Privacy policy

What we collect

• Your account. The email address and display name you sign up with, or that your sign-in provider gives us, and a password we store only as a hash. Optionally a profile picture if you upload one.
• Your messages. The text of what you send and what she sends back, in both languages. We keep it because a messenger that forgets the conversation is not a messenger, and because her replies have to stay readable to you.
• What you do in the app. Who you have favourited, who you have blocked, who you have reported and why, and which conversations you have read, so unread counts are right.
• Whether you have a paid pass. Whether one is running and the date it runs to. Not your card. See below.
• Operational records. Standard technical logs, page views inside the app, and how you first arrived, so we can find faults and know what is worth building. These are ours, kept on our own servers, and never handed to an advertising or analytics company.

Who else sees your messages

She does. That is the point.

ThaiPo does, because ThaiPo is what translates them and delivers them to her. Your messages are processed by its AI translation and stored on its side too, under its own privacy policy. Using Up To You Ka means your messages go through ThaiPo, and there is no version of the product where they do not.

We do, when we have to. A named operator can read a conversation when someone reports it, when we are investigating abuse, or when we are fixing a fault you have told us about. Not otherwise, and never out of curiosity.

An automatic check does, looking for phone numbers and messaging handles. It does not stop, change or delay anything you write, and no person reads your message because of it. When it spots one, it adds a note beside your message about keeping the conversation here, and sends her a short safety note. That is the whole of it.

We do not sell your data. We do not show advertising. We do not build a profile of you for anyone else, and we do not use one person's conversations for anything to do with another.

Who else is involved

These are the companies that touch your data so that the service can work. There are no others.

• ThaiPo translates your messages and delivers them.
• LINE carries the message to her phone. She reads and answers there.
• Google translates the short profile text a woman writes about herself, so that you can read it, and serves the two typefaces this site uses. Your messages do not go to Google.
• Tigris and Cloudflare store pictures and hold our encrypted backups.
• Resend sends the few emails we send you, such as a password reset.
• Stripe takes payments through ThaiPo for passes and Lady Sponsorship. We never see your full card details.

Payment

Passes and Lady Sponsorship are billed by ThaiPo through Stripe. Your card number never reaches us. For Lady Sponsorship, Stripe stores the payment method used for monthly renewals. We retain subscription and invoice identifiers, your renewal agreement and its date, paid periods, refund records and payout accounting. You manage sponsorship renewals and payment methods in Account > Lady Sponsorships.

Sponsor photos and videos are encrypted in storage and served only after an access check. The lady who uploaded a post can manage it; authorised operators review it before it is shared with her paying sponsors. Sponsor status is visible to the lady and the sponsoring customer, not a public spending leaderboard. Access controls cannot prevent a recipient from recording what they can view.

Optional ad measurement

We use Google Ads to advertise Up To You Ka. If you choose Allow measurement, Google's tag can run on public pages, the sign-in form and a one-time signup confirmation. It uses cookies to connect an ad visit with a completed signup. Google receives ad identifiers, a random signup reference and technical data such as your IP address and browser information. We do not send your email, name, messages, the women you view or your private chat activity to this tag. We disable personalised advertising and enhanced conversions.

Until you allow measurement, we load no Google Ads tag and send it no data. Declining does not affect your account or messages. You can change your choice below. Turning measurement off stops future tag loads and clears this site's Google Ads cookies; it does not erase data already sent to Google. Google may process data outside Thailand under its privacy policy. Change ad measurement choice

Google Analytics is disabled. We have no Meta or TikTok tag, session recorder or third-party error reporter. Our operational analytics stay on our servers.

We use three cookies for site features. One keeps you signed in. One remembers whether you asked for the phone or desktop layout. One remembers which women Discover has already shown you, so the front of that page changes as you come back. Another cookie remembers your measurement choice for six months. If you opt in, Google's attribution cookies (whose names begin with _gcl_) normally last up to 90 days and may be renewed on a later visit.

Notifications

If you install the app to your home screen and allow notifications, we send you one kind: a woman has replied to you. Nothing else is ever pushed, and you can turn it off from your phone's settings or by muting the conversation.

Where it lives, and how long

The service runs on Fly.io in Singapore, and everything travels encrypted between your phone and us. Encrypted backups are held with Tigris and with Cloudflare, and those can sit outside Thailand.

We keep your messages for as long as your account exists, because that is the conversation. Operational logs age out on their own within three months. If you delete your account, a copy can remain in a backup for up to 30 days, after which every backup holding it has aged out.

What you can do about it

• Block someone. Blocking stops the conversation from both ends.
• Read what you have. Ask us and we will send you a copy of your account and your messages.
• Delete your account. Ask us and we will delete your account and messages, including ThaiPo's copy. Active sponsorships are cancelled before deletion; deletion waits if cancellation cannot be confirmed. Financial records needed to reconcile payments, refunds and payouts remain with the customer account identifier removed. Stripe retains its own billing records. We will confirm when deletion is complete.

All of it starts at the contact page.

The women here

They are real people who joined by choice, by opening the link themselves and ticking a box that says they are 20 or over and agree to receive messages from customers. That agreement is recorded with the date. For a woman working at one of the bars, her identity document is also checked in person at the venue, for whether it is genuine and not only for the date on it. The whole of it is set out under Safety, including every route back off the service.

Every woman has a drawn portrait, and that illustration is what anyone who is not signed in ever sees. She can also add photographs of herself. Those are real pictures, an operator approves each one before it appears, and only signed-in customers can see them. She can remove any of them whenever she wants.

Anyone here can withdraw at any time, for any reason or none. A woman working at one of the venues tells the venue's management. A woman here independently removes the Official Account on LINE. Either way she is removed and stays removed, including from any later refresh of our records. The contact page does the same thing and reaches a person.

You do not have to be her to ask. If you are a partner, a family member, or anyone who has seen something on this service you think should not be there, the same contact page reaches us and a person reads it. We do not require proof of who you are before taking something down while we look into it.

Treat what she writes to you as private to the two of you. Reposting a woman's messages or her pictures elsewhere is grounds for closing your account, it is a breach of the terms, and it is one of the few things here we cannot undo for her afterwards.

Your rights

Under Thailand's Personal Data Protection Act (PDPA), and equivalent laws elsewhere, you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Ask us and we will sort it out. If you are not happy with how we handled it, you can complain to your local data-protection authority.

Children

This service is for adults. It is not for anyone under 18, we do not knowingly collect anything from anyone under 18, and an account we find to belong to a minor is closed and deleted.

Changes

If we change this policy we will update this page and the date at the top, and say so in the app when the change matters.

Contact

Any question about your data goes to the contact page and a person reads it.