back to the site// privacy

Privacy policy

Last updated: 2026-08-16

Short version: this site collects the minimum needed to let you sign in, save a game score, and count how many people visit. Visit counting uses no cookies and cannot identify you or follow you from one day to the next. There is no advertising, no third-party tracking, and nothing is sold or shared for marketing. You can delete your account data yourself from account settings.

Who is responsible

This site is a personal portfolio operated by Theppratan Junpanya, based in Nonthaburi, Thailand. For the purposes of the Personal Data Protection Act B.E. 2562 (PDPA) and the EU General Data Protection Regulation (GDPR), that individual is the data controller.

Contact: theppratanjun@gmail.com

What is collected, and why

You can browse the entire public site without giving anything at all. Data is only collected once you create an account.

Email address
Required to create an account and to sign in. Also used as the fallback display name on the leaderboard if you never set one.
Password
Stored only as a bcrypt hash. The original password is never written to disk and cannot be recovered by anyone, including the site owner.
Session token
A random identifier stored in an HttpOnly cookie and in the database, so that a sign-out can revoke access immediately. Expires after 2 hours.
IP address
Recorded alongside security events (sign-in, sign-in failure, password change, account deletion, resume access) to detect and rate-limit abuse.
Display name and score
Only if you choose to save a score. This appears publicly on the leaderboard. You can change or delete it at any time.
Language and theme
Kept in your browser's local storage, not on any server. Clearing your browser data removes them.
Page visits
Which page was opened, the referring domain (for example linkedin.com, never the full link), a two-letter country code, and whether the device is a phone, tablet or desktop. No cookie is set for this.

Legal basis

Account data is processed to perform the service you asked for — creating an account and keeping you signed in (PDPA s.24(3); GDPR Art. 6(1)(b)). Security logs, including IP addresses, are kept under legitimate interest in protecting the service from abuse (PDPA s.24(5); GDPR Art. 6(1)(f)). Publishing your chosen display name on the leaderboard happens only on your explicit action of saving a score.

Cookies

One cookie is used: portfolio_session. It holds the session token, is marked HttpOnly, Secure and SameSite=Strict, and expires after two hours. It is strictly necessary for signing in, so there is no consent toggle — declining it would simply mean the site could not log you in.

Your language and theme choices are kept in local storage, and the acknowledgement of the cookie notice in session storage. Neither is sent to a server and neither can identify you.

There are no advertising cookies and no third-party tracking cookies of any kind. Visitor counting, described below, is done without cookies.

Counting visitors

This site counts page visits so its owner can tell whether anyone is actually reading it. It is built to answer that question and nothing more, using no third-party service — the data stays in this site's own database.

Your IP address is never stored. It is combined with a secret that changes every midnight and turned into a one-way fingerprint, used only to tell two visits apart on the same day. The next day the same person produces a different value, so following anyone across days is impossible by design rather than by promise.

The referring domain is kept, but never the full link it came from, since a full link can carry search terms or identifiers. Requests from bots and monitoring tools are discarded rather than counted.

Who else can see it

Data is not sold, rented or shared for marketing. It is handled by these service providers acting as processors:

  • ▸Vercel — Website hosting and content delivery
  • ▸Supabase — PostgreSQL database (Singapore region) and social sign-in
  • ▸Google / GitHub — Only if you choose social sign-in. They confirm your identity and share your email address with this site.

The database is hosted in Singapore. If you are in the EEA or the UK, this is a transfer outside that region, carried out under the provider's standard contractual clauses.

How long it is kept

Account data is kept until you delete the account. Sessions expire after two hours and expired rows are removed. Security log entries are kept so that repeated abuse can still be recognised; entries tied to a deleted account have their link to that account cleared, leaving only the event, timestamp and IP address.

Your rights

  • ▸Access — ask what is held about you, or read most of it yourself in account settings.
  • ▸Rectification — change your display name yourself at any time.
  • ▸Erasure — delete your account from account settings. This removes your account, sessions and leaderboard entry immediately.
  • ▸Withdraw consent — sign out, or delete the account. Nothing is retained that would let the site identify you afterwards, apart from security logs described below.
  • ▸Object or complain — write to the address below. In Thailand you may also complain to the Office of the Personal Data Protection Committee.

Requests sent to the address above are answered within 30 days, as required by both the PDPA and the GDPR.

Children

This site is not aimed at children under 13 and does not knowingly collect their data. If you believe a child has created an account, write to the address above and it will be removed.

Changes

If what the site collects ever changes, this page is updated at the same time and the date at the top changes with it.

Every statement here was written against the code that implements it, and is updated in the same change whenever what the site collects changes. If anything on this page does not match what you observe, that is a bug — please report it to the address above.

back to the site