Privacy Policy
Version 3
This policy explains how Mythbyte Studio collects, uses, discloses and protects your personal data when you use the game Piggy Days on any platform, the game website, the account centre, the web shop, pre-registration and the help centre (together, the "Service"), under Thailand's Personal Data Protection Act B.E. 2562 ("PDPA").
1. Data controller and contact
- Data controller: Mythbyte Studio, the provider of Piggy Days ("we").
- E-mail for personal data matters and requests: mythbyte.th@gmail.com
2. Data we collect, purposes and legal bases
| Data | Purpose | Legal basis (PDPA) |
|---|---|---|
| Sign-in data: the provider you sign in with (Google, Apple or LINE) and the user ID that provider issues for our game, when it was linked and last used; for Apple, an encrypted token issued by Apple that we use to revoke the connection when you delete your account | Create your account and let you open the same account in the game and on the website | Contract (s. 24(3)) |
| Game data: account number, characters, character names, levels, items, diamonds, gold, pigs, friends, village, progress, and records of items gained and spent | Provide the game, keep your progress, investigate lost items | Contract |
| Chat messages (including the original text before the word filter), your block list, and player reports (reason and the reported messages) | Provide chat, moderate the community, handle reports and rule breaches | Contract; legitimate interests (s. 24(5)) |
| In-game "Report a problem": category, your text, game version and platform; if you choose to attach details: device model, operating system, your last 5 game screens, last 5 error codes, network type and device time | Investigate and fix the problem, reply by in-game mail | Contract; legitimate interests |
| Access logs: IP address, operating system, app version, sign-in channel, installation ID (a random value created when the game is installed, not a hardware ID), log-in and log-out times | Security, preventing cheating and abusive multiple accounts, technical support, player statistics | Legitimate interests |
| Game usage analytics (our own system, no third-party analytics service): screens opened, load times, app errors, low frame rate, platform, app version, a session ID and a hash of your account number — no names, e-mail or chat | Improve performance and stability | Legitimate interests — you can turn it off in the in-game Settings (section 9) |
| In-app purchases (Google Play / App Store): order number, item, amount, currency, store transaction ID and receipt token, time — we never receive your card or payment details | Verify receipts, deliver items, handle store refunds, prevent fraud | Contract; legal obligation (s. 24(6)) for accounting and tax |
| Web purchases (TrueMoney Wallet transfer): amount, transaction reference, the payer's mobile number masked to its last 4 digits, time, the receiving character | Confirm payment, deliver items, refund, prevent fraud | Contract; legal obligation for accounting and tax |
| E-mail address you give when you pre-register (stored encrypted, with IP address, platform and the version of the terms you accepted), contact the help centre, or request account deletion through the form | Deliver pre-registration rewards and tell you when the game launches, answer requests, verify identity for deletion requests | Contract (or steps before a contract) |
| Newsletter e-mail (only if you opt in) | Send game news and promotions until the game launches | Consent (s. 19), withdrawable at any time |
| Help-centre messages and attachments | Support and answers | Contract; legitimate interests |
| Enforcement records (bans and chat mutes: account, IP address, period, reason) | Enforce the Terms of Service and Community Guidelines | Legitimate interests |
| Closed beta (CBT) testers: a keyed hash of the sign-in provider and user ID, the highest level reached and the reward claim status — no names or other gameplay data | Give commemorative items to testers at launch after the test data is wiped | Legitimate interests |
| Essential website cookies (section 8) | Make the account centre and sign-in work, remember that you have seen the cookie notice, and remember the language you chose | Legitimate interests |
We do not request or store the e-mail address, real name or profile picture of your Google, Apple or LINE account (LINE's consent screen may show profile access, but we do not keep your name or picture). We do not collect sensitive data under section 26 (such as health, religion or biometric data) and we do not sell your personal data.
Sign-in data, game data and access logs are needed to provide the game; without them we cannot provide the game to you.
3. Sources
- You directly (character names, chat, e-mail addresses you enter).
- Automatically from your use of the Service (access logs, usage analytics).
- Google, Apple or LINE when you choose to sign in with them (the user ID for our game).
- Google Play, the App Store and TrueMoney (payment and refund status).
- Other players, when they report your messages or behaviour.
4. Advertising
The game shows Google AdMob rewarded ads only when you choose to watch an ad for an in-game reward. The game does not show ads on its own while you play, and not watching ads does not stop you from playing.
- When an ad is requested and shown, Google may use your device's advertising ID (the Advertising ID on Android or the IDFA on iOS), cookies or similar technologies, your IP address and device information to serve ads, measure ads and prevent fraud, as described in How Google uses information from sites or apps that use its services. Google processes this data under its own Privacy Policy.
- We do not receive or store your device's advertising ID. On our side we only record that your account finished an ad and which reward it received, to deliver the reward and prevent duplicate rewards.
- Consent: the game asks for your consent in the game before showing ads, through Google's consent screen (UMP) and, on iOS, Apple's tracking permission prompt (App Tracking Transparency). If you do not consent, you can still watch ads for rewards, but the ads will not be personalised to your interests.
- You can change your ad consent choice at any time in the game's Settings, and on iOS in the device settings (Privacy & Security > Tracking). You can also reset or turn off the advertising ID in your device settings.
5. Disclosure
We disclose data only as needed:
- Google (Google Sign-In, Google Play), Apple (Sign in with Apple, App Store) and LY Corporation (LINE Login): to verify your identity at sign-in, verify receipts and revoke the connection when you delete your account — these providers also process data under their own privacy policies.
- TrueMoney: to accept payments on the website.
- Google (reCAPTCHA): to protect the website's forms (pre-registration, contact, account deletion request) from bots — Google receives page interaction data, IP address and browser data under Google's Privacy Policy and Terms.
- Google (AdMob): when you choose to watch a rewarded ad in the game, see section 4.
- Resend (e-mail delivery provider): to send confirmation and service e-mails to the address you give us, as a data processor.
- The server hosting provider we rent from, which stores the Service's data (location: Thailand (Bangkok)), as a data processor under data-protection terms.
- Other players: your character name, level, pigs, village and chat messages are visible to other players as part of the game.
- Government authorities when required by law, or to establish, exercise or defend legal claims.
Before we start using a new outside provider that receives personal data (for example an e-mail delivery or anti-bot service), we will update this list.
6. International transfers
We store the Service's data on servers in Thailand (Bangkok). Data leaves Thailand only in the following cases, where the recipient is based abroad:
- Google, Apple and LY Corporation (LINE): when you use their sign-in and store services; they receive only what is needed to verify your identity at sign-in, verify store purchases and revoke the connection when you delete your account.
- Resend (e-mail delivery provider): when we send you a confirmation or service e-mail; Resend receives your e-mail address and the content of that e-mail.
- Google (reCAPTCHA): when you use a form on the website (pre-registration, contact, account deletion request); Google receives page interaction data, IP address and browser data as described in section 5.
These transfers rely on section 28 of the PDPA because they are necessary to perform a contract with you or to act on your request (sign-in, store purchases, pre-registration, contacting us, account deletion requests), which you chose to use. When you choose to watch an ad in the game, Google (AdMob), based abroad, receives the data described in section 4 under the consent you give in the game.
7. Retention
| Data | Retention |
|---|---|
| Account, sign-in data, game data | While your account exists; deleted immediately when you delete the account |
| Access logs, item records, chat messages, usage analytics | 180 days |
| "Report a problem" submissions | 180 days |
| Player reports (including the reported messages) | 365 days |
| Order records | 5 years, as needed for accounting and tax |
| Pre-registration e-mail | Deleted 30 days after we send you the launch announcement e-mail, or 30 days after you unsubscribe (link at the end of every e-mail), whichever comes first; unconfirmed sign-ups are deleted 30 days after sign-up; a pre-registration linked to a game account is deleted with the account when the account is deleted (within 24 hours if deleted in the game) |
| Help-centre requests (including their messages) | 1 year after the request is closed, then deleted |
| CBT tester hashes | Deleted within 90 days after the official launch |
| Database backups | Up to 30 days |
Closed beta (CBT): all game data of the test period, including accounts and characters, is wiped when the test ends, except the tester hashes above. Backups taken before the wipe are kept for 30 days after the wipe and then deleted.
After you delete your account we keep only data that does not identify you: order records unlinked from the account and characters (5 years), access logs with the IP address and installation ID removed (until their 180 days end), a record of which account number was deleted, when and through which channel, and hashes of the account and character names for 30 days to prevent impersonation. Staff activity records about your account have their personal content removed.
Data deleted from the live system may remain in backups until those backups expire (at most 30 days); we do not use it.
8. Website cookies
The website uses only essential cookies and no analytics or advertising cookies.
| Cookie | Purpose | Lifetime |
|---|---|---|
sp_consent | Remembers that you have seen the cookie notice | 180 days |
sp_acct | Keeps you signed in to the account centre | While signed in |
sp_oauth | Protects the sign-in flow with Google, Apple or LINE against forgery | 10 minutes |
sp_lang | Remembers the language you chose (th or en); set only when you choose a language yourself (the language switch or a link with ?lang=); not used to track you | 1 year |
9. Your rights
Subject to the PDPA you have the right to:
- access and obtain a copy of your data, and ask us to disclose how we obtained data you did not consent to (s. 30);
- receive your data, or have it sent to another controller, in a commonly used machine-readable format (s. 31);
- object to collection, use or disclosure (s. 32);
- have your data erased, destroyed or anonymised (s. 33);
- restrict the use of your data (s. 34);
- have your data corrected and kept up to date (s. 35);
- withdraw consent at any time, without affecting anything done before (s. 19);
- complain to the Office of the Personal Data Protection Committee (PDPC).
How to exercise them: delete your account yourself (section 10); turn off usage analytics in the in-game Settings; withdraw your newsletter consent with the unsubscribe link at the end of every e-mail or by e-mailing us. For any other right, e-mail mythbyte.th@gmail.com with your account number or character name and the sign-in channel you use. We may ask you to verify your identity first. Requests are free, and we answer within 30 days of receiving them. If we refuse a request we will give the reasons the law requires.
10. Account deletion
You can delete your account in three ways:
- In the game: Settings → Linked accounts → Delete account → review what will be lost → type the confirmation phrase → confirm your identity again with the linked Google, Apple or LINE account.
- On the website, without installing the game: the account deletion page — sign in with the channel linked to your game account and follow the same steps as in the game.
- If you can no longer sign in with the linked channel: use the deletion request form or e-mail mythbyte.th@gmail.com; we check that you own the account before deleting it.
Deletion takes effect immediately once confirmed. There is no grace period and it cannot be undone. All characters, items and remaining diamonds are lost and are not refunded. What we keep afterwards is described in section 7. Deleting your account does not cancel store purchases, which you manage with the store.
11. Minors
We do not knowingly collect data from children under 10 without the consent of the person exercising parental power, as required by section 20 of the PDPA. Minors (under 20) should use the Service and make purchases with a parent's or guardian's consent. If a parent finds that a child gave us data without consent, contact mythbyte.th@gmail.com and we will delete the data or the account.
12. Security
We encrypt traffic between the app, the website and our servers (HTTPS / WSS), store pre-registration and help-centre e-mail addresses and sensitive tokens encrypted, keep the database closed to the internet, limit the admin panel to authorised staff with a password and two-factor authentication, and log every staff action.
13. Personal data breaches
If a personal data breach occurs, we will notify the PDPC within 72 hours of becoming aware of it, unless the breach poses no risk to your rights and freedoms. If the risk is high, we will also inform you without delay, together with the remedies.
14. Changes to this policy
When we change this policy we publish the new version on the website with its effective date. For material changes we announce them in the game or on the website before they take effect, and ask for consent again where the law requires.
15. Contact
Mythbyte Studio — e-mail mythbyte.th@gmail.com
If the Thai and English versions differ, the Thai version prevails.