This policy explains how ThaiEar ("we", "us") — a trading name of Toby Ralph, a sole trader with a business address at 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB — collects and uses
your personal data when you use thaiear.com. We are the data
controller, registered with the UK Information Commissioner's Office (reference ZC176414). For any
privacy question or to exercise your rights, contact us at support@thaiear.com.
1. What we collect
Account data — when you sign in with Google we receive your name, email
address, profile picture and Google account identifier. If you sign in with an email link
instead, we store your email address only. You can choose a display name at any time on your
account page; if you do, we store the name you chose and use it in place of the one your
sign-in provider gave us.
Subscription & billing data — if you subscribe, our payment provider
Stripe processes your payment. We store your Stripe customer/subscription identifiers and
subscription status. We never see or store your card details.
Marketing preference — whether you have opted in to update emails.
Technical data — standard server/security logs (e.g. IP address, browser
type) handled by our hosting/CDN provider.
Advertising measurement — if you arrive from one of our adverts, the link you
followed carries an advert-click identifier. We read it from the web address you arrived
on, and if you then create an account we store it against that account, together with the
campaign tags and the page you landed on, so we can tell which advert produced it. Reading the
address stores nothing on your device, so we do not ask for consent to do it — we rely on our
legitimate interest in knowing whether the advertising we pay for works. You can object at any
time (section 5).
If you are in the UK, the EEA or Switzerland we do not record the advert-click
identifier at all. Separately, if you consent to advertising cookies, we also keep a copy of that
identifier on your device for up to 30 days, so a click can still be matched if you create your
account on a later visit. If you decline, nothing of ours is kept on your device.
See section 6.
How you use the service — for your account we keep a small usage record:
when we first and last saw you signed in, how many separate days and visits that covers, and
how many times you have listened to a sentence. It exists so we can tell whether people come
back, and it is deleted automatically if you delete your account.
Your saved work and progress — the playlists you build, a count of how many
times you have played each sentence, and a few totals built from that: how many separate days
you have listened on, your current run of consecutive days, your best run, and the date you
last listened. Together these are what your progress page shows you. The play count is
a running total per sentence — there is no record of which sentences
you played on which day, and no record of the order you listened in. It is part of
the features you are using and is shown back to you, and it is deleted automatically if you
delete your account.
Your quiz results and settings — for each quiz you take we keep your
best score and how many times you have taken it, and for each individual
question how many times you have seen it and how many times you answered it correctly. These
are what the “My results” panel and the quiz columns on your progress page show
you. We also keep the settings you choose for a quiz — its length,
whether decoys are shown, and so on — and any questions you have chosen to leave out,
so that they are the same next time and on your other devices.
In the Thai Builder we additionally keep answers the checker refused: the
sentence, the word order you built, and when. We read these to find correct Thai that our
answer key was wrongly rejecting, which is how the quiz gets fixed. It is
your answer, not anything about you, and it is never shown to anyone else.
All of this is part of the features you are using, and all of it is deleted automatically if
you delete your account. The Reset progress data button on your progress
page permanently deletes your scores, your per-question counts, the questions you chose to
leave out and the Builder answers we kept. It keeps only your quiz settings, because those
are display choices rather than results.
Your Read Thai test results — for each test in the reading course we
keep how many times you have taken it, your best score, and your average
across attempts. These are what the course shows you on each step and in its results
table. They are stored with your account so they follow you to any device you sign in
on; a result recorded while you are offline is kept on that device and sent to your
account when you reconnect. We do not keep a record of when you took any
individual test. All of it is deleted automatically if you delete your
account. The Clear my reading progress button on the course’s
results page permanently deletes all of them, from your account as well as this
device.
Signup country — when you create an account we record which
country you were in, worked out from your internet connection.
We do not store your IP address in this record. This tells us which
countries our visitors come from. It applies to every new account, whether or not you
arrived from an advert, and it is deleted automatically if you delete your account.
How much audio we have given your account — a count of how many audio
files we have unlocked for you today, the total so far, the number of days that covers, and
your busiest single day. It is a number only: it does not record
which files, topics or sentences, and it is never used to decide what you
see. We keep it so that we can tell ordinary listening apart from an account being used to
copy the whole audio library, which our voice recordings are licensed to us alone. It is
deleted automatically if you delete your account.
2. Why we use it, and our legal basis
To provide the service (sign-in, access to content) — performance of a contract.
To take payment and manage your subscription — performance of a contract.
To show you your saved work and listening progress — performance of a contract.
To send update/offer emails — only with your consent (you can withdraw it any time).
To measure whether our advertising works — legitimate interests for the
advert-click identifier we read from the web address (not recorded at all in the UK, EEA or
Switzerland); you can object at any time by emailing us. Keeping a copy of it on your device is
separate and happens only with your consent, which you can withdraw at any time from
section 6.
To see whether people come back and keep learning (the usage record in
section 1) — legitimate interests. It is counts and dates only, it does not record which
sentences you played, and it is deleted with your account. You can object at any time by emailing us.
To understand which countries our users come from (the signup country in
section 1) — legitimate interests. It is country-level only, we never store the IP address it
was derived from, and it is deleted with your account. You can object to this at any time by
emailing us.
To protect our audio library from being copied in bulk (the count in
section 1) — legitimate interests. It is a count only, it does not record which audio you
played or opened, nothing about it is stored on your device, and it is deleted with your
account. You can object at any time by emailing us.
To keep the service secure and meet legal obligations — legitimate interests / legal obligation.
3. Who we share it with (processors)
We use trusted providers who process data on our behalf:
Supabase — authentication and our database (EU-hosted).
Stripe — payment processing and subscription billing.
Google — "Sign in with Google" authentication.
Cloudflare — website hosting, content delivery and security.
MailerSend — sending sign-in and account emails.
MailerLite — sending update emails (only if you opt in).
Google Ads — measuring whether our adverts work. Where we have recorded an
advert-click identifier (see section 1), we may send it back to Google to record that the click
led to an account being created, and later whether that account went on to play a sentence.
Google minted that identifier and already holds the click; we send no name, email or other detail
about you with it.
Reddit Ads — measuring whether our Reddit adverts work. Where we have recorded a
Reddit advert-click identifier, we tell Reddit that the click led to an account being created, and
later whether that account went on to play a sentence. We send only the click identifier and the
time — never your name or email.
We do not sell your personal data. Some providers may process data outside the UK/EU — including
Google, Reddit and Stripe in the United States; where they do, appropriate safeguards (such as the UK
International Data Transfer Addendum and Standard Contractual Clauses) are in place.
4. How long we keep it
We keep account and subscription data for as long as you have an account, and as required for
legal, tax and accounting purposes after that. You can ask us to delete your account at any time.
The advertising-measurement, approximate-location and usage records described in section 1 are
held against your account and are deleted automatically when your account is
deleted.
One exception: if you have been given access to a feature that is granted by email address,
that address stays on the access list until we remove it. Email
support@thaiear.com and we will.
5. Your rights
Under UK GDPR you have the right to access, correct, delete or export your data, to object to or
restrict processing, and to withdraw consent. To exercise any of these, email
support@thaiear.com. You can also delete your account from your account page.
If you are unhappy with how we handle your data you can complain to the UK Information
Commissioner's Office (ICO) at ico.org.uk.
6. Cookies & local storage
We use two kinds of storage on your device. You are asked about the second kind the first time
you visit, and nothing in that category is set unless you agree to it.
Strictly necessary — always on
These make the site work. They are exempt from the consent requirement and cannot be turned off.
Sign-in session (sb-…-auth-token) — keeps you logged in.
Your settings and saved work — playlists, progress, playback preferences and
any topics you have downloaded for offline listening. These stay on your device.
Your cookie choice (te_consent) — so we do not ask you again.
Kept for 6 months.
Advertising — only with your consent
If you agree, we use these to measure whether an advert you clicked led to anything. They are
not used to build a profile of you, and refusing them changes nothing about what you can read,
use or listen to.
Google Ads measurement (_gcl_au, _gcl_aw) — set by
Google so an advert click can be matched to what happened afterwards. Kept for up to 90 days.
Our own advert record (te_attrib) — the identifier of the advert
click that brought you here, held on your device for up to 30 days. If you create an account we
store it against that account so we know which advert produced it.
We apply Google Consent Mode, so if you refuse, Google's tags are told not to store anything or
use your data for personalisation.
One thing worth being clear about: refusing these means nothing is kept
on your device. It does not by itself stop us recording the advert-click identifier that
was in the web address you arrived on — that is described in section 1, relies on legitimate
interests rather than consent, and is not recorded at all if you are in the UK, EEA or
Switzerland. You can object to it at any time by emailing us.
Changing your mind
You can change or withdraw your choice at any time, with no effect on anything you have already
done here.
What we do not do
We do not use advertising cookies to build advertising profiles, we do not sell or share your
data with data brokers, and we do not use third-party analytics that track you across other
websites.
7. Changes
We may update this policy; the "last updated" date above reflects the latest version.