Privacy Policy

1. Who we are

LearnThai ("we", "our", "us") runs the LearnThai web application and mobile application (together, the "Service") and is responsible for the personal data described here. Contact us at [email protected].

2. Data we collect

• Account: email address, password (stored only as a secure hash), display name. If you sign in with Google, we receive your email address and name from Google; we never receive your Google password.
• Learning progress: lessons started and completed, exercise results, vocabulary review history and schedule, XP, level, streaks, accuracy, study time, daily goal and the date you last studied.
• Subscription: whether you have Premium, your plan and its expiry date. Payment details are handled by Stripe (web) or by Apple or Google (mobile); we never see your card number.
• Streak reminders (optional): your browser’s push address and encryption keys, your time zone, and the last day a reminder was sent.
• Technical data: IP address, browser and device details in server logs; crash reports containing the page, the error and your browser version — never your account details.
• Usage statistics (optional): see section 6.

3. How we use it, and on what legal basis

• Providing the Service (your account, progress sync between devices, Premium content) — necessary to perform our contract with you.
• The leaderboard — our legitimate interest in a motivating learning community; see section 5.
• Streak reminders — your consent, which you give when you turn them on and can withdraw at any time in your Profile or browser settings.
• Security, error fixing and usage statistics — our legitimate interest in a working, secure and improving Service. You can switch statistics off (section 6).
• Accounting and legal obligations — for payment records.

4. Who receives your data

We do not sell or rent your personal data. These service providers process it on our behalf, only for the purposes listed:

• DigitalOcean (hosts our PocketBase database)

  Receives

  Everything in your account: email, display name, learning progress, statistics, subscription status, reminder registrations

  Why

  Storing your account so it works on the web and in the mobile app

  Location

  European Union (Frankfurt)

• Netlify (hosts this website and its server functions)

  Receives

  IP address, browser details and the pages requested; crash reports (no account data)

  Why

  Delivering the website, running payment and reminder functions, fixing errors

  Location

  United States and a global network

• Google

  Receives

  Only if you choose “Continue with Google”: Google confirms your identity and shares your email address and name

  Why

  Signing in

  Location

  United States

• RevenueCat (subscription management)

  Receives

  Your LearnThai account ID (not your name or email), purchase and subscription history, country and currency

  Why

  Selling and managing Premium on the web and in the mobile app

  Location

  United States

• Stripe (payment processing for web purchases, through RevenueCat)

  Receives

  The payment details, email and billing information you enter at checkout, and device information for fraud prevention. Stripe sets fraud-prevention cookies when the checkout opens

  Why

  Taking payments securely — we never see your card number

  Location

  United States and European Union

• Your browser’s push service (e.g. Google for Chrome, Mozilla for Firefox, Apple for Safari)

  Receives

  Only if you turn on streak reminders: a push address for your browser and the encrypted reminder messages

  Why

  Delivering reminders

  Location

  Depends on your browser vendor

• Our analytics provider (Umami or Plausible)

  Receives

  Only if analytics is enabled and you have not opted out: the page path (no query strings), referrer, browser, operating system, device type, country, and the events listed below

  Why

  Understanding which lessons and features are used, to improve them

  Location

  Depends on the provider’s hosting region

• unpkg and jsDelivr (public code CDNs)

  Receives

  Your IP address and browser details when the home-page animation loads its player

  Why

  Showing the animated mascot

  Location

  Global network

In the mobile app, purchases are processed by Apple or Google, and their privacy policies apply to that processing. We may also disclose data when required by law, or to a buyer of the Service in a merger or acquisition (you will be notified).

5. What other learners can see

Signed-in learners can see the leaderboard, which shows your display name, XP, level and streak. Your email address, subscription and other account details are never shown to other learners. Choose a display name you are comfortable sharing; you can change it at any time in your Profile.

6. Usage statistics and cookies

LearnThai does not use advertising or tracking cookies. When usage statistics are enabled, we use a cookie-less analytics provider (Umami or Plausible) that does not store your IP address or build a profile of you. Besides page views (without query strings), we count these events: sign-up, login, paywall viewed, lesson completed (with the lesson ID), purchase started and purchase completed (with the plan ID).

Statistics are never loaded if your browser sends a Do Not Track or Global Privacy Control signal, and you can switch them off at any time under Profile → Settings → Anonymous usage statistics.

Your browser stores what the app needs to work: your sign-in session, a copy of your progress (so lessons work offline), your preferences and, for Premium learners, downloaded lessons. Signing out removes the account-related parts. Stripe sets its own fraud-prevention cookies only when you open the checkout.

7. How long we keep it

• Account and learning data: while your account exists. When you delete your account it is removed from our database immediately.
• Database backups: rotated automatically; deleted data disappears from all backups within 5 weeks.
• Server logs and crash reports: deleted automatically after a short period (days to a few weeks, depending on the provider).
• Subscription records at RevenueCat: deleted when you delete your account.
• Payment records at Stripe, Apple or Google: kept by them for as long as tax and anti-fraud laws require.
• Reminder registrations: until you turn reminders off, your browser revokes them, or you delete your account.

8. Your rights

Wherever you live, you can:

• Get a copy of your data in a machine-readable format: Profile → Download my data.
• Correct it: edit your display name in your Profile, or contact us.
• Delete it: Profile → Delete Account (see data deletion details).
• Object or withdraw consent: switch off usage statistics or streak reminders in your Profile.
• Restrict processing or ask any question: email [email protected]. We answer within 30 days.
• Complain to the data protection authority where you live or work.

9. Security

All traffic is encrypted (HTTPS/TLS), passwords are stored only as secure hashes, access to each learner’s records is restricted to that learner, and payment processing is handled entirely by PCI-certified providers. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

10. International transfers

Our database is hosted in the European Union (Frankfurt). Some providers listed in section 4 are based in, or process data in, the United States or other countries. Those transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

11. Children

The Service is not directed to children under 13 (or 16 in the EEA). We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

12. Changes to this policy

When we change this policy we update the date at the top of this page. We notify you of material changes by email or in the app.