1. Data We Collect and Legal Basis (PDPA)
| Data Category | Legal Basis | Purpose & Notes |
|---|---|---|
| Account, phone number, birthdate | Contractual necessity | Create your account, prevent duplicate/bot accounts, and verify 18+ age (only your age is shown, never your birthdate). |
| Nickname, profile details, photos, prompts | Contractual necessity | Shown to matches according to the photo reveal stage you reach together. |
| Face data (Selfie Liveness) | Explicit consent (PDPA Sec. 26) | Verify you are a real person during onboarding. Video is deleted within 30 days; only pass/fail status is kept. |
| Selected area / rough distance | Contract / Consent | Filter nearby Space posts and Daily Drops without storing exact GPS coordinates or showing maps. |
| Space posts and chat messages | Contractual necessity | Deliver core app features (other users never receive the author’s user_id in Space). |
| Abuse reports & security logs | Legitimate interest / Legal obligation | Keep the community safe, prevent fraud, and comply with applicable laws. |
2. Biometric Data & Selfie Liveness Processing
- We ask for explicit, separate consent before starting Selfie Liveness verification to keep fake accounts out.
- Face video/frames are used strictly to verify liveness and may be processed via secure cloud infrastructure outside Thailand (such as the Asia-Pacific / Tokyo region).
- Liveness video recordings are permanently deleted within 30 days. We retain only the verification result and timestamp.
3. Who Can See What
- Space post authors: Other users never see your real identity (only your alias). Moderators can reveal an author’s identity only when investigating a serious rule violation report or complying with a legal order, and every reveal is permanently audit-logged.
- Phone number, email, and birthdate: Never shown to other users.
- Profile photos: Stored in a private bucket and served via short-lived signed URLs only according to your conversation’s reveal stage.
- University / workplace badge (optional): Only the organization name or domain is stored and displayed — never your full work/student email address.
4. Data Retention Schedule
| Data | Retention Period | Afterward |
|---|---|---|
| Selfie Liveness video | Up to 30 days | Automatically deleted from storage |
| Deleted Space posts | Hidden immediately; kept up to 30 days | Permanently purged |
| Chats from expired/closed matches | 90 days (for safety/report review) | Permanently purged |
| Waitlist email entries | Until launch or unsubscribe | Deleted upon withdrawal |
5. Your Rights Under PDPA
- You can access, export, update, withdraw consent, or delete your account directly from the in-app Settings menu.
- When you delete your account, your profile and photos are removed immediately and associated data is purged within 30 days, except where retention is required by law or for severe abuse investigations.
Questions about safety or personal data:support@rukan.app