1. Scope and Application

This policy describes how Vow Squad Co., Ltd. ("we", "the service provider") collects, uses, discloses, and protects personal data of FairHoops users. The service is provided via fairhoops.com and related subdomains including play.fairhoops.com and play-dev.fairhoops.com.

This policy is governed by Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

2. Data We Collect

We collect personal data only as necessary for service delivery, in 3 categories:

2.1 Data You Provide Directly

2.2 Automatically Collected Data

• Firebase UID — system-generated user ID (for authentication)
• User Agent — browser info (only at consent acceptance)
• Timestamps — when activities occur (creating Session, joining, etc.)

2.3 In-Group Activity Data

• Sessions you created or joined
• Match scores and statistics (W/L/D, Points)
• Teams you were assigned to
• Payment status and attendance

3. Purpose of Collection

We use your data only for the following purposes:

1. Provide team management service — display rosters, auto-team assignment, record match results
2. Identify users — for re-login and Admin permission verification
3. Link activity to history — show Sessions you joined and personal stats
4. In-group contact — Admins see phone numbers for announcements (regular players don't)
5. Payment verification — Admins review payment slips (only for their Sessions)
6. Service improvement — aggregate analytics without identifying individuals

4. Legal Basis

We process your data on the following legal bases:

5. Sharing with Third Parties

We use the following technology providers to deliver our service:

6. Data Retention Period

7. Your Rights as Data Subject

Under PDPA Sections 30-37, you have the following rights:

1. Right to Access (Section 30) — request to view data we hold about you
2. Right to Rectification (Sections 35-36) — edit name/photo yourself in Profile
3. Right to Erasure (Section 33) — click "Delete Account" in Profile
4. Right to Restrict Processing (Section 34) — request via email
5. Right to Object (Section 32) — request via email
6. Right to Data Portability (Section 31) — request via email
7. Right to Withdraw Consent (Section 19) — deleting account = withdrawing consent
8. Right to Complain — contact the Personal Data Protection Committee at pdpc.or.th

We will respond to your request within 30 days per PDPA.

8. Account Deletion (Anonymise Pattern)

When you delete your account, the system will:

🗑️ Delete immediately and permanently:

• Profile data (users/{uid}) — display name, photo, photoURL
• Personal Session history (users/{uid}/sessionHistory/*)
• Storage files (profiles/{uid}.jpg)
• Firebase Auth account
• localStorage entries (fh_name, fh_my_player_*)

🔒 Anonymise (don't delete, just unlink):

• Sessions you created → set createdByUid: null + ownerDeleted: true + label changes to "(Deleted User)"
• Player records in other Sessions → set uid: null + remove photoURL, but keep name + scores + stats

Why Anonymise?

Deleting all Sessions you joined would impact 9-10 other players in each team. Teammates would lose their entire match history; team creators would lose records of activities they organized.

Anonymising removes identifying data (uid, photoURL, email) while preserving aggregate activity data (display name, scores, team) — which constitutes Legitimate Interest of other players under PDPA Section 24(5).

How to Delete Your Account

1. Go to "My Profile" (click avatar in top-right)
2. Click "🗑️ Delete Account Permanently"
3. Type "DELETE" to confirm
4. Click "Delete My Account" (final warning)
5. Re-authenticate via Google popup
6. System will delete data and log you out

9. Cookies and localStorage

FairHoops uses browser localStorage (not HTTP Cookies) to store:

We do NOT use third-party marketing cookies or tracking pixels.

10. Security Measures

• HTTPS/TLS — All communications encrypted
• Firebase Security Rules — Access restricted by role (Admin/Player/Public)
• Re-authentication — Account-impacting actions (e.g., deletion) require re-verification
• Data minimization — Only collect what's necessary
• Audit log — Consent records and significant changes logged

11. Cross-Border Transfer

Your data is processed by Google Firebase across multiple data centers:

• Primary: asia-southeast1 (Singapore)
• Backup: US Multi-region (for availability)

Cross-border transfers comply with PDPA Sections 28-29. Google maintains adequate protection (Standard Contractual Clauses + Adequacy frameworks).

12. Minors' Data

FairHoops is designed for users aged 18 and above. Users under 20 require parental consent per PDPA Section 20.

If we discover we have collected minors' data without proper consent, we will delete it immediately. Please contact us if you suspect your child's data is in our system.

13. Policy Changes

We may update this policy periodically. Significant changes will:

• Increment policy version (e.g., v2 → v3)
• Display new consent banner — request consent again
• Notify via email (if available) for changes affecting your rights

Latest version always at /privacy-policy.html

14. Contact Us

For questions, complaints, or to exercise your PDPA rights, please contact:

If you're unsatisfied with our response, you have the right to file a complaint with the Office of the Personal Data Protection Committee (PDPC) at www.pdpc.or.th