นโยบายความเป็นส่วนตัว

1. Scope

This policy covers all Ohloma services: the website https://ohloma.com, the Ohloma apps for iOS and Android, and the backend services behind them (together, the “Service”).

Ohloma is a platform for following the progress of young swimmers. It brings together competition results from officially published result documents so that parents, athletes and coaches can follow them in one place.

2. Data controller

The data controller for the Service is CNY CORPORATION CO., LTD (“we”).

• Address: 541/1-3 Moo 1, Mae Khri, Tamot, Phatthalung, Thailand
• Privacy contact: [email protected]

3. Data we collect

3.1 Account data you give us when you sign up

• Email address.
• Password: we never store it. We keep only a one-way Argon2id hash, which cannot be turned back into your password.
• The swimming club you choose.
• Email verification status, account status, and when the account was created and last changed.

3.2 Sign-in and security data created as you use the Service

• Session records: when a sign-in started, was last used, expires and ended.
• A description of the device or browser used to sign in (User-Agent).
• One-time codes for email verification and password reset. We store only their hashes.
• Your IP address, used briefly in memory to limit sign-in attempts and block attacks. It is never written to our database.
• System logs recording the request type, the page called, the outcome and the time taken. They contain no passwords, codes or form contents.

3.3 Price

• Ohloma is free, with every feature and no plans or payments. We therefore collect no purchase, paid-subscription or card data.
• If a paid service is ever introduced, we will update this policy and tell you before collecting any related data.

3.4 Data kept only on your device (apps)

• Starred athletes and clubs, names you give athletes yourself, and display preferences stay on your device. We don't receive them, and they are deleted when you delete the app.
• Once the apps offer sign-in, sign-in data will be kept in the operating system's secure storage (Keychain or Android Keystore).

3.5 Swimming competition results

The Service shows competition results compiled from official result documents published by meet organisers. This data does not come from users of the Service and may concern athletes who are minors. It includes:

• The athlete's name as printed, gender, and the club they competed for.
• Age or age group as the meet stated it on the day.
• Events swum, times, places, medals, points, and meet details.
• Date of birth, only where verified evidence exists. We generally don't show it.

We take no contact details, addresses or photos of athletes from these documents.

Competition results are shown only to people who have signed up and signed in, on the website and in the app. They are not open to anonymous visitors or search engines.

3.6 What we don't collect

• Location, contacts, photos, camera or microphone.
• Advertising identifiers (Advertising ID / IDFA).
• Tracking across other apps or websites.
• We use no third-party analytics or advertising tools.

4. Purposes and legal bases

We don't send marketing email. If we ever want to, we will ask for your consent first, and you can withdraw it at any time.

We don't use your data for automated decisions with legal or similarly significant effects on you.

5. Cookies

The website uses only two strictly necessary cookies, which keep you signed in securely.

Both cookies are HttpOnly (page scripts can't read them) and Secure, and are sent only to our website. In production their names start with __Host-. We use no analytics, advertising or tracking cookies.

Because these cookies are necessary, we don't ask for separate consent. If you block them, you won't be able to sign in.

6. Disclosure

We don't sell, rent or trade your personal data. We disclose it only as follows:

• Processors working for us: Amazon Web Services (AWS), which provides our servers, databases and email delivery (Amazon SES). AWS processes data on our instructions, under a contract with data-protection terms.
• Apple and Google, as the app stores you download the app from, under their own privacy policies.
• Public authorities, when the law or a court order requires it.
• A successor to our business in a merger or transfer. They must protect the data at least as well as this policy does, and we will tell you in advance.

Competition results (3.5) are shown only to people who have signed up and signed in.

7. International transfers

The Service stores and processes data on Amazon Web Services servers in Singapore. We comply with sections 28 and 29 of the PDPA by using a provider with appropriate data-protection standards, contractual data-protection terms, and the security measures in section 9.

8. Retention

9. Security

• All traffic between your device and the Service is encrypted with HTTPS (TLS).
• Passwords are stored as Argon2id hashes. One-time codes and sign-in tokens are stored as hashes; the codes themselves are never stored.
• Web sign-in uses HttpOnly, Secure cookies. Sign-in tokens rotate on every renewal and are revoked at once if reuse is detected.
• Resetting your password signs you out on every device.
• Sign-in attempts and email requests are rate-limited to stop password guessing and email flooding.
• Database access is limited by role, and account data is kept in a separate database from competition results.

No system is 100% secure. If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, as the law requires, and notify you when the breach poses a high risk to your rights.

10. Your rights

Under the PDPA you have the right to:

• Access your personal data and get a copy.
• Receive your data in a machine-readable format, and have it sent to someone else (data portability).
• Have inaccurate data corrected and kept up to date.
• Have your data deleted, destroyed or anonymised.
• Restrict our use of your data.
• Object to processing based on legitimate interests.
• Withdraw consent, where we rely on consent.
• Complain to the Office of the Personal Data Protection Committee (PDPC).

Send requests to [email protected]. We may ask you to confirm your identity first, and we will reply within 30 days of receiving the request. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

11. Deleting your account

You can delete your account and its data yourself at any time, without contacting us.

• In the Ohloma app: open your account and choose “Delete account”.
• On the website: sign in at https://ohloma.com/account and choose “Delete account”.
• For your security, you enter your password again before the account is deleted.

If you can't sign in, email [email protected] from the address you signed up with. Details: https://ohloma.com/delete-account

• What is deleted: your account, chosen club, sessions and one-time codes, except records the law requires us to keep.
• When: at once when you delete it in the app or on the website; within 30 days when you ask by email. Either way, every sign-in on every device ends as soon as the account is deleted, and we send a confirmation to the account's email address.
• A deleted account can't be restored, but you can sign up again with the same address at any time.
• Competition results are not linked to user accounts, so they are not deleted with your account. To have them corrected or removed, see section 12.
• On-device data (3.4) is removed when you delete the app.

12. Requests about competition results

An athlete, or a parent or guardian if the athlete is a minor, can ask us to correct inaccurate results, or object to or ask us to remove or limit results shown, at [email protected]. Please give the athlete's name, the meet and what you would like changed.

We check requests against the official result documents and consider objections as the law requires, giving weight to the best interests of minors. We will reply within 30 days.

13. Children

• Ohloma accounts are designed for parents, coaches and athletes.
• Users under 20 need the consent of a parent or guardian before signing up, as section 20 of the PDPA requires.
• Children under 13 should not create their own account. A parent should sign up and manage it.
• If we learn that we hold a minor's data without the consent the law requires, we will delete it promptly. Parents can contact us at [email protected].
• Results of athletes who are minors show only what the competition record needs (section 3.5), with no contact details and no advertising or behavioural tracking.

14. Changes

We may update this policy when the Service or the law changes. The version and effective date are shown at the top of this page. We will tell you about significant changes by email or in the Service before they take effect.

15. Contact

For questions about this policy or your personal data, contact CNY CORPORATION CO., LTD:

• Email: [email protected]
• Address: 541/1-3 Moo 1, Mae Khri, Tamot, Phatthalung, Thailand