Privacy Policy

Do9ood is a social platform for sharing everyday acts of goodness. We built the system with "Privacy by Default" — anonymous mode is the default, and you always control who sees your stories.

This policy explains the data we collect, how we use it, and your rights under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

Data you provide directly

Email and name (from Clerk Authentication at signup)

Deed content: story, category, impact, media (images/video)

Privacy settings: visibility mode (anonymous / public / followers)

Interests selected during onboarding

Data generated by use

Thanks given and received

Campaigns joined

Standard usage logs (IP address, browser, timestamp) for security and debugging

Data we do not collect

Passwords (fully managed by Clerk)

Credit card information (no payment feature yet)

Real-time location data

We use your data to:

Deliver a feed tailored to your interests and location

Send Thanks notifications (if you enable them)

Review and moderate content per community policy

Analyze aggregate usage to improve the product

Prevent abuse and spam

We do not sell your personal data to third parties, and we do not use your data for behavioral advertising.

Do9ood is one of the few platforms that defaults to anonymous:

Default: your deed is shown without identifying you

You choose to be public: switch to "Public" or "Followers only" at any time

Face blur: when enabled, the system prompts you to blur faces before posting

Backend data: even if a deed is anonymous, it is still linked to your account so you can edit or delete it, and to prevent abuse

Clerk (Authentication)

Login data (email, session) is managed by Clerk Inc. See Clerk's privacy policy at clerk.com/privacy.

Cloudflare

D1 (Database): deed and onboarding data stored in Cloudflare D1 (SQLite)

R2 (Storage): media files (images, video) stored in Cloudflare R2

Workers: application runs on Cloudflare's global Edge Network

Data may be processed in multiple regions per Cloudflare's Edge Network, including Southeast Asia.

Do9ood requires posters to:

Confirm consent every time before posting a deed featuring another person

Blur or crop the faces of anyone who has not consented before publishing

Not post identifying information of others without permission

If you appear in content without your consent, contact privacy@do9ood.com — we will act within 48 hours.

Active accounts: data is kept as long as the account is active

Account deletion: deeds and personal data deleted within 30 days (except security logs, kept 90 days)

System logs: kept for up to 90 days

Anonymous aggregate data: may be kept as anonymized statistics

Under PDPA you have the right to:

Access: request a copy of your personal data

Rectify: correct inaccurate data via Settings

Erase: request deletion of your account and all data

Portability: export your deed data as JSON

Object: object to certain types of data processing

Complain: lodge a complaint with Thailand's PDPC

Send requests to privacy@do9ood.com

We use only essential cookies:

Session cookie (Clerk): to maintain login state

Preference cookie: to save UI settings (if any)

We do not use tracking cookies, third-party analytics cookies, or advertising cookies.

Do9ood is open to all ages, but users under 20 (or the age specified by local law) should obtain parental consent before registering, per Section 20 of the PDPA.

If we make significant changes to this policy, we will notify you by email at least 14 days in advance. Continued use after the effective date constitutes acceptance of the new policy.