Privacy Policy
Last updated: 11 July 2026
IXAY ("IXAY", "we", "us", or "our") is a real-time screen translation application operated by an individual developer based in Thailand. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it.
By creating an IXAY account or using the IXAY application, you agree to the practices described in this policy.
1. Who we are (Data Controller)
IXAY is operated by an individual developer based in Thailand, acting as the Data Controller for the personal data described in this policy.
- Service name: IXAY
- Contact for privacy matters: hello@ixay.app
- Website: https://ixay.app
If you have any questions about this policy or wish to exercise your rights, contact us at hello@ixay.app.
2. What personal data we collect
We practice data minimization — we collect only what is needed to provide the service.
| Data | Why we collect it |
|---|---|
| Email address | To create your account, sign you in, send one-time verification codes (OTP), and let you reset your password. |
| Usage and quota metrics | Counts of translations and related usage, so we can apply your plan's limits and keep the service running reliably. |
| Vocabulary deck | The words you capture for the learning feature (spaced-repetition review), so the feature works across your sessions. |
| Subscription and billing status | Your plan, status, and renewal/expiry information, so we can give you access to the features you paid for. |
What we do NOT collect:
- We do NOT store screenshots or screen captures. Screen content is processed in memory to produce a translation and is then discarded — it is not saved to our servers.
- We do NOT collect sensitive personal data (such as health, race, religion, political opinions, biometric or genetic data). If you type such information into content you ask us to translate, please note it is processed transiently to deliver the translation and is not stored by us.
- We do NOT sell your personal data to anyone.
Payment details: We do not store your full card or payment details. Payments are handled by Stripe (see Section 5).
3. How we use your data (and our legal basis)
We rely on the following lawful bases under the PDPA (and the equivalent GDPR bases where applicable):
- To provide the service you signed up for — creating and securing your account, verifying your email, delivering translations, storing your vocabulary deck, and giving you the features of your plan. Legal basis: necessity for performance of a contract with you.
- To operate, secure, and improve the service — applying plan limits, preventing fraud and abuse, and understanding aggregate usage. Legal basis: our legitimate interests, balanced against your rights.
- To send optional marketing or product updates — only if you have opted in. Legal basis: your consent, which you may withdraw at any time.
We do not use your data for automated decision-making that produces legal or similarly significant effects on you.
4. How long we keep your data
- Account data (email, deck, usage, billing status): kept for as long as your account is active.
- After you delete your account: we delete or anonymize your personal data within a reasonable period, except where we must retain limited records to comply with legal, tax, or accounting obligations.
- You can request deletion at any time (see Section 7).
5. Who we share your data with (sub-processors)
We use a small number of reputable third-party service providers ("sub-processors") to run IXAY. Each processes data on our behalf under its own data processing agreement, and some process data on servers located outside Thailand.
| Provider | What it does | What it processes |
|---|---|---|
| Supabase | Database, authentication, and hosting | Account email, vocabulary deck, usage and subscription records |
| Google (Gemini API) | Translation processing | The text to be translated (sent transiently to return a translation) |
| Stripe | Payment processing | Payment and billing information you provide at checkout |
| Resend | Transactional email | Your email address, to send verification codes and password-reset messages |
We share data with these providers only as needed to provide the service. We do not share your personal data with third parties for their own marketing.
6. International data transfers
Because some of our sub-processors operate outside Thailand, your personal data may be transferred to and processed in other countries. Where we make such transfers, we rely on appropriate safeguards — including the data processing agreements and Standard Contractual Clauses offered by our sub-processors — and on the transfers being necessary to provide the service you requested, consistent with the PDPA's cross-border transfer requirements (and the GDPR where applicable).
7. Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you and request a copy.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten").
- Restrict or object to certain processing.
- Data portability — receive your data in a commonly used, machine-readable format.
- Withdraw consent at any time, where processing is based on consent (this does not affect processing already carried out).
- Lodge a complaint with the relevant data protection authority — in Thailand, the Personal Data Protection Committee (PDPC).
To exercise any of these rights, email hello@ixay.app. We will respond within the timeframe required by law (generally within 30 days). We may need to verify your identity before acting on a request.
8. How we protect your data
We maintain reasonable technical and organizational security measures appropriate to the risk, including encryption in transit and at rest through our infrastructure provider, access controls, and secure authentication. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.
In the event of a personal data breach that poses a risk to your rights, we will notify the relevant authority and, where required, affected users, in accordance with applicable law.
9. Children's privacy
IXAY is not directed to children under the age where consent is required under applicable law, and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us at hello@ixay.app and we will take appropriate steps.
10. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide additional notice where appropriate. Your continued use of IXAY after an update means you accept the revised policy.
11. Contact
For any questions, concerns, or requests regarding this Privacy Policy or your personal data:
Email: hello@ixay.app