Privacy Policy
The policy version above is the version the app records when you accept this policy. It changes only when this policy or the Terms change materially, and the app then asks every Adult to accept again. Wording fixes keep the same version.
1. Who we are
DekDaiDao (เด็กได้ดาว) is a stars-and-rewards app for families, at app.dekdaidao.com and dekdaidao.com. It is a personal, non-commercial prototype.
The data controller under the Thai Personal Data Protection Act B.E. 2562 (2019) ("PDPA") is [owner's full legal name], an individual, who runs DekDaiDao personally ("we", "us").
Contact for anything about your personal data: privacy@dekdaidao.com. General contact: contact@dekdaidao.com.
2. Words we use
- Adult: a person who signs in to the app. Each Adult belongs to one Family and has a role: Owner, Parent or Caregiver.
- Kid: a child's profile that an Adult creates. A Kid is not an account and never signs in.
- Ledger: the history of Stars given, taken away (Oops) and spent (Redeem) for each Kid.
3. What we collect
About Adults
- Email address and sign-in provider (Google or email link), and a technical account ID.
- The display name you choose (for example "Mom" or "ยาย"). When you sign in with Google we use the name on your Google account only to prefill this field.
- Your role in the Family, when you joined, your language, and the day you last opened the app while signed in (recorded at most once a day; we use it for retention, §7).
- Your consent record: when you accepted, which policy version, and which wording (parent or legal guardian, or invited Adult).
About the Family
- Family name, timezone and, if you set one, a salted hash of the 4-digit PIN (we never store the PIN itself).
- The Family's Deeds, Oopses and Rewards (labels, icons, Star values).
- Invites: role, who created them, expiry, and who used them.
About Kids (entered by an Adult, never by the Kid)
- First name or nickname, a chosen animal avatar and a color.
- Star Balance and an optional Goal.
- Ledger entries: what was given, oopsed or redeemed, how many Stars, when, and the display name of the Adult who did it.
We do not collect Kids' photos, birth dates, email addresses, location or contact details, and Kids never have accounts.
Technical data
- Error reports from the app (for example a crash message and app version), sent without Kid names or Item labels.
- Our hosting and database provider keeps short-lived server logs, which may include IP addresses and browser details, for security and operation.
4. Why we use it, and on what basis
| Purpose | Data | Legal basis (PDPA) [confirm] |
|---|---|---|
| Create your account and sign you in | email, sign-in provider, account ID | contract (s. 24(3)) |
| Run the app for your Family: Kids, Stars, history, sharing with other Adults | Family, Kid and Ledger data, display names, roles | contract (s. 24(3)); for Kids' data, the consent of the parent or legal guardian who adds them (s. 19, s. 20) |
| Record your acceptance of this policy and the Terms | consent record | legal obligation and legitimate interest (s. 24(5), (6)) |
| Keep the service secure and fix bugs | error reports, server logs | legitimate interest (s. 24(5)) |
| Delete inactive accounts and warn you first | email, last-active day | legitimate interest (s. 24(5)) |
We do not sell personal data, show ads, profile you, or use analytics or tracking tools.
5. Who processes it for us
We use these service providers (processors). They process data only on our instructions.
| Processor | What for | Data |
|---|---|---|
| Google (Firebase and Google Cloud) | website and app hosting, sign-in, database, server functions, error logs | all data in §3 |
| Resend | sending the warning emails before an inactive account is deleted | your email address and display name, and for an Owner the name of the future Owner |
| Cloudflare | domain name and DNS | DNS queries |
| Fastmail | receiving email sent to privacy@ and contact@ | the content of emails you send us |
Google sign-in. If you choose "Sign in with Google", your browser goes to Google (accounts.google.com), and when you come back the app loads a script from apis.google.com to finish signing you in. Google then processes your data under its own privacy policy. The app loads that script only when you return from a Google sign-in, never on a normal start. Signing in with an email link sends no request to Google or any other third party.
Apart from Google sign-in, the app makes no request to third-party websites: no analytics, ads, social media buttons or external fonts.
We do not share personal data with anyone else unless the law requires it.
6. Where it is stored
Family data is stored by Google Cloud in the asia-southeast1 (Singapore) region. Some processors may handle data in other countries (Resend [United States — confirm], Cloudflare [global network]). [Lawyer: describe the safeguards for transfers outside Thailand under PDPA s. 28–29.]
7. How long we keep it
- Your data stays while your account is active.
- Inactive accounts: if you do not open the app while signed in for 24 months, we delete your account. We email you 30 days and 7 days before. Opening the email does not count; opening the app does.
- If an inactive Owner's Family still has an active Parent, the most recently active Parent becomes Owner first; the warning emails name them.
- A Family and all its Kids and history are deleted only when every Adult in it is inactive.
- When an Adult leaves or is deleted, their display name stays on the history entries they made, so the Family's history still reads correctly.
- Server logs and error reports are kept for [Google Cloud default retention — confirm, e.g. 30 days].
- Deleted data may remain in provider backups for [period — confirm] before it is overwritten.
8. Your rights
Under the PDPA you can ask to access, get a copy of, correct, delete, restrict, or object to the use of your personal data, and to move it to another service. Where we rely on consent, you can withdraw it at any time; this does not affect what we did before.
Many of these you can do yourself in the app (Settings):
- Export: Owners and Parents can download the whole Family's data as a JSON file.
- Correct: edit your display name, Kids, and Items.
- Delete a Kid: removes the Kid and all their history.
- Clear history: removes a Kid's history and keeps their Balance.
- Delete your account: immediate. An Owner must first transfer ownership or delete the Family for everyone.
- Sign out everywhere: ends your sessions on all devices.
For anything else, write to privacy@dekdaidao.com. We answer within [30 days — confirm]. You can also complain to the Office of the Personal Data Protection Committee (PDPC), Thailand.
Kids' data. A Kid's data is controlled by the Family's Owner and Parents, who are responsible for it. A parent or legal guardian of a Kid can exercise the Kid's rights by deleting the Kid in the app or by writing to us.
9. Children
DekDaiDao is used by Adults about their children. Children do not sign in or create accounts. Only a parent or legal guardian may create a Family and add Kids, and confirms this when accepting this policy. An Adult invited by the Owner (for example a grandparent or nanny) joins with the Owner's permission.
10. Storage on your device
The app stores only what it needs to work: your sign-in session, an offline copy of your Family's data so it works without a connection, and preferences such as language, theme and sound. These are strictly necessary, so we do not show a cookie banner. Signing out removes your session; [confirm whether signing out also clears the offline copy].
11. Security
Access is limited by security rules so that only Adults in a Family can read or change its data. Connections use HTTPS, and the sites use a strict Content Security Policy. The Kid view PIN is a child lock, not a security measure. No system is perfectly secure; if a breach affects your data, we will notify you and the PDPC as the PDPA requires.
12. Changes
If we change this policy materially, we change its version, and the app asks you to accept the new version before you continue. Small wording fixes keep the version. Past versions are available on request.