Privacy Policy

Last updated: October 2026

Summary: We collect account and profile data, device/push tokens, optional portal credentials, and operational server logs to run the app and send reminders. Optional diagnostic screen-navigation events may be enabled for troubleshooting. We use Supabase, Expo Push, and RevenueCat. In-app Sabai payments are processed by Apple or Google. We do not sell your data. We do not use third-party advertising analytics SDKs (e.g. Firebase Analytics, Amplitude).

Data we collect

• Account: Email, password (handled by Supabase Auth), user ID, timezone, subscription status. If you use Sign in with Google or Sign in with Apple, we receive the email and name you allow those providers to share.
• Immigration profiles: Name, passport number and country, passport expiry, date of birth, visa type and dates, entry date, 90-day report dates, TM30 info, re-entry permit, work permit, profile stage, e-visa application data, planned entry, etc.
• Device and push: Expo push token, device ID, platform (iOS/Android), device name (for reminders and notifications).
• Documents: Files you upload (e.g. passport, visa, receipts) and metadata (category, expiry, tags, notes); stored in Supabase Storage.
• Travel log: Entry/exit dates and locations you record.
• Reminders and notifications: Reminder settings, quiet hours, notification preferences (email/push, digest frequency).
• API access logs (server): For each API request we may log method, path, status, duration, client IP, anonymized user id (JWT subject), and request correlation ids (X-Client-Request-Id / X-Request-Id). Purpose: security, support, and reliability—not advertising.
• Optional diagnostics: When diagnostics are enabled for troubleshooting (a server setting with matching app configuration), we may receive screen route names (e.g. /(tabs)/travel), event type, timestamp, and client request id. No profile names or other PII in these events. Default is off in production until you enable it.
• Sabai (optional):
  • Portal account linking: Encrypted storage of usernames/passwords for Thai immigration portals (e-visa, 90-day, TM30, VFS extension) for in-app browser prefill.
  • Bank balance (e.g. for retirement visa): Account name, bank name, balance, renewal date.
  • Profile groups, check-ins, profile linking (invitations, access grants).

How we use it

To provide the service (tracking, reminders, notifications, document storage, optional portal linking), to record an in-app Sabai subscription after Apple or Google processes the payment, and to communicate with you (email for verification, password reset, invitations, link requests, check-ins).

Storage and third parties

• Supabase: Auth, database (PostgreSQL), file storage; data stored in Supabase's infrastructure.
• Expo Push Notifications: To send push notifications to your devices.
• Apple / Google: Sabai is an in-app subscription. The store processes the payment. ThaiTrack does not receive your card number.
• RevenueCat: Receives the app user id and subscription status so a purchase on one store is recognized on the other. It does not receive your card number.
• Email: Sending transactional email (verification, password reset, invitations, link requests, check-ins) via our server.
• Google / Apple: If you use "Sign in with Google" or "Sign in with Apple," those providers process the sign-in; we receive only what you allow (e.g. email, name).

Security

Passwords and auth by Supabase; sensitive portal credentials encrypted (AES-256-CBC) before storage; HTTPS for all traffic; Row-Level Security (RLS) in the database so users only access their own data.

Your rights

You can access and correct your data in the app. You can delete the account in the app under Settings → Account → Delete account. That removes the login and the profiles, documents, and reminders you own. If you cannot sign in, email support@thaitrack.app from the account address with the subject Account deletion request. We process email requests within 3 days. Details are on the account deletion page.

Data retention

We retain your data while your account is active; you can request account deletion; we may retain some data as required by law or for legitimate purposes (e.g. backups, disputes).

Changes

We may update this policy; we'll post the new version at this URL and update the "Last updated" date; continued use after changes constitutes acceptance.

Contact

For privacy or data requests: support@thaitrack.app.