Privacy Policy

Last updated 24 September 2026

1. Who we are

Durumi Game Centre is run by Durumi Studio, 291 Navara Rama 2, Tha Kham, Bang Khun Thian, Bangkok 10150. We sell subscriptions to educational games for children and this policy explains what we do with the information you give us. We follow Thailand's Personal Data Protection Act (PDPA).

You can reach us about anything in this policy at pattarapon.noia@gmail.com or on LINE at @461rgkxz.

2. What we collect

When you create an account

• Your email address — required, because it is how you sign in and how we reach you.
• Your password, stored only as a salted hash. We never see or store the password itself.
• Your name, phone number and school name, if you choose to give them. All three are optional.
• Whether you signed up as a parent, a tutor or a school.

When you pay

• The photo of the transfer slip you send us, and any note you write with it.
• What we recorded from it: amount, date, method and our own reference for the payment.
• Your plan, how many devices it covers and when it runs out.

When a game is played

• A device identifier we generate in the browser — a random string, not a serial number, not an advertising id.
• A label you give the device, if you set one, and when it was first and last used.
• The browser's user-agent string, so a device is recognisable in your own device list.

Automatically

• Your IP address, used to limit how often anyone can try to sign up, log in, redeem a code or upload a

file. This is how we keep other people from attacking your account.

• Ordinary server logs kept by our hosting provider.

We do not collect: card numbers or bank credentials — you transfer money in your own banking app, never on our site. We do not use advertising trackers, and we do not sell anything about you to anybody.

3. Why we collect it

• To run your subscription — sign you in, know which plan you have, and let your games open.
• To take payment — read your slip, record the payment and extend your plan.
• To keep the device limit honest — a plan covers a number of devices, so we have to count them.
• To keep the service safe — rate limits, and refusing a copy of a paid game that was not bought.
• To answer you — when you write to us about your account.

Our legal basis is the contract between us for the parts that run your subscription, our legitimate interest for security, and your consent for anything optional.

4. Payment slips

A slip is a photograph of a bank transfer, so it can show your name, your bank and your account number. We treat it as the sensitive document it is:

• Only JPEG and PNG images are accepted. We check the file's own bytes, not what it claims to be.
• Each slip is stored under a name our server generates. Nothing from your filename is used.
• Slips are never public. The only way to view one is through the owner's signed-in admin page.
• Accepting a slip does not grant anything by itself — a human reads it and records the payment.

5. Devices and your child

Accounts are held by adults. A child does not sign up, does not give us their name and does not have an account of their own. What a game sends us while a child is playing is the device identifier and whether the subscription is still valid — never anything about the child, their answers or their progress.

6. Who else sees it

• Cloudflare hosts the site, the database and the slip storage. Your data sits on their

infrastructure and passes through their network.

• Google Fonts serves the two typefaces the site uses, so your browser makes a request to Google

that carries your IP address.

• Your bank and ours handle the transfer itself. We never see your banking login.
• LINE, if you choose to message us there rather than by email.

We do not sell personal data, and we do not share it for advertising. We would hand something over to the authorities only where the law requires it.

7. How long we keep it

• Account details: while your account exists, and 15 days after you close it.
• Payment records and slips: 5 years, as the tax rules require, because tax law requires it.
• Device records: until you remove the device, or your account closes.
• Rate-limit and server logs: 30 days.

8. Your rights

Under the PDPA you may ask us to show you what we hold, correct it, delete it, stop using it, or send it to you in a portable form. You may also withdraw consent for anything you agreed to. Write to pattarapon.noia@gmail.com and we will answer within 30 days. If we get it wrong you can complain to Thailand's Personal Data Protection Committee.

9. How we protect it

Passwords are salted and hashed, never stored as text. Sessions use a signed cookie, and changing your password retires every cookie issued before it. Slips are private storage reachable only by an administrator who is signed in. Our staff — which is to say the owner — reads a slip only to record the payment on it.

10. Changes and contact

If we change this policy we will post the new version here with a new date, and your account records which version you agreed to. For anything at all: pattarapon.noia@gmail.com, or LINE @461rgkxz.