Privacy Policy
Last updated: 13 September 2026
This policy explains how the developer of the Berry Bloom application ("we", "us") collects, uses, discloses and retains the personal data of Berry Bloom players, under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).
We collect only what running the game and handling its payments requires. We do not sell your personal data, and the application contains no third-party advertising or behavioural analytics SDK.
The Thai version of this document is the operative one. This English translation is provided for convenience; where the two differ, the Thai text prevails.
1. Data controller
The data controller is the developer of the Berry Bloom application. For anything concerning personal data, contact vorapon1995@gmail.com.
2. What we collect
| Category | Detail | Source |
|---|---|---|
| Account data | Email address, display name, first and last name, avatar (if any), email verification status | You, or your sign-in provider |
| Authentication data | A hash of your password (argon2id — we never store the password itself), and the user identifier and email from any Google or Apple account you link | You, or Google / Apple once you consent |
| Session data | Hashes of your sign-in tokens, their expiry, and the device or browser user agent | Generated automatically when you sign in |
| Gameplay data | Levels completed, scores, stars, hearts, mission progress, items held, gold and token balances, and the full ledger of balance movements | Produced by your play |
| Payment data | Store receipts, product identifiers, amounts, currency, platform (iOS/Android), timestamps and the fees deducted — we never receive your card or payment account details | Apple App Store or Google Play |
| Payout data | Bank, account number, account name and transfer evidence, for players taking gold out as cash | You, given to our staff |
| Technical data | IP address, request time, path, correlation identifier and error messages | Generated automatically by using the Service |
| Support correspondence | The content of emails or messages you send us | You |
We do not collect location, contacts, on-device photos, or any sensitive data under section 26 of the PDPA, and the application does not request permission for them.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account so you can sign in and keep playing across devices | Performance of a contract |
| Storing progress, gold and token balances, and transaction history | Performance of a contract |
| Verifying store receipts and crediting what you bought | Performance of a contract |
| Making the bank transfers you request and keeping evidence of them | Performance of a contract; legal obligation |
| Preventing fraud, cheating and account takeover, and keeping the system secure | Legitimate interest |
| Answering support requests and handling complaints | Performance of a contract; legitimate interest |
| Accounting and tax records | Legal obligation |
| Understanding aggregate, non-identifying usage in order to improve the game | Legitimate interest |
5. Transfers outside Thailand
Our servers and database are operated by Railway Corp., and our sign-in and payment providers are foreign companies, so your data may be stored or processed outside Thailand. We select providers that maintain appropriate safeguards and standard data processing terms.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and gameplay data | While the account is active; erased when you delete it |
| Session and token data | Until expiry or revocation, normally no more than 90 days |
| Technical logs | No more than 90 days |
| Payment, payout and accounting records | 10 years, as Thai accounting and tax law requires |
| Deletion record | A hash of the email address and the deletion date, kept to verify support requests and prevent abuse. It contains no readable name or address |
7. Deleting your account
You can delete your account yourself from the settings screen. Doing so immediately erases your account data, sign-in data, gameplay data and all balances.
Two things survive: (1) a hash of your email address with the deletion date, which cannot be turned back into the address, and (2) the payment and transfer records that accounting and tax law require us to keep, access to which is restricted to accounting and audit work.
If you want us to delete the account for you, or you can no longer sign in, email vorapon1995@gmail.com from the address on the account and we will act within 30 days.
8. Your rights
Under the PDPA you have the right to:
- access your personal data and obtain a copy;
- have inaccurate or out-of-date data corrected;
- have data erased or destroyed once it is no longer necessary, or when you withdraw consent;
- have processing suspended;
- object to processing based on legitimate interest;
- receive your data in a machine-readable form and have it sent to another controller;
- withdraw a consent you previously gave, without affecting processing already carried out;
- lodge a complaint with the Personal Data Protection Committee.
To exercise any of these, email vorapon1995@gmail.com. We will verify your identity first and respond within 30 days. There is no charge, unless a request is manifestly repetitive or excessive.
9. How we protect it
- All traffic between the application and our servers is encrypted with HTTPS/TLS.
- Passwords are hashed with argon2id; we have no way to read yours.
- Sign-in tokens are stored as hashes, rotated on every use, and the whole family is revoked the moment reuse is detected.
- On your device, tokens live in the iOS Keychain or Android EncryptedSharedPreferences, not in plain files.
- Staff access is limited to those who need it, goes through a separate back-office system, and every action affecting an account or money is recorded in an audit trail.
- Rate limiting is applied to reduce the risk of password guessing and abuse.
If a personal data breach occurs that presents a risk to your rights and freedoms, we will notify the Personal Data Protection Committee within 72 hours, and notify you without delay where the law requires it.
10. Children
The Service is not directed at children under 13 and we do not knowingly collect their data. A parent who finds that an under-age child has created an account should contact us so we can delete it and the associated data.
For users under 20, every payment requires a guardian's consent, as stated in the Terms and Conditions.
11. This website
These pages are static content. They set no marketing cookies, run no third-party analytics, and do not track visitors. Our infrastructure provider may log IP addresses and access times briefly as a routine security measure.
12. Changes to this policy
We may update this policy when the Service or the law changes. The version in force is published on this page with the date it was last updated, and material changes are announced in the application with reasonable notice.
13. Contact and complaints
Questions, requests to exercise a right, or complaints about personal data go to vorapon1995@gmail.com.
If our answer does not satisfy you, you may complain to Thailand's Personal Data Protection Committee through the channels it publishes.