1. Data controller

tudtu (company details will be added once registered). Data protection contact: privacy@tudtu.com

2. What we collect

Account: phone number · display name · profile picture · date of birth (for 18+ titles) · language · e-mail (when you add and confirm it for updates — every e-mail has an unsubscribe link, never marketing).

When you sign in with Apple, Google, Facebook or LINE: that provider's user id, e-mail, name and picture (if the provider sends them — the profile picture is copied to become your account picture) — from LINE we ask for the profile only, not the e-mail unless permitted · on Facebook you may decline the e-mail and still get an account · to delete your data use Me › Delete account, or remove tudtu in your Facebook settings and request deletion (status at tudtu.com/legal/data-deletion).

Use: titles and episodes watched, where you stopped, watch time, likes, saves, follows, comments, notifications · the creator who invited you (when you sign up through a creator's invite link).

Device and security: a device id (cookie), browser type, sign-in times and your IP address as an irreversible hash.

3. Purposes and legal bases

Contract: signing in, remembering where you stopped, new-episode alerts · Legitimate interests: preventing view fraud and attacks (rate limits, locking after wrong codes), aggregate statistics for creators, trending · Legal obligations: tax and lawful requests · Consent: anything we will ask you about separately (e.g. marketing, if ever).

4. Cookies

Necessary: sign-in (short-lived and refresh tokens), device id, language and settings · a creator's invite link (which channel invited you, kept 7 days) · tudtu's own viewing statistics (never shared) · We currently use no advertising or third-party cookies; we will ask before ever doing so.

5. Sharing

We do not sell personal data. We share only what is needed with processors working for us: the SMS provider (your number, to send the code) · the e-mail provider (your address, to send updates) · Cloudflare Turnstile (bot check) · Apple/Google/Facebook/LINE (when you choose to sign in with them) · hosting providers. Creators see aggregate statistics only, never who watched.

Data may be processed on servers outside Thailand with safeguards required by the PDPA.

6. Retention

Individual viewing events: 90 days, after which only anonymous aggregates remain · Sign-in and security records as needed · When you delete your account, personal data is erased within 30 days · Records of accepted documents and creators' tax data are kept as the law requires (tax: 5 years).

7. Your rights

Access and a copy: “Download my data” under Me › Account & security (JSON file) · correction · deletion · objection or restriction · withdrawing consent · complaint to Thailand's PDPC. Contact privacy@tudtu.com — we answer within 30 days.

8. Security

Encrypted connections · no passwords to leak · one-time codes stored hashed · sign-in tokens rotated on every use, every device signed out when theft is detected · alerts when a new device signs in.

9. Children

The service is not designed for children under 13. Minors should use it with a parent's consent. If we learn we hold a child's data without consent we delete it promptly.

10. Changes

When we change this policy we change the version number and ask you to accept the new version on the site.