Privacy Policy

1. Who we are

Gimleng Chat (chat.gimleng.com) is responsible for your personal data under Thailand's Personal Data Protection Act (PDPA). Contact: admin@gimleng.com or Help in the app.

2. What we collect

Account: email address, username, password (stored encrypted by our auth provider) and language. If you sign in with Google, we also receive your Google email, name and profile-picture link.

Profile: profile picture, frames, name colors, medals and Chat Plus status.

Content: messages, reactions, stickers, voice messages, files, room names, descriptions and pictures, and help tickets.

Archive: when a message is edited, unsent or deleted, a copy of the previous version is kept for moderation.

Activity: rooms you join, friends, blocks, read status, active days (for medals), and call records (who called whom, when and how long; calls are not recorded).

Technical: IP address (for security, rate limiting and reports), browser push-notification address if you turn notifications on, and cookies needed to keep you signed in and remember language and theme.

Payments: amount, product, status and payment reference. We never see your bank account or card details.

3. Why we use it

To run the service (accounts, chat, calls, files, notifications), keep it safe (spam and abuse prevention, reports, moderation), deliver paid features, answer help tickets, and meet legal obligations. The legal bases are our contract with you, our legitimate interests in safety, and legal duties.

4. Who processes it

We use these providers to run the service: Supabase (database and sign-in, Singapore), Vercel (hosting, Singapore), Cloudflare (file storage, call relay, captcha and email routing), Upstash (rate limiting), Resend (email), Omise / Opn Payments (payments), Google (sign-in, if you choose it), and your browser's push service (Google, Apple or Mozilla) if notifications are on.

Some providers store data outside Thailand (for example Singapore). We don't sell your data and don't use it for advertising.

5. What others can see

Your username, profile picture, decorations, medals and Plus badge are visible to other users. Messages in public rooms can be seen by anyone, and public room pages may appear in search engines. Private rooms and direct messages are visible only to their members. Admins can access all messages, including private ones and the moderation archive, for moderation and safety.

6. How long we keep it

Uploaded files: deleted automatically when their storage time (1–30 days) ends.

Account data and messages: kept while your account exists.

Moderation archive (edited, unsent and deleted messages): currently kept with no fixed time limit; we plan to set one. You can ask us to delete it.

Payment records: kept as long as tax and accounting laws require.

7. Your rights

Under the PDPA you can ask to access, correct, delete or get a copy of your data, object to or limit its use, and withdraw consent. Account deletion is currently done on request: open a ticket in Help or email us. You can also complain to Thailand's PDPC.

8. Security

Data is sent over HTTPS, access is protected by row-level security, only a few admins have access, and admin actions are logged. No system is perfectly secure; tell us right away if you notice a problem.

9. Changes

We'll update this page and its date when this policy changes.