Privacy policy

Who we are

PopNx MCP (mcp.popnx.com) is operated by PopNx, the data controller under Thailand’s Personal Data Protection Act B.E. 2562 (2019).

Visitors

Cookies in your browser remember your language, color theme, beginner mode and the app you chose for installs, for 1 year. There are no advertising or cross-site tracking cookies.

We do not use third-party analytics.

“Ask PopNx” chat

Your question and the last 3 turns of the conversation are sent to Anthropic or OpenAI to write the answer (OpenAI is asked not to store it). We do not store your question text or your IP address.

To limit questions per day we count with a code derived from your IP with a secret key. It cannot be turned back into an IP, changes every day and is deleted the next day.

Chat history stays in your browser only. Press “Start over” to delete it.

When Cloudflare Turnstile is on to stop bots, Cloudflare checks your browser under Cloudflare’s policy.

Do not put personal information in your questions.

Accounts and reviews

You sign in with your Google account. We receive your Google user ID and display name. We do not store your email address, profile picture or Google tokens.

When you sign in we set an HttpOnly session cookie for 30 days and keep only a hash of the session on the server.

Your reviews (rating, text, language, date) are public, shown with your display name. You can change your display name on your account page.

We count reviews per account per day to prevent spam.

How we use data

To show the site in your language and settings, answer chat questions, limit usage, let you sign in and write reviews, and prevent abuse.

We do not sell data, use it for advertising, or use your data to train models.

Service providers

Cloudflare: hosting, database, system logs and Turnstile · Google: sign-in · Anthropic and OpenAI: writing chat answers.

These providers may process data outside Thailand under the protections in their contracts.

How long we keep it

Settings cookies: 1 year in your browser · question counter: 1 day · sessions: 30 days or until you sign out · account and reviews: until you delete them.

System logs sampled by Cloudflare at about 10% (method, path and errors) expire on Cloudflare’s schedule.

Deleting your account

Press “Delete account” on your account page. You are signed out on every device at once and all your reviews are hidden at once.

Within 30 days you can restore it by signing in again and pressing “Cancel deletion”, or press “Delete now”.

After 30 days (or at once with “Delete now”) we delete your account, reviews, sessions and counters. Cached copies of pages expire within minutes, so everything is gone everywhere within 90 days.

After deletion we keep only a record that a deletion happened (a derived code that cannot identify you, and dates) to confirm it was complete.

Your rights

Under Thai law you can access and get a copy of, correct, delete, restrict, object to the use of, and port your data.

You can export your data (display name and reviews) on your account page, and edit or delete reviews at any time.

You can complain to Thailand’s Personal Data Protection Committee office.

Security

Every page uses HTTPS · the session cookie cannot be read by JavaScript · each account’s data is separated in the database · identity comes only from a session the server has verified.

Minors

People under 20 should get a parent’s or guardian’s consent before creating an account or writing reviews.

Changes

If we change this policy we will update the date above and describe the change on this page.