Privacy Policy

In the event of any conflict between the Thai and English versions, the Thai version shall prevail.

This policy explains how Vobz (“we”) handles your personal data when you use our application and services.

1. Data we collect

1.1 Data you provide

• Phone number — used to sign up and verify your identity via an OTP code
• Profile information — display name, profile photo, and information you choose to add
• Photos and media — photos/audio/video you upload to albums or send in chats
• Chat messages — content you send to one another between users

1.2 Location data

To show users who are near you, we need to use the approximate location of your device. We always offset the coordinates (fuzz) by approximately ±100–200 meters before storing or displaying them to protect your real location — we do not disclose precise coordinates to other users.

1.3 Data collected automatically

• Device identifiers and tokens for notifications (FCM)
• Basic usage data and technical logs for security and troubleshooting
• IP address (used to prevent abuse and to limit the rate of requests)
• Profile view records — when you view the profiles of other users (see Section 5)

1.4 Passkey sign-in credentials (if you enable it)

Vobz supports sign-in with a Passkey (FIDO2 / WebAuthn standard) as an optional, passwordless alternative. If you choose to enable it, your device creates a cryptographic key pair itself and sends only the public key, together with a credential identifier, to be stored on our servers so that it can be used to verify your identity the next time you sign in.

• Your private key and biometric data (fingerprint/face) never leave your device — we do not see, store or process your biometric data at all. Unlocking happens on the device only.
• All we store is the public key, the credential identifier and technical data about the authenticator (such as device type and usage counter), which cannot be used in reverse to impersonate you even if the data were leaked.
• A Passkey is voluntarily enabled — signing in with a phone number and OTP continues to work as normal, and you can delete any Passkey you have registered at any time in the app's settings.

1.5 Sensitive personal data

Some information you may choose to add to your profile is sensitive personal data under personal data protection law: sexual orientation/role, pronouns, and date of birth. This information is shown on your public profile to other users.

• Providing this information is voluntary — you can still use the core service without it
• You can edit or remove it at any time in Edit Profile in the app
• We do not share this sensitive data with advertising or analytics providers (e.g. Google AdMob, Firebase Analytics)
• By choosing to provide this information, you consent to our processing it under this policy. You can withdraw that consent at any time by removing it from your profile

2. How we use data

• Provide the core service — finding nearby friends, chatting, and sending media
• Verify identity, keep accounts secure, and prevent spam/abuse
• Send notifications (new messages, friend requests, etc.)
• Process payments for Premium membership
• Show ads to free-account users (see Section 4)

3. Sharing data with third-party service providers

We use third-party service providers that are necessary for the service to operate:

Automated content moderation: Before your profile photo is published, we send it for automated review via Google Cloud Vision. If inappropriate content is detected, the photo is not used as your profile photo and you are notified. This automated scan currently applies to profile photos only — chat and album photos are reviewed through user reports and our team.

Payment information: All payments are processed directly by Apple (App Store) or Google (Google Play) — we do not see and do not store your card number or financial information. We receive only the subscription status (such as the plan purchased and the expiry date) through RevenueCat in order to enable Premium entitlements on your account.

We do not sell your personal data.

4. Advertising and advertising identifiers

All choices are summarized in one place: Your privacy choices

Free-account users may see ads through Google AdMob. We do not show ads on chat screens, disappearing media, or privacy features, and Premium users will not see any ads at all.

To show and measure ads, Google AdMob may collect and use the device's advertising identifier (such as the Advertising ID / IDFA) and some usage data. You can:

• iOS: decline tracking (App Tracking Transparency) when the app asks, or at Settings → Privacy & Security → Tracking
• Android: reset or delete your Advertising ID at Settings → Google → Ads
• In regions where the law requires it (GDPR/CCPA), we will ask for your consent before showing personalized ads, or show only non-personalized ads

For details on how Google uses data, see Google's privacy policy. We consider this use of advertising to be not a “sale” of data, but under the CCPA it may be regarded as “sharing” for advertising, which you have the right to opt out of (see Section 8).

5. Privacy and special features

• Profile views: Normally, when you view the profile of another user, the system records that visit, and the profile owner (a Premium member) can see that you came to look.
• Stealth mode (Premium): When enabled, your profile views are not recorded at all — the person viewed will not see that you visited.
• Disappearing media: Files are deleted from storage after the timer expires, not just hidden from the screen.

6. Retention and deletion of data

We keep data for as long as your account is active. You can delete your account yourself in 2 ways:

• In the app: Settings (การตั้งค่า) → Delete Account
• By email: send a request to support@vobz.app from a phone number/details that can verify the account

When you request deletion, the account is hidden from other users immediately and enters a 30-day recovery period (you can recover it by signing in and tapping recover account). After that period, personal data is permanently deleted or made non-identifiable, except for data we are required to keep by law. See the detailed steps and the list of data on the Privacy choices and Account deletion pages

How long we keep each category of data:

• Account, profile and chat data: for as long as your account is active, plus the 30-day recovery period after you request deletion
• General content/user reports and moderation records: no longer than 2 years after the report is closed, unless a dispute or legal requirement means we must keep it longer
• Reports involving serious safety risks (such as child sexual abuse material or self-harm risk): kept until the related investigation or legal process concludes — no fixed deletion date
• Administrative action records on your account (e.g. suspensions): at least 1 year
• Technical logs (IP, access logs): no longer than 12 months
• Subscription and transaction records: at least 5 years, under Thai accounting and tax law

Where your data is stored: our core infrastructure is located in the Singapore region (DigitalOcean). Media storage and networking (Cloudflare) operate on a global network, so your data may be processed outside Thailand. We put in place appropriate safeguards as required by law.

7. Legal bases for processing (PDPA / GDPR)

We process your personal data on one of the following legal bases:

• Performance of a contract — to provide the core service you request (account, chat, finding people nearby)
• Consent — for example access to location and sending notifications, where you can withdraw your consent at any time
• Legitimate interests — security, fraud/spam prevention, and improving the service
• Compliance with the law — when the law requires us to retain or disclose data

8. Your rights under the law (PDPA / GDPR / CCPA)

Depending on where you live, you may have the following rights:

• The right to access and obtain a copy of your personal data
• The right to rectify data that is inaccurate or out of date
• The right to erasure (“right to be forgotten”) and the right to request restriction of the use of data
• The right to object to processing, and the right to withdraw consent
• The right to data portability
• CCPA (US): the right to know what data is collected, the right to delete, and the right to opt out of the “sale/sharing” of data — please note that we do not sell personal data

You can exercise your rights by contacting support@vobz.app. We will act within the timeframe required by law. You also have the right to lodge a complaint with a supervisory authority (for example, Thailand's Office of the Personal Data Protection Commission, or the authority in your region).

9. International data transfers

Some of our service providers may process or store data abroad. When data is transferred outside your region, we will ensure that appropriate safeguards are in place as required by law.

10. Data security

We use appropriate technical and organizational measures to protect your data. However, no method of electronic transmission or storage is 100% secure, so we cannot guarantee absolute security, and you acknowledge that using the service carries inherent risk. In the event of a personal data breach, we will notify you and the relevant authorities as required by applicable law.

11. Minors

The service is not intended for anyone under 18 years of age, and we do not knowingly collect data from minors. If we find that data of a minor has been collected, we will delete it promptly.

12. Limitation of liability

To the extent permitted by applicable law, we are not liable for damage arising from unauthorized access, the actions of third parties, or causes beyond our reasonable control.

13. Changes to this policy

We may update this policy from time to time, and will notify you of material changes through the app or another appropriate channel.

14. Contact us

If you have questions about privacy, or want to exercise your rights, contact support@vobz.app
Provided by the Vobz team · Data controller: the Vobz team (support@vobz.app)