Privacy policy

Phattharaphum Kingchai (Thailand) runs phatphum.me and is the data controller under Thailand’s Personal Data Protection Act B.E. 2562 (PDPA). You can reach me at the email address at the bottom of this page.

Only two things:

• Visit statistics (automatic): the page opened, language, device type, browser, operating system, screen width, referring site (domain only), utm_* parameters when a link has them, how long the tab was open, how far you scrolled, and your country (only if the host supplies it).
• The contact form (when you send it): your name, email, message, the project type and timing you pick, the case study you came from, the page language, plus your IP address and browser user agent, which are used against spam and repeated submissions.

I collect nothing else — no precise location, no contacts, no payment details — because the site has no accounts or shop.

• No cookies, and no IP address is stored in the statistics.
• A visitor is a hash of IP + browser + date + a secret salt. It changes every day, so the same person cannot be counted across days and the hash cannot be turned back into an IP.
• Bots, the site owner while signed in to the admin area, and browsers sending Do Not Track or Global Privacy Control are not counted.
• Only the referring site’s domain is kept — never the path or query string of the link that brought you here.
• The data is used only to see which pages get read and to improve the site; there is no profiling or advertising.

Visitors get no cookies, but these values are kept in your own browser and are not sent to the server unless noted:

• theme (localStorage): remembers the light/dark mode you chose.
• contact-draft (localStorage): your unsent contact message, so it survives closing the page; removed once you send it.
• analytics:sid (sessionStorage): a random id for this visit, used to count pages per visit; it disappears when the tab closes.
• analytics:ignore (localStorage): used only by the site owner to leave their own device out of the numbers.

A session cookie exists only for the admin area (/admin), for the site owner.

• Google Fonts: your browser loads fonts from fonts.googleapis.com and fonts.gstatic.com, so Google receives your IP address as with any file request.
• Spotify (the “Me” page): the player loads only when you press play yourself, and Spotify may then collect data under its own policy. Album covers are fetched by the server without sending your data.
• Image storage (Amazon S3) and the database hold the site’s content; images are served through this site’s own domain.
• Links to other sites (for example GitHub) are covered by those sites’ policies.

There are no ads, no Google Analytics and no Meta or ad-network pixels.

• Visit statistics: removed automatically after 400 days, and I can delete them sooner.
• Contact messages: kept as long as needed to reply and follow up, then deleted — and deleted on request.

Under the PDPA you can ask to access or get a copy of your data, correct it, delete it, restrict or object to its use, and withdraw consent at any time.

• Contact-form data: email me from the address you used, with your name. I will check and act within 30 days.
• Visit statistics: because no IP is stored and the visitor hash changes daily, I cannot identify you in the statistics. If you would rather not be counted, turn on Do Not Track in your browser.
• If you believe the law is not being followed, you may complain to Thailand’s Personal Data Protection Committee.

The site uses HTTPS, the admin area is password-protected, access to the database and file storage is restricted, and visitors’ tokens or passwords are never stored. No system is perfectly secure; if an incident affects your data I will notify you as the law requires.

If how data is collected changes, I will update this page and the “last updated” date above.