Privacy
My main line of work is other people's security, so this page is not a policy copied from somewhere else. It is a list walked out of the code that is actually running, table by table. If it is not in the code it is not on this page, and if it is in the code I wrote it down even where it does not look flattering.
What is actually stored
Grouped by what you do on the site. If you only read pages, not a single row below ever gets written.
When you send the project form
Only happens when you press send on the order form
| What | Why | How long | Who can see it |
|---|---|---|---|
| Your name, how to reach you, what your business does, what you want, budget and timing | To reply to you, and to write up the scope and the price | Kept as the record of the job. Nothing deletes it automatically. Deleted when you ask | Me only |
| The IP address the form was sent from | To trace back when someone floods the form with fake submissions | Sits in the same row as the enquiry and goes with it | Me only |
| Which site sent you here, and the first page you opened | So I know which channel real clients come from and do not waste effort elsewhere | Sits in the same row as the enquiry and goes with it | Me only |
The last two are held in your own browser first (sessionStorage) and are only sent when you press send yourself. Close the tab without sending and they disappear without me ever seeing them.
When you create an account and use the chat
Only happens if you sign up or sign in. Reading the site needs no account
| What | Why | How long | Who can see it |
|---|---|---|---|
| Email address | It is the identity of the account and the way I can reply to you | Until you ask for the account to be deleted | Me only |
| Name and profile picture from Google | Shown as your picture in the chat. Not used for anything else | Until you ask for the account to be deleted | Me only |
| Password, stored only as a scrypt hash | To check it is you when you sign in | Until you ask for the account to be deleted | Nobody sees the real password, including me. It was never stored |
| Every chat message with its timestamp | So a conversation can carry on instead of starting over each time | Gone the moment the account is deleted. The database enforces that, it does not rely on me remembering | You and me |
| What you need, a rough budget and where to reply, if you leave those | Used when you message while I am away from the screen, so I come back to the right place | Goes with the chat thread when the account is deleted | You and me |
| Username, full name and contact details you type into account settings | Used on documents and while working on your project. The site works the same if you leave them blank | Until you clear them, or ask for the account to be deleted | Me only, except the username, which is the name shown in chat |
The account and chat tables have no column for an IP address, no phone number and no postal address. It is not that they are collected and unused. There is nowhere to put them, by design.
When you pay and once you have invoices
Only happens when you open a payment for work already agreed, and when I issue you an invoice
| What | Why | How long | Who can see it |
|---|---|---|---|
| Item code, amount, status, and the name and contact you enter at payment | To issue documents and to be able to look up later what was agreed | Kept as an accounting record. Nothing deletes it automatically | Me only |
| The transfer slip image you upload and the reference number on it | To confirm the money arrived, and to stop the same slip being reused on a second order | Kept with that payment record | Me only |
| The website address you enter when ordering a security audit package | It is what says which site to audit. Without it the work cannot be done | Sits in the same row as the payment and goes with it | Me only |
| The IP address the payment was opened from | To check back when a payment looks wrong | Sits in the same row as the payment | Me only |
| Your invoices, tied to the account email, with the service, package, amount, paid or unpaid, and the period | To issue documents, and so you can open your own purchase history in account settings | Kept as an accounting record. Nothing deletes it automatically | You and me. The lookup only ever uses the email on the signed-in session, so nobody can ask for somebody else's |
| Any monthly care plan you are on, the package, the price per cycle, the start date and the next one | To know what is under care for you and when the next cycle falls due | Until you stop that service | You and me |
| A record of which months a summary email has already gone to your address | So a rerun of the script cannot send you the same month twice | Kept as a log of the mail system | Me only |
There is no card number, no CVV and no bank account detail of yours anywhere in this system. Payment is by Thai PromptPay QR with a transfer slip. Cards are never handled here. Quotes I issue also store the name they are addressed to and the lines on them, because you need to be able to quote the document number back to me months later.
When you use the free tools
The free site check and the demo chatbot. No sign-in needed
| What | Why | How long | Who can see it |
|---|---|---|---|
| A count of uses and the time of each, and nothing else | To see whether the free tools are still worth keeping running | Kept as a plain total, not linked to you | Me only |
| IP address inside the rate limiter | To stop one person hammering the free tools, and to stop strangers spending my AI budget | The counter expires in one to two hours and is never read again. Old rows are cleared by a sweep I run by hand. It is not on a timer yet | Me only |
The address you scan, the result you get and the question you type into the demo bot are never written to the database at all. The stats table has exactly two columns: event type and time. Data you never keep is data that can never leak.
Three cookies, all of them necessary
All three are needed for the site to work. None of them tracks you, and none of them is sent anywhere except this site's own server.
| Cookie | What is inside | Lifetime | How it is set |
|---|---|---|---|
zl_session | Your user id, an expiry time and an HMAC-SHA256 signature that stops the value being edited. No personal data inside | 30 days | HttpOnly · SameSite=Lax · Secure in production |
zl_oauth | The state value and PKCE verifier used while sending you to Google's consent screen and back | 10 minutes, and deleted the moment you come back from Google | HttpOnly · SameSite=Lax · Secure in production |
zl_theme | The single word light or dark. Nothing else | 1 year | Not a secret. The browser writes it, so switching themes is instant instead of waiting on the server |
No advertising cookies, no cross-site tracking cookies, no Google Analytics, no Facebook Pixel. That is why this site never throws a cookie consent bar at you. Not because it skips the step, but because there is nothing to ask about. Visitor counting is Vercel Analytics, which works without cookies.
Third parties your data passes through
I build this alone, which is not the same as your data staying with me alone. Every service below genuinely sees part of it, so all of them are listed.
Every request to the site, including your IP address as any server would, and provides Vercel Analytics, which counts visitors without cookies
Everything in those tables, because that is where it physically lives
The enquiry you filled in, because it is the body of that email. If you are a client with invoices, it also sees your address and the figures in your monthly summary
That you signed in to this site. This site asks Google only for openid, email and profile, and never asks for a refresh token, because it never calls Google APIs on your behalf
The first 300 characters of your chat message, with the name or email on the account, travel with that alert. If you leave a brief while I am offline, the topic, the budget and where to reply go with it too. It is written here because it is the kind of detail nobody mentions
The question you type into the demo bot is sent there to produce an answer. This site does not keep the question
I do not sell, trade or hand your data to anyone outside this list. If a new service ever has to be added, its name goes into this table before it goes live.
What is never collected and never done
- Your password is never stored in any form that can be read back
- No card numbers and no bank account details of yours
- The free checker does not store the address you put in, and does not store the result. A paid audit package is the separate case: there the address is kept with the payment record, because it is what says where to look
- The questions you type into the demo chatbot are not stored
- No list selling, no list swapping, and no sales email unless you contacted me first
- No cross-site tracking, and no advertising tags embedded on any page
Your rights over this data
This site is run from Thailand and follows the Personal Data Protection Act B.E. 2562. Here are the rights it gives you, with how to actually use them rather than just a note that they exist.
I send back the full list, using the same headings as the table above
As a file you can do something with, not a screenshot
Username, full name and contact details you can fix yourself in account settings. Tell me about anything else and I fix it
Deleting the account removes the chat thread and every message with it. For enquiries and payment records that have to be kept as accounting evidence, I tell you plainly what is kept and why
At any time, with no reason required. Withdrawing does not undo work already done before that point
Tell me which part you do not want used and I stop using that part
How to use them
- Email madarotsa@gmail.com with the subject Data request
- Say which right you want to use, and give the email address the account was created with so I can find your data
- For deletion or a copy I confirm back with you once first, so nobody can impersonate you to get it
I do it within 7 days and confirm back every time. No charge, and no need to explain why you are asking.
What is in place to keep it from leaking
These are in the running code, not marketing lines. If you hire me to review your system, this is the same kind of list I go through for you.
- Passwords go through scrypt, a memory-hard function that resists GPU guessing, and the real password is never stored anywhere
- The session cookie is signed with HMAC-SHA256 and set HttpOnly, so page JavaScript cannot read it even if a script injection ever got through
- Every secret comparison uses timingSafeEqual rather than a plain equals, because ordinary string comparison leaks timing and can be guessed a byte at a time
- Google sign-in uses both state and PKCE. Even if the code leaked in transit, nobody without the verifier can exchange it for a token
- The account system is written directly on node:crypto with no auth library in beta, because attack surface added by a dependency is something I cannot answer for in front of a client
- Money rules are enforced in the database itself: the amount must be above zero, the status must be one of a fixed set, and a slip reference cannot repeat. A rule in the database cannot be skipped by a new code path
- The free site checker pins its connection to an IP address it has already validated, so it cannot be used to reach into private networks, and DNS rebinding does not get around it
- Every route that costs real money has a rate limit counted centrally across all instances, not a per-instance counter that limits nothing in practice
What I will not claim
I will not tell you your data is one hundred percent safe, because nobody can say that honestly, and the people who say it are the ones who have not met the real thing yet. What I can say is that everything above is in the code running right now, and that if there is ever a breach I will tell you straight what happened, how far it went and what I have already done about it. I will not go quiet and hope it blows over.
Who is responsible for this data
- Phisit Tantiranon, trading as ZyntronLabs
- Thai commercial registration 1719900398604 · Registrar office, Pattani City Municipality
- Email madarotsa@gmail.com · Phone +66 95 439 2344 · Thailand, GMT+7
- No team and nobody in between. Every request reaches me directly and I answer it myself
If you believe I have mishandled your personal data and talking to me does not resolve it, you can complain to Thailand's Personal Data Protection Committee office. I am writing that here myself because you should know the route exists before you need it, instead of going looking for it in the middle of a problem.
Something here you are not happy with? Ask.
Anything is fair game, including the questions where the honest answer is that this is not good enough yet.