What we collect, and what we don't
The short version
- No ads, no tracking SDKs, no third-party analytics.
- You can play without signing up. The app creates an anonymous account id; your email is stored only if you choose to link it.
- We store your answers, scores, streak and subscription status so the app can pick questions and show your progress.
- Card and payment details stay entirely with Apple or Google. They never reach us.
- Data lives on Supabase in Singapore. You can delete your account in the app; it is purged within 30 days.
990club ("the app", "we") is a TOEIC-style practice app operated by [NAME OF DATA CONTROLLER — individual or legal entity] ("the data controller"). This policy explains how we collect, use, disclose and retain your personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
1. Data we collect
We collect only what the app genuinely needs. This table is the complete list.
| Data | When | Why |
|---|---|---|
| Account id (a random UUID) | First launch | Ties all your progress to one account without knowing who you are |
| Email address | Only if you choose to link your account by email | Signing in again, moving to a new phone, account recovery, and account-related emails (never marketing) |
| Apple identifier (the Apple user identifier and the email Apple passes to us, which may be Apple's private relay address) | Only if you choose "Sign in with Apple" | Signing in and moving devices; preventing the free trial from being restarted with the same identity |
| Study goals — target score, exam date, preferred study time, play-style choices | During first-run setup (editable later) | Initial difficulty, the countdown to your exam, and the on-device reminder time |
| Study data — the option you chose on each question, right or wrong, time spent, daily quests, mock-test results, per-skill statistics, streak, XP, level, predicted score | As you use the app | Picking questions from your weak spots, computing the predicted score, and showing your statistics |
| Subscription status — plan (monthly/annual), status (trial/active/grace/expired), period end, the store's transaction id, and store notifications (renewal, cancellation, refund) | When you subscribe, renew, cancel, or are refunded | Deciding whether the account is entitled. We never receive card numbers, billing addresses or cardholder names |
| Reports — the type and reason you enter | When you report a question or explanation | Reviewing and fixing questions |
| Technical records — a de-duplication key per batch of answers, and the IP address and user agent our infrastructure provider keeps briefly in its logs | Whenever the app talks to the server | Score integrity (no double counting) and system security |
Stays on your device, never sent to us
- Daily reminder time — the study reminder is a local notification scheduled on the phone. This version of the app sends no server push notifications and does not know whether you allowed notifications.
- Today's cached quest, answers queued while offline, and your session token — all gone when you delete the app.
What we do not collect
Location, contacts, photos, microphone, advertising identifiers, card or bank details, the list of other apps on your phone. We do not log taps or in-app behaviour for marketing analysis; everything we know about your usage comes from the study data listed above.
If we ever add server-sent push notifications, the app will need to store a device push token. We will update this policy before switching that on.
2. Legal bases
- Performance of a contract (PDPA s. 24(3)) — account id, study data, study goals and subscription status are what makes the service you use work.
- Legitimate interests (s. 24(5)) — system security, preventing repeat free trials, and improving question quality from aggregate statistics, none of which override your rights.
- Consent — only where we ask for it specifically, such as permission to show notifications, which you can withdraw at any time in your phone's settings.
- Legal obligation (s. 24(6)) — where the law requires us to keep or disclose data.
3. What we never do with your data
- Sell it, rent it, or pass it to advertisers or data brokers.
- Build marketing profiles, or send marketing emails or notifications.
- Make automated decisions with legal effect on you. The predicted score is a study estimate, not an exam result.
4. Where data is stored, and cross-border transfer
All data is stored with Supabase, Inc. in Amazon Web Services' Singapore region (ap-southeast-1). Using the app therefore transfers your personal data outside Thailand under PDPA s. 28. We do so because it is necessary to perform our contract with you, and we chose a provider with appropriate safeguards (encryption in transit and at rest, row-level access control) under its data-processing terms.
This website loads its fonts from Google Fonts, which means your browser sends its IP address to Google under Google's policies. The site sets no cookies and runs no tracking scripts.
5. Who we share data with
| Recipient | Role | Data involved |
|---|---|---|
| Supabase, Inc. (Singapore) | Processor — database, authentication, file storage | Everything in section 1 |
| Apple Inc. / Google LLC | Independent controllers — App Store and Google Play payments, Sign in with Apple | Your subscription purchase and receipts, under Apple's/Google's own policies. We receive only the entitlement status and a transaction id |
| Resend, Inc. | Processor — delivers account emails (from no-reply@games.ploikhong.com) | Your email address, only if you linked by email |
| Authorities or courts | Where the law requires | Only what is legally compelled |
Nobody else.
6. Retention
- While your account exists — we keep everything, including after a trial or subscription lapses, so you can pick up where you left off. Statistics and streaks are not deleted because you stopped paying.
- When you delete your account — the account is closed immediately and can no longer be used. All data is removed from the database within 30 days; system backups rotate out on the provider's backup schedule after that.
- What survives deletion — aggregate question statistics (such as the share of people who answered a question correctly), which are anonymous totals, and store notification records no longer linked to your account, kept as far as needed for accounting.
7. Your rights under the PDPA
You have the following rights, and we will act on a request within 30 days of receiving it.
- Access and copy your personal data (s. 30)
- Portability in a machine-readable format (s. 31)
- Object to processing based on legitimate interests (s. 32)
- Erasure — do it yourself in the app under Settings → Delete account, or see the account deletion page (s. 33)
- Restriction of processing (s. 34)
- Rectification — target score and exam date can be changed in the app (s. 35)
- Withdraw consent at any time, without affecting processing done before withdrawal (s. 19)
- Complain to Thailand's Personal Data Protection Committee (PDPC) if you believe we are not complying with the law
Send requests to admin@games.ploikhong.com. If your account is linked to an email address, please write from that address so we can verify you own the account. An account that has not been linked to an email or Apple identity contains nothing that identifies you, so requests about such an account can only be made from inside the app.
8. Security
All connections are encrypted with TLS, the database is encrypted at rest, each account can only reach its own rows through database-level access control, and the question bank with its answer keys is reachable only through server functions. We store no passwords (email sign-in uses a verification link, not a password) and never see payment details. No system is perfectly secure; if a breach puts you at risk we will notify the PDPC within 72 hours and notify you as the law requires.
9. Children
The app is not directed at children under 13 and we do not knowingly collect data from children under 13. Minors should use the app with the consent of a parent or guardian as PDPA s. 20 requires. If we learn that we have collected a child's data without the legally required consent, we will delete it. Parents with concerns can contact us at the address above.
10. Changes to this policy
When we change this policy we publish the new version on this page with its effective date. For material changes — a new type of data, or a new recipient — we will tell you in the app before the change takes effect.
11. Contact
Data controller: [NAME OF INDIVIDUAL OR LEGAL ENTITY]
Address: [LEGAL CONTACT ADDRESS]
Email: admin@games.ploikhong.com