Privacy Notice

1. Controller and contact

DOZI is the personal data controller for the DOZI service. For privacy questions or rights requests, contact privacy@dozi.app.

2. Data we may process

• Account data from Google or Discord, such as provider user ID, email, display name and avatar.
• Session and security data, such as hashed session tokens, access times, IP/technical logs and audit logs needed for security and troubleshooting.
• Feature activity such as store check-ins, events or play sessions you create/join, and content users or merchants publish in the service.
• Location when you invoke nearby/map features, used when needed to fulfil that request.
• Analytics and performance data only when you consent through cookie settings.

3. Purposes and lawful bases

• Create and operate accounts, check-ins, player discovery, stores and events: necessary to provide the requested service.
• Security, abuse prevention and incident investigation: legitimate interests and/or applicable legal obligations.
• Non-essential analytics and performance measurement: consent, which can be withdrawn at any time via Cookie settings.
• Compliance with binding government or legal requirements: legal obligation when applicable.

4. Recipients and processors

DOZI may use hosting/database providers, Google or Discord for OAuth, map providers when you use related features, and Vercel Analytics/Speed Insights only with consent. We disclose data to authorities only when legally required.

5. International transfers

Some service providers may process data outside Thailand. Where data is transferred, DOZI will use applicable safeguards or transfer mechanisms required by law.

6. Retention

• Normal sessions expire after up to 30 days unless revoked earlier.
• OAuth security state expires after about 10 minutes.
• Account and service data is retained while the account remains active or as needed for the stated purposes.
• Audit/security logs and Privacy Notice acknowledgement evidence may be retained as needed for compliance, disputes and security.

7. Your rights

Subject to applicable legal conditions, you may have rights to access/copy, rectify, erase, restrict, object, obtain portability, withdraw consent, and complain to Thailand's Personal Data Protection Committee. Withdrawal does not affect processing that was lawful before withdrawal.

8. Cookies and similar technologies

See cookie categories, durations and how to change preferences in the Cookie Policy.

9. Changes to this notice

If material terms change, DOZI will publish a new version and request acknowledgement again when appropriate.