Privacy Policy

1. About this policy

This Privacy Policy explains how AlphaOS collects, uses, stores, and protects your personal data, and the rights you have over it. AlphaOS is operated by an individual based in Thailand, referred to here as “the AlphaOS operator,” “we,” “us,” or “our.”

This policy is written with Thailand’s Personal Data Protection Act B.E. 2562 (the “PDPA”) as its frame. For the purposes of the PDPA, the AlphaOS operator is the data controller for the personal data described below. This policy reflects how the Service actually works today; it has not been reviewed by legal counsel.

2. Data we collect

We collect only what we need to run AlphaOS for you:

• Identity data: your email address, display name, and either a hashed password or, if you use Google sign-in, your Google account identity. We never store your password in plain text.
• Portfolio data: the information you enter to track your investments, including transactions, holdings, account names, and notes.
• Technical data: a session cookie that keeps you signed in, and basic server logs generated when your browser talks to our servers.

We do not use advertising trackers or analytics cookies. The only cookies AlphaOS sets are the session cookies needed to keep you signed in.

3. Why we use your data and our lawful basis

Under the PDPA, we rely on the following lawful bases:

• Performance of the service you asked for (contract): to create and secure your account, store and display your portfolio, and provide features such as data export.
• Legitimate interest: to keep the Service secure, prevent abuse, maintain deliverable email (for example, suppressing messages to addresses that bounce or complain), and fix problems.
• Consent: where we ask for it, such as when you choose to sign in with Google. You can withdraw consent at any time, as described in Section 8.
• Legal obligation: where we must retain or disclose data to comply with applicable law.

We do not sell your personal data, and we do not use it for advertising or for automated decisions that produce legal or similarly significant effects on you.

4. How we protect your data

We apply technical safeguards appropriate to a personal-finance tool. Where it is used to look up records, personal data is protected using keyed hashing (HMAC), and sensitive fields are encrypted at rest using authenticated encryption (AEAD) where applicable. Passwords are stored only as secure hashes, never in plain text. Access to the Service is protected by session cookies, and connections are encrypted in transit.

No system is perfectly secure, but we work to protect your data against unauthorized access, loss, and misuse.

5. Where your data is stored and processed

AlphaOS relies on trusted service providers to operate. Using the Service involves transferring your personal data to, and processing it in, countries outside Thailand:

• Application hosting — Vercel: serves the AlphaOS web application.
• Database — Supabase (PostgreSQL): stores your account and portfolio data, hosted in Singapore (AWS ap-southeast-1).
• Transactional email — Resend: sends account and security emails, using infrastructure in the United States.
• Market data providers: we retrieve market and reference data from third parties such as Yahoo Finance and Thai SEC Open Data. We send them the symbols we need to look up, not your account or portfolio data.

This means your data may be transferred to and stored in Singapore and the United States. We share the minimum personal data necessary for each provider to perform its function.

6. How long we keep your data

We keep your personal data for as long as your account is active. When you delete your account, we apply a short soft-delete grace period during which the deletion can be reversed; after that period ends, your personal data is permanently purged from our active systems. We may retain limited records for longer only where a legal obligation requires it. Backups and logs are retained for a limited period and then rotated out.

7. Sharing your data

We do not sell or rent your personal data. We share it only with the service providers listed in Section 5, who process it on our behalf to run the Service, and where we are legally required to disclose it (for example, in response to a valid legal request).

8. Your rights under the PDPA

Subject to the conditions and exceptions in the PDPA, you have the right to:

• Access the personal data we hold about you and obtain a copy of it;
• Rectify data that is inaccurate, incomplete, or out of date;
• Erase your personal data (for example, by deleting your account);
• Data portability — receive your data in a commonly used, machine-readable format;
• Object to certain processing of your data;
• Withdraw consent at any time where our processing is based on consent, without affecting processing that already took place.

Some of these rights are already built into AlphaOS: you can export your full account data and delete your account from within the app at any time. For any other request, contact us using the details in Section 11. You also have the right to lodge a complaint with Thailand’s Personal Data Protection Committee.

9. Email communications

We send transactional emails needed to run your account, such as sign-in, verification, password reset, and security notices. To keep our email deliverable and respect your inbox, we automatically suppress future emails to an address that bounces or reports a message as spam.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the version and effective date at the top of this page. For material changes, we will make a reasonable effort to notify you, for example by email or an in-app notice.

11. Contact and data protection

For any privacy question or to exercise your rights, contact the AlphaOS operator, who serves as the point of contact for data protection matters, at support@alpha-os.app.