Privacy

Sabai Thai - Privacy Policy

Effective 13 September 2026

Sabai Thai ("we", "us") is a Thai language-learning app. This policy explains what we collect, why, and the choices you have. We keep it short and plain.

Who is responsible

Sabai Thai is run by Robin Volkers, Engelenland 19, 6932 PC Westervoort, the Netherlands. He is the data controller for everything described below, which means he decides what is collected and why. Reach him at support@sabai-thai.app.

Information we collect

• Account: when you sign up, we store your email address and, if you use Google Sign-In, the basic profile Google returns. Authentication is handled by Supabase.
• Learning data: your display name, learning goal, lesson progress, XP, streak, and achievements are stored in your account so they sync across devices.
• Notifications: if you enable reminders, we store a device push token (via Firebase Cloud Messaging) so we can send them. Turning reminders off stops us sending to it; the token is deleted when you delete your account.
• On-device only: your settings (sound, romanization, question types, known words, gems and other in-app items) live on your device and are not uploaded.

Microphone and speech

Speaking is scored the same way wherever you do it, in a lesson's pronunciation question or in Shadowing.

• Your take is recorded and sent to our server, which passes it to Google Cloud Speech-to-Text to be written out so it can be scored. We do not keep the recording or the text: the score comes back and the audio is gone.
• If that is not possible, because you are offline or did not give the microphone permission, the attempt is scored by your phone's own speech recognition instead. We never receive that audio, though depending on your device Android may process it on Google's servers rather than on the phone. You can refuse the microphone and still use every exercise.
• A copy of each take stays on your own device, with its score and the time it was recorded, so you can hear yourself improve. It is only sent again if you ask for an ungraded take to be scored, and you can delete any of it from Your takes in Shadowing.

How we use it, and on what basis

To run the app: sign you in, save and sync your progress, and send the reminders you asked for. We do not sell your personal data or use it for advertising.

• Your account, progress and purchases: to provide the app you signed up for (performance of a contract).
• Reminders, analytics, crash reporting and the AI companion: only if you switch them on or use them (consent). You can withdraw at any time in Settings.
• Daily message counts, abuse limits and moderation: to keep the app working and affordable for everyone (legitimate interests).
• Reporting a question: if you flag a lesson question, the question, your reason and any comment you type are emailed to the maintainer once a day so it can be fixed. Your name is not attached (legitimate interests).

What other people can see

Some parts of the app are social, and your display name and level are visible to other learners there: the weekly league table, the friends leaderboard, practice rooms you join, and anything you post in the community. Your email address is never shown. If you would rather not be recognisable, change your display name in Profile.

Analytics and crash reporting

Crash reports and Share Usage Statistics are separate choices, both off by default in onboarding and Settings. Crash reporting uses Sentry to help fix bugs. Crash reports include the screens you visited and what you tapped shortly before the error, so they are not fully anonymous. You can turn this off at any time.

Share Usage Statistics uses Firebase for limited app events and sends structured lesson, answer-choice, game, shop, companion, navigation, reminder choices, return prompts, app version, and Thai Moments events to Supabase under an analytics-specific learner ID. It excludes names, email addresses, typed answers, chat content, recordings, and transcripts. Only the owner can view journeys and reports. Detailed events last 90 days and aggregate daily trends last two years. Turning this off stops collection on this device immediately and requests removal of detailed history when online. Previously aggregated totals remain. Thai Moments personalisation and your local last-lesson recap work without sharing usage statistics. Reminder times stay on your device.

Feedback you intentionally submit is readable by the owner in a restricted inbox. Verified subscription receipts are recorded separately from client purchase attempts to operate and understand subscriptions.

The website

Everything above is about the app. The website at sabai-thai.app is separate, and this is what it does. It is hosted on Cloudflare Pages, so Cloudflare receives every request and its IP address in order to serve the page and to block abuse. Visits are counted with Cloudflare Web Analytics, which sets no cookies and stores nothing on your device, which is why there is no cookie banner to dismiss. It records the page you opened, the site you arrived from, your country, browser, operating system and device type, and how fast the page loaded. It does not build a profile of you and it cannot follow you to other sites. We rely on legitimate interest for that, and you can object using the rights below. If you request our free ebook, we use your email to send the requested download link. Separately, you can choose an optional checkbox for beginner Thai tips and occasional Sabai Thai updates. The ebook is available without that choice. For this opt-in we store your email, signup page, date and exact consent wording. We send one reminder after seven days if you opted in and have not accessed the guide. Personal links record a guide-page visit or PDF request to prevent unnecessary reminders; they do not prove that you saved or read the PDF. This uses no tracking cookies or email-open pixels added by Sabai Thai. We use Resend delivery status to avoid reminders after a failed delivery, bounce or complaint. You can unsubscribe without an account using the link in each marketing email. Downloading the app or creating an app account does not subscribe you to marketing emails. Older website newsletter subscriptions are separate and are not automatically enrolled in this ebook reminder. We retain consent evidence and the minimum unsubscribe record needed to honour your choice and demonstrate consent; contact us for access or deletion requests. There are no advertising or social trackers anywhere on the site.

Optional learning emails

Learning emails are off unless you request them and confirm the link sent to your account email address. This choice is separate from app notifications and analytics. Choose app updates, weekly lesson companions and learning reminders independently. We use saved lesson completion and your device UTC offset to match the released weekly lesson and skip completed-lesson reminders. We use your email address to send a welcome message and your selected emails through Resend. Supabase stores your category preferences, the consent wording and timestamps, and delivery records. We do not track email opens or clicks. You can unsubscribe using any learning email or in Settings > Notifications > Learning Emails. This does not affect necessary account messages. Confirmation links expire after 24 hours; subscriptions expire after 24 months unless renewed. Delivery records are kept for up to 90 days. Consent evidence is retained while the subscription is active and for up to 24 months after withdrawal. A hashed address is kept after a bounce or complaint to prevent further unwanted delivery. Account deletion removes the linked subscription, consent evidence and queued messages. Contact us about removal of a suppression record or provider-held data.

AI companion

When you use Ask or Practice with your companion, what you type and the recent messages in that conversation are sent to Anthropic, which generates the reply. The Thai in the reply is sent to Google Cloud Text-to-Speech to be voiced. Your messages are not used to train any model. The conversation is stored on your device only and goes when you clear it. We record how many messages you send each day, so the daily limit can be applied.

AI-generated content

Some of what you see and hear is produced with AI assistance: the course audio, the companion artwork, and some of the written material. All of it is reviewed before it ships. This sits in a privacy policy as a transparency notice under Article 50 of the EU AI Act rather than as a statement about your data, because none of your data is used to make any of it. The same notice is in Settings under Legal, and on the About page at sabai-thai.app.

Who we share it with

We use trusted providers to operate the app: Supabase (accounts, database), Google/Firebase (sign-in and push notifications), Anthropic (AI companion replies), Google Cloud (speech, both reading Thai aloud and writing down your shadowing takes, and translating the destination you type into the taxi card, which we do not store), Sentry (crash reporting, only if you enable it), RevenueCat (subscriptions and purchases), Google Play (distribution and, if you rate us, the store review), Cloudflare (hosting the website and counting its visits), and three that carry email on our behalf: Resend (requested ebook delivery, optional beginner Thai emails, optional learning emails and the daily summary of reported questions), Brevo (replies we send you from the support address) and Porkbun (forwarding mail you send to that address). They process data on our behalf under their own policies.

Where your data goes

Several of those providers are based in the United States, so your data is transferred outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework.

How we protect it

Everything travels over an encrypted connection (HTTPS). Your data sits behind row-level security in the database, so an account can only reach its own rows, and the keys that could bypass that never leave our servers or reach the app. Database backups are encrypted. No system is perfect, but we keep the number of places your data goes as small as the app allows.

Data retention & deletion

We keep your account data until you delete your account. You can delete it any time in Settings → Delete Account, which permanently removes your profile and progress. Device-local data is cleared by uninstalling the app. Encrypted database backups can still hold deleted rows for up to 30 days before they age out. Records of purchases are kept for as long as tax law requires us to keep them.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable format, restrict what we do with it, or object to processing we base on legitimate interests. Where we rely on your consent, you can withdraw it at any time without affecting what came before. Deleting your account does most of this immediately; for anything else, email us and we will answer within one month.

If you think we have got it wrong, you can complain to your national data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Age

Sabai Thai is for people aged 16 and over. We do not aim it at children and we do not knowingly collect their data. Sixteen is the age at which you can agree on your own to the optional parts described above, which is why it is the line we draw. If you believe a child has an account here, email us and we will delete it.

Changes

We may update this policy; we'll revise the effective date above when we do.

Contact

Questions or requests: support@sabai-thai.app