Privacy Policy

We collect the following categories of personal data:

• Account information — your name, email address, and password (passwords are stored only in hashed form). If you sign in with Google, we receive your name, email address, and Google account identifier.
• Learning activity — courses you enroll in, lesson and topic progress, quiz and coding-exercise submissions, certificates, and notes you create.
• Code you submit — source code you run or submit for automated grading is sent to our code-execution service for the purpose of running and evaluating it.
• Payment information — when you purchase a course or bundle, payment is processed by Stripe. We do not store your full card number. We retain order records, amounts, currency (THB), and payment status.
• Communications — support tickets, bug reports, course reviews, and any messages you send us.
• Technical data — log data such as IP address, browser type, device information, and timestamps, used for security and to operate the Service.

We use your personal data to:

• Create and manage your account and authenticate you;
• Deliver course content, track your progress, and grade exercises;
• Process payments, issue receipts, and grant enrollments;
• Issue certificates for completed courses;
• Send transactional emails such as account, purchase, and support notifications;
• Respond to your support requests and bug reports;
• Maintain the security, integrity, and performance of the Service; and
• Comply with our legal obligations.

Depending on the activity, we rely on one or more of the following legal bases under the PDPA: your consent; performance of a contract with you (providing the Service you signed up for); compliance with a legal obligation; and our legitimate interests in operating, securing, and improving the Service.

We share personal data only with trusted service providers who process it on our behalf, and only as necessary to provide the Service:

• Google — authentication when you sign in with Google.
• Stripe — payment processing. Your card details are provided directly to Stripe and are governed by Stripe's privacy policy.
• Supabase — file and media storage.
• Our code-execution service — running and grading code you submit.
• Email delivery provider — sending transactional emails.

We do not sell your personal data. We may disclose data if required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of RuffBlitz, our users, or others.

We use browser local storage to keep you signed in (an authentication token) and to remember preferences such as your language and theme. We use cookies and similar technologies as needed to operate the Service. Disabling these may prevent you from staying signed in or using certain features.

We retain your personal data for as long as your account is active or as needed to provide the Service. After account deletion, we may retain certain records (for example, order and payment records) for as long as required to comply with legal, accounting, or reporting obligations, after which the data is deleted or anonymized.

Subject to the PDPA, you have the right to: access and obtain a copy of your personal data; request correction of inaccurate data; request erasure or restriction of processing; object to processing; request data portability; and withdraw consent at any time (without affecting processing already carried out). To exercise these rights, contact us at the address below. You also have the right to lodge a complaint with Thailand's Personal Data Protection Committee (PDPC).

Our Service is intended for students, including secondary-school students who may be minors. If you are a minor under the age at which you can give valid consent under Thai law, you must obtain consent from your parent or legal guardian before using the Service. A parent or guardian may contact us to review, correct, or delete their child's personal data. If we learn that we have collected personal data from a minor without the required consent, we will take reasonable steps to delete it.

We implement reasonable technical and organizational measures to protect your personal data, including hashed password storage and encrypted connections (HTTPS). However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Some of our service providers may process data on servers located outside Thailand. Where personal data is transferred internationally, we take steps to ensure an adequate level of protection consistent with the PDPA.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

If you have questions about this Policy or wish to exercise your rights, contact us at teejuta.sriwaranon@gmail.com.