Privacy Notice

Data controller

[ชื่อผู้ควบคุมข้อมูล / Controller name], [ที่อยู่ / Address]

Privacy contact: [อีเมลติดต่อ / Contact e-mail]

What we collect

• Account: your e-mail address, and what Google or Facebook shares when you sign in with them (such as your name, profile picture and their user ID).
• Profile: username, display name, bio, language and music interests.
• What you create and do: posts, photos, video links, comments, likes, follows, blocks, clubs, memberships and reports you send.
• Uploaded photos are resized and stripped of EXIF/GPS location data on your device before upload; we do not keep original file names.
• Technical data: IP addresses and request data needed to run the service; used for rate limiting without being stored in our database, and may appear in Cloudflare's system logs for a few days.

Why we use it (legal bases)

• To provide Muskill under the Terms of Use (contract): accounts, profiles, feeds, clubs, discussions.
• To keep the community safe (legitimate interests): spam prevention, rate limiting, reviewing reports, hiding content or suspending accounts that break the rules.
• To send account e-mails such as verification and security notices. We send no marketing e-mail and never sell your data.

Processors and where data is stored

Your data is therefore transferred to and stored outside Thailand (e.g. Singapore). We use providers with internationally recognised data-protection safeguards.

• Supabase — database and sign-in, located in Singapore.
• Cloudflare — serves the website and API on its global network, stores uploaded photos (R2) and stores and encodes uploaded videos (Stream).
• Google and Meta (Facebook) — when you choose to sign in with them.
• An e-mail delivery provider — for verification and security e-mails.

Cookies and embedded videos

• Muskill uses only the cookies needed to keep you signed in — no analytics or advertising cookies.
• Videos and music from YouTube, Vimeo, TikTok, Facebook and Spotify load the provider's player only when you tap play; from then on those providers may use their own cookies and tracking under their policies.
• YouTube, Vimeo and Spotify cover images load from their servers when the card is shown, so your browser contacts those providers.

Who sees your data

• Posts and profiles are public; posts in private clubs are visible to club members only.
• Your block list is visible only to you; who reported something is visible only to Muskill admins.
• Your e-mail is never shown to other users.

How long we keep it

• Account data and content are kept until you delete your account; deletion is immediate (see "Data deletion").
• Database backups expire on our provider's backup schedule.
• Club moderation logs and admin logs are kept for accountability. After deletion they are no longer linked to your account, but admin logs may still contain the username or a short excerpt of the moderated item.

Your rights

• Access, obtain a copy of, and correct your data (edit your profile in Settings).
• Delete your account and data yourself at /settings/account.
• Object to or restrict processing, and receive your data in a readable format (contact us at the e-mail above).
• Complain to Thailand's Personal Data Protection Committee (PDPC) if you believe we break the law.

Age

Muskill is for people aged 13 and over. Users under 20 must have a parent's or guardian's permission.

Changes

If we change this notice materially we will tell you in the app and ask you to accept again before continuing.