TonPing privacy policy

App: TonPing (โอนปิ๊ง), package com.tonping.app

Effective date: [[EFFECTIVE_DATE]] Last updated: [[EFFECTIVE_DATE]]

1. Who we are

TonPing is operated by [[COMPANY_NAME_EN]] (“TonPing”, “we”, “us”), registered address [[REGISTERED_ADDRESS]].

Privacy contact: [[PRIVACY_EMAIL]] · Phone: [[PHONE]] · Data Protection Officer (if appointed): [[DPO_NAME_OR_CONTACT]]

This policy covers the TonPing Android app, the TonPing server that the app connects to, and the website at tonping.io. It is written to follow Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and Google Play’s User Data policy.

2. What TonPing does, in one paragraph

TonPing is a subscription service for businesses. You install the app on an Android phone that stays on and receives text messages (SMS). The app is that phone’s default SMS app. It also, only if you turn it on, reads notifications from bank apps you choose. For each message that matches a forwarding rule you set, the app sends the message to the TonPing server, and the server forwards it to the webhook address (URL) you entered, which is normally your own server. Messages that match no rule stay on the phone and are not uploaded.

3. Data we collect and why

Data	What exactly	Why we use it	Required?
Account	Email address; password (the server stores only a one-way hash, never the password itself); account status and device quota; [[ROUND3: sign-in with Google gives us your Google account email and an account identifier, nothing else]]	Create and secure your account, sign you in, apply your plan limits, contact you about your service	Yes
Device details	A name for the phone (you or the app chooses), manufacturer, model, Android version, app version; a public key the app creates for this phone (the private key never leaves the phone’s secure key store); a random device ID	Register the phone, verify that every upload really came from your phone, show you which phones are connected, support	Yes
Forwarded messages (SMS)	Sender (phone number or name), message text, time sent and received, which SIM slot (if available), which of your rules matched, a message ID created by the app, and whether the message was recovered after the phone missed it	Deliver the message to your webhook, which is the service you subscribed to	Yes, for messages that match your rules
Forwarded bank-app notifications (only if you turn this on)	Sender app package name, notification title and text, time	Deliver the notification to your webhook, as with SMS	No, optional
Forwarding settings	Webhook URL, a secret key we generate to sign each delivery, and your rules (sender, words that must or must not appear)	Run the forwarding service	Yes
Device health report (“heartbeat”)	Every 5 minutes while the app runs: battery level and charging state, network type (Wi-Fi/mobile), number of messages waiting to send, time of last message received and last upload, whether TonPing is the default SMS app, whether battery restrictions are lifted, whether the background service is running, app version	Detect that a phone has stopped working, wake it, and send you a “device offline/online” event so you do not miss payments	Yes
Push token	The Firebase Cloud Messaging (FCM) token of the phone and a Firebase installation ID	Send a silent wake-up signal to a phone that has gone quiet. The wake-up contains no message content	Yes
Delivery history	For each webhook delivery: time, HTTP status code, duration, error text, and up to 1 KB of your server’s reply	Retry failed deliveries, show you what happened	Yes
Device events	Login, silent, wake sent, offline, back online, revoked	Detect and report device problems	Yes
Subscription	[[ROUND3: Google Play purchase token, product, status and expiry date. Google handles payment; we never see your card or bank details]]	Check that your subscription is active	Yes
Technical data	IP address and time of requests to our server; request counts per email and IP to block password guessing. [[CONFIRM: web server and container logs: what is logged, who can read it, and how long it is kept]]	Security, abuse prevention, fixing errors	Yes

What TonPing does not collect: your contacts, location, photos, files, microphone, call history, or a list of the apps installed on your phone. The app has no advertising SDK, no analytics SDK and no crash-reporting SDK. We do not sell your data and we do not use it for advertising.

3.1 Text messages and notifications are filtered on your phone

• All SMS the phone receives are stored in the phone’s normal SMS storage, because TonPing is the default SMS app. That is on your phone, under your control.
• The app compares each message with your rules on the phone. Only messages that match are uploaded. Rules must name a sender, so the app cannot be set to upload every message.
• Notifications: Android gives a notification-access app visibility of every notification on the phone. TonPing keeps the content only of notifications from apps for which you created a rule. For every other app it keeps just the app’s package name and the time, on the phone only, so you can pick the app when you create a rule. None of that is uploaded.
• Messages and notifications can contain financial information such as amounts, balances and account digits, and can contain personal data of the people who paid you. TonPing processes this only to forward it to the destination you chose.
• The app uploads nothing until you have tapped “I agree” on the in-app disclosure screen.

4. Our roles under the PDPA

• For your account, device and billing data, we are the data controller.
• For the content of the messages and notifications you forward, you decide the purpose (receiving that content on your own systems) and we process it on your behalf, so we act as your data processor. You, the customer, are the controller of that content, including towards the people who sent you the messages. [[CONFIRM WITH LAWYER: processor role and whether a data processing agreement must be offered to business customers — see 08-pdpa-checklist.md]]
• We use the content only to deliver it to you, to retry delivery, to show you delivery history, and to keep the service secure. We do not read it for any other purpose.

5. Legal bases (PDPA)

Purpose	Basis
Provide the service you subscribed to (account, device registration, forwarding, retries, heartbeat, wake-up)	Performance of a contract
Security, fraud and abuse prevention, rate limiting, logs	Our legitimate interests
Reading SMS as the default SMS app; reading bank-app notifications	Your consent, given on the in-app disclosure screens. You can withdraw it (section 10)
Tax, accounting and legal requests	Legal obligation

6. Where your data goes

Recipient	What	Why
Your own webhook server (the URL you set)	Message content and device events, signed with your secret	This is the service. We do not control your server; what it does with the data is your responsibility. Use HTTPS only (the app and server reject non-HTTPS URLs)
Google Firebase Cloud Messaging (Google LLC)	Your phone’s push token and a wake-up signal with no message content; Firebase installation ID	Wake a silent phone. Google acts as our service provider
Google Play (Google LLC)	[[ROUND3: purchase token and subscription status exchanged to verify your subscription]]	Billing. Google processes payment under its own policy
Hosting provider [[HOSTING_PROVIDER_AND_REGION]]	All server-side data above	Runs our server and database
Email provider [[EMAIL_PROVIDER]] [[ROUND3: only if account emails such as verification or password reset are sent]]	Your email address and the email text	Send account emails
Authorities	Only what the law requires	Legal obligation

We do not sell personal data, do not share it for advertising, and do not give it to anyone else.

International transfer. Our server is located in [[SERVER_COUNTRY]]. Google Firebase and Google Play process data in countries outside Thailand. [[CONFIRM WITH LAWYER: PDPA cross-border transfer basis for each recipient]]

7. How long we keep data

Data	Where	Kept for
Forwarded message content (SMS and notifications)	Our server	90 days, then deleted automatically every day. A message still waiting for a delivery that is retrying is kept until that delivery finishes
Webhook delivery history (including your server’s reply snippet)	Our server	90 days after the delivery, then deleted
Device events (login, offline, online…)	Our server	90 days, then deleted
Account, device records, webhook URL and secret, rules	Our server	Until you delete the account or device. [[CONFIRM: how long after the subscription ends we keep an inactive account before deleting it]]
Latest heartbeat	Our server	Only the most recent report is kept; each new one overwrites it
Database backups	Our backup storage	Backups are kept 14 days, so deleted data can remain in a backup for up to 14 more days. [[CONFIRM: backups are encrypted and who can access them]]
Technical logs	Our server	[[CONFIRM: log retention period]]
Messages waiting to send, and already-sent or filtered messages	Your phone, in TonPing’s private storage	Sent and filtered messages: deleted after 7 days. Waiting messages: kept until sent (we stop after the subscription has been inactive for 7 days)
SMS in the phone’s SMS storage	Your phone	Until you delete them; this is the phone’s normal SMS inbox
Billing records	Google and [[ROUND3: us]]	As required by tax and accounting law [[CONFIRM: period]]

Uninstalling the app removes TonPing’s private storage on the phone. It does not delete server-side data; to remove that, delete your account (section 10).

8. Security

• All traffic between the app and the server uses HTTPS; the released app refuses unencrypted connections.
• Each phone signs every request with its own private key stored in the Android Keystore. The server keeps only the public key, so a copy of our database cannot be used to forge messages.
• Each webhook delivery is signed with HMAC-SHA256 using your secret, so your server can verify it came from us. You can rotate the secret at any time in the app.
• Passwords are stored as argon2id hashes. Repeated failed sign-ins are rate-limited.
• Each customer’s data is separated by account in our database.
• The app excludes its data from Android cloud backup and device-to-device transfer.
• No system is perfectly secure. If a personal data breach is likely to put you at risk we will notify the Personal Data Protection Committee within 72 hours of becoming aware, and notify you without undue delay where required by law.

9. Permissions the app asks for

Android permission or access	Why
Default SMS app role; RECEIVE_SMS, READ_SMS, RECEIVE_MMS, RECEIVE_WAP_PUSH	Receive messages and show them in TonPing’s inbox, then match them against your rules
SEND_SMS	Send a text message when you write one in TonPing’s basic messaging screen
Notification access	Read bank-app notifications you choose, only if you accept the second disclosure. You can switch this off in TonPing’s status screen or revoke it in Android settings
Internet / network state	Talk to the server
Notifications (Android 13+)	Show the “TonPing is running” notice
Foreground service, start after boot	Keep TonPing alive and resume after the phone restarts
Ignore battery optimisation	Stop Android from pausing TonPing so messages are forwarded on time

10. Your rights and how to use them

Under the PDPA you may ask to: access your personal data and get a copy; receive it in a portable format; correct it; object to or restrict its use; have it erased; and withdraw consent at any time (withdrawing does not affect earlier processing). You may also complain to the Personal Data Protection Committee (pdpc.or.th).

• Delete your account and data: in the app go to [[ROUND3: Settings → Delete account]], or at https://tonping.io/delete-account on our website (no app needed), or email [[PRIVACY_EMAIL]]. We delete the account, devices, rules, webhook settings and server-held messages [[CONFIRM: within 30 days]], except what we must keep by law, which we will tell you about.
• Stop reading SMS: switch the default SMS app to another app in Android settings.
• Stop reading notifications: use the toggle in TonPing’s status screen, and revoke access in Android’s notification-access settings.
• Other requests: email [[PRIVACY_EMAIL]]. We answer within 30 days. If you are an end customer of a TonPing customer (for example you paid them and your name is in a forwarded message), contact that business first; they are the controller of that content.

11. Children

TonPing is for businesses and is not directed at children under 18. We do not knowingly create accounts for them.

12. Changes

If we change how we use data we will update this page and the date above. For material changes we will show a notice in the app and ask for consent again where the law requires it.

13. Cookies and Facebook Pixel

This section applies to the tonping.io website only, not the TonPing Android app (the app has no advertising or analytics SDK, see section 3).

Sections 3 and 6 describe the app and the server. On the website only, and only with your consent, Meta Platforms, Inc. is an additional recipient, as described below. Nothing from the app, and no message content, account data or device data, is sent to Meta.

• The website sets no cookies of its own. The only thing it stores in your browser is your cookie choice, in localStorage under the key tp-consent.
• The Facebook Pixel loads only after you press “Accept”. If you have not chosen, or you press “Decline”, the site does not load the Pixel and sends nothing to Meta.
• What is sent to Meta Platforms, Inc. once you accept: the URL of the page you open, the page you came from (referrer), your IP address, browser details (such as User-Agent and language), the identifiers stored in the _fbp and _fbc cookies, and event names: PageView when a page opens, and Lead when you press the button to Google Play. After you accept, Meta may set the cookies _fbp and _fbc in your browser. Meta processes this data under its own policy, possibly outside Thailand. We use it only to measure the results of TonPing’s advertising to website visitors; this is the only advertising-related use of data, and it does not involve app or message data.
• Legal basis: your consent.
• Withdraw consent: press “Cookie settings” in the footer of any page and choose “Decline”. The site updates tp-consent and deletes the _fbp and _fbc cookies that Meta set on our domain. You can also clear cookies in your browser settings. Withdrawing does not affect earlier processing.
• Controls on Meta’s side: you can adjust ad preferences in your Facebook account settings.

14. Contact

[[COMPANY_NAME_EN]] · [[REGISTERED_ADDRESS]] · [[PRIVACY_EMAIL]] · [[PHONE]]