Privacy Policy

Privacy Policy

Last updated Oct 24, 2026

This policy explains how toonyin collects, uses and discloses your personal data under the Personal Data Protection Act B.E. 2562 (PDPA).

1. Data we collect

  • Google account data when you sign in: email, name and profile picture.
  • In-app profile: display name, chosen picture and settings.
  • Usage data: watch history, resume positions, saved series, likes, comments and unlocked episodes.
  • Transaction data: orders, coin history and the payment slip images you upload.
  • Device and event data such as browser type, language and button taps (only when you consent to analytics).
  • Notification data: the Web Push endpoint when you turn notifications on.

2. Why we use it

  • To provide the service, identify you and keep your history when you change device.
  • To process coin purchases, verify slips, prevent fraud and keep accounting records.
  • To show comments, moderate content and comply with the law.
  • To send the notifications you choose, such as new episodes and replies.
  • To analyse and improve the service and measure advertising, only with your consent.

3. Consent and cookies

Cookies required for the service to work (session, language, theme) are used without consent. Analytics and marketing/advertising (such as ad pixels) run only if you allow them. You can change your mind at any time in Settings > Privacy.

4. Processors and disclosure

We use outside providers to run the service and share only what is necessary:

  • Cloudflare: infrastructure, database, file storage and bot protection (Turnstile).
  • Google: sign-in with a Google account.
  • EasySlip: payment slip verification (slip image and amount).
  • Sentry: system error logs.
  • Advertising platforms: only when you consent to marketing and advertising.

5. Retention

  • Payment slip images: at most 180 days, then deleted automatically.
  • Transaction and coin ledger records: kept for accounting and tax duties, with no link to personal data after you delete your account.
  • Visitor accounts with no activity and no coins for 180 days: deleted automatically.
  • Inbox notifications: 60 days.
  • After you delete your account: personal data is deleted or anonymised immediately and permanently removed within 30 days.

6. Your rights

You may request access, a copy, correction, deletion, restriction or objection, withdraw consent, and request portability. You can edit your name and picture in Edit profile, delete your account in Settings, and request a data export through the team on LINE (handled manually at first).

If you believe we do not comply with the law, you may complain to the Personal Data Protection Committee Office.

7. Security

We use encryption in transit, restricted internal access and private storage for payment slips that only authorised staff can open. No system is perfectly secure; tell us immediately if you suspect someone else is using your account.

8. Minors

The service is for people aged 13 and over. We do not knowingly collect data of children under 13 and will delete it if we find any.

9. Contact

To exercise your rights or ask about personal data, use Me > Contact the team (LINE). We will reply within a reasonable time.