Privacy policy
Draft: under review by legal counsel; the data controller will be named before public launch.
This policy explains how the website vdopa.com and the game Vdopa: The 333 Rooms (“the game”, “we”) collect, use, disclose and protect your personal data under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA).
1. Data controller
[Name of the person or company acting as data controller — to be stated before launch] Privacy contact: [email protected]
2. Data we collect
| Data | Source | Purpose |
|---|---|---|
| Email, password (stored only as a hash) | Sign-up | Logging in, verification and password-reset emails |
| Display name, profile picture | You, or Google / LINE / Facebook / Apple | Shown in the game and in competitive mode |
| Date of birth | Sign-up | Minimum-age check (13) and privacy settings for minors |
| Google / LINE / Facebook / Apple user ID | When you choose that sign-in method | Linking accounts and logging in |
| Guest account (no email or password) | When you press “Play now as a guest” | Saving progress before you sign up (deleted automatically 30 days after its last session expires) |
| Game progress (puzzles, stars, times, helper use) | While playing | Saving progress and tuning difficulty (aggregated, non-identifying statistics) |
| Device and browser information (user agent) | When you log in | Managing sessions per device, detecting abuse |
| IP address | Every request | Security, rate limiting, cheat prevention |
| Consent records | When you accept terms or choose cookie settings | Proving consent as required by law |
| Contact messages (name, email, message) | Contact form | Answering you |
| Purchase history (item, amount, time, Stripe payment reference) — no card numbers | When you buy in the store | Granting what you bought, receipts, refunds, and accounting/tax law |
What we do not collect: camera and microphone streams in Vdopa Rush go live between players only and are never recorded.
3. Legal bases
- Contract: account and progress data needed to provide the game under the terms of service.
- Legitimate interests: security, cheat prevention and aggregated statistics to improve the game.
- Consent: analytics cookies, personalised advertising, marketing email, and camera/microphone use. You can withdraw consent at any time.
- Legal obligation: records the law requires us to keep.
4. Minors
You must be at least 13 to sign up. Under Thai law, users under 20 are minors; for them we do not carry out consent-based processing: no personalised advertising, no marketing email, and camera and microphone off by default in competitive mode.
5. Recipients
We do not sell your personal data. We may share what is necessary with:
- our hosting and database provider [to be named]
- our email delivery provider [to be named]
- Google (Sign in with Google, Google AdSense, Google Analytics when you consent)
- LINE Corporation (LINE Login)
- Meta Platforms (Facebook Login)
- Apple (Sign in with Apple)
- Stripe (store payments: your email, the amount, and the card/PromptPay details you enter on Stripe’s payment page)
- a video/voice streaming provider for Vdopa Rush (once launched)
- authorities where the law requires it
Some providers may store data outside Thailand; we choose providers with adequate safeguards as required by law.
6. Retention
| Data | Kept for |
|---|---|
| Account and progress | While the account is active |
| Accounts requested for deletion | 30 days (cancellable), then deleted or anonymised |
| Chat messages in competitive mode | 90 days |
| Player-report evidence | 1 year |
| System logs | 90 days |
| Contact messages | 1 year after the case is closed |
| Purchase records | 5 years (Thai accounting and tax law), also after the account is deleted |
7. Your rights
You may request access to and a copy of your data, correction, deletion, restriction or objection, data portability, and you may withdraw consent.
- Download your data instantly on the “My account” screen in the game.
- Delete your account yourself on the “My account” screen.
- Change your name in the game.
- For anything else, email [email protected]; we answer within 30 days.
You may also complain to Thailand’s Personal Data Protection Committee (PDPC).
8. Security
We use encrypted connections (HTTPS), store passwords only as hashes, limit access to people who need it and keep encrypted backups. If a breach puts your rights at risk we will notify the PDPC within 72 hours and inform you without undue delay.
9. Cookies and advertising
The website uses cookies necessary for it to work, and Google analytics and advertising cookies only with your consent. Google may use cookies to serve ads based on your visits to this and other websites; you can manage Google ad settings at adssettings.google.com. See the cookie policy.
10. Changes
If we make important changes we will tell you in the game and ask you to accept the new version. The current version is 2026-10-15.