across users) are retained.
• Erase what you sent without an account. Feedback and the optional signup answers are collected from visitors who have no account, so deleting them must not require making one. Data Deletioncarries a control that erases what you sent from the browser you are reading this in — the messages, anything of yours shown on the homepage, and your signup answers including any school or tutor name — immediately and without signing in. It is authorised by a server-set cookie for that browser, not by anything you type, so it can only ever reach your own submissions. Anything sent from another browser goes by email, and you still do not need an account for that.
• Access and correction. You can request a copy of the personal data we hold about you, or ask us to correct it, by emailing the address above.

Data retention

We keep account and learning data for as long as your account exists. Analytics events are retained for up to twenty-four (24) months, after which they are aggregated or deleted. Backups are retained for thirty (30) days.

Security

We use industry-standard transport encryption (TLS) and rely on our auth provider for password hashing and session management. No online service is perfectly secure; if we become aware of a breach affecting your data we will notify you without undue delay.

International transfers

Our service providers store data in the United States and other countries. By using the service you consent to your information being transferred to and processed in those countries.

Children

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

Regional rights

EEA / UK residents: you have rights under the GDPR to access, rectify, erase, restrict, port, or object to the processing of your personal data. The legal basis for our processing is contract performance (running the app you signed up for) and our legitimate interest in improving the service.

California residents: the CCPA gives you rights to know, delete, and opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be announced in-app or by email.

Contact

Questions, requests, or complaints: pjeide@gmail.com.