Account data
If you create an account in the app, your email, password (handled by Supabase, never seen by us in plain text), and onboarding answers (country, situation, arrival status, goals) are stored so your plan can be saved and reloaded.
Payment data
Payments are processed entirely by Stripe. We never see or store your card details — only that a subscription exists, its plan, and its status.
Contact form and CRM
Submitting the contact form, creating an account, or subscribing sends your name, email, and message to our CRM (Santati) so we can respond and keep a record of the relationship. It is not sold or shared with unrelated third parties.
Cookies and analytics
We use a first-party analytics script ("Wisp") to understand page views, clicks, and form activity on our own domain — no third-party ad trackers, no cross-site tracking, no fingerprinting. It only runs if you accept optional analytics in the cookie banner; choosing "Essential only" keeps it fully inactive. You can change your choice anytime via the "Cookie preferences" link in the footer.
Ask Chang Deng
Questions you send to Chang Deng may be processed together with your MyThai profile, relevant itinerary context and remembered preferences to generate a relevant answer. Avoid putting passwords, payment-card details, passport numbers, medical records or other secrets into a question.
Recommendations and outbound links
When you are signed in, Thai'd Down may record that you opened a provider or recommendation link, together with the recommendation, trip and destination context. We use this to understand what is useful, improve recommendations and measure referrals. A commercial partner relationship does not guarantee ranking or recommendation.
Secure Travel Vault
Sensitive Vault values are encrypted on your device using a non-exportable device key. Vault contents do not sync between devices. Labels, categories and notes may remain readable on the device, so do not put secrets in those fields.
Your choices
You can decline optional analytics at any time, ask us to delete your account and data, or ask what we hold on you, through the contact form.