Privacy policy
This page explains what the app collects, why, who can see it, how long it is kept and what your rights are under Thailand’s Personal Data Protection Act B.E. 2562 (2019). We try to keep it plain and to match how the app really works. If anything is unclear, ask us (section 18).
In short
- You can browse the map without signing in. Your GPS position is used on your phone to work out distances; the app only sends a rough area to our server to get the shops around it, and it is not recorded.
- Signing in with Google is needed to run a shop, call a shop, see a shop’s phone number or tap “I’d like … around here”. We do not keep your Google name or email in readable form, only one-way coded values.
- Shop details are public (name, menu, photo and the shop’s location while it is open). A shop’s phone number is shown only to signed-in users.
- When you call a shop, the vendor you call sees your display name and phone number, and sees your meeting pin only after tapping “On my way”. Our server does not store meeting pins or chat messages.
- We keep a traffic log for 90 days (account, encrypted IP address, time, type of request) for signed-in use only, for safety and because the law requires it. No location and no chat content.
- No ads, no analytics, no selling or renting of data · You can delete your account in the app — see Delete your account.
1. Who is responsible
The data controller is the developer of RotRe (“รถเร่ใกล้ฉัน”) in Thailand. Developer name on Google Play: PONG Developer · email kampanatth0222@gmail.com. On this page “we” and “our team” mean the developer.
2. Browsing the map without signing in (everyone)
- Your GPS position (if you allow it) is used on your phone to show you on the map, compute distances, sort nearby shops and check whether a shop you follow is near. Browsing the map does not send your GPS coordinates to our servers. The map works without location access. (Calling a shop and “I’d like … around here” are different — see sections 6 and 8.)
- What the app sends to get shop lists: the ID of the roughly 20 km map area you are viewing (and, if you follow shops, the area around you); the centre of the map rounded to about 1 km; and at times the IDs of the shop you are viewing or following, to receive that shop’s live position. All of this stays in server memory only while the app is connected, is not recorded, and is gone when you disconnect.
- Random install ID: the app creates a random ID not linked to any name or account, used to limit abuse and stop repeat reports. The server keeps only a one-way coded value of it, with a key that changes daily, for at most 48 hours, then deletes it.
- Kept only on your phone: shops you follow, shops you hid, language, night mode, the point you set for “Tell me when a cart comes near”, the last position the app uses to work out distances for alerts, and a call in progress (so the app can resume it). Android auto-backup is disabled, so none of this is copied to the cloud. Clear the app’s data or uninstall to remove it.
- Call / Navigate: tapping Call opens your phone’s dialer with the number (the app never places calls itself); Navigate opens Google Maps. Those apps’ own policies then apply.
3. Alerts
- A followed shop is near (100 m) and “Wait for this shop to come to me”: distances are computed on your phone. While waiting, the app may keep running in the background for up to 45 minutes, with a visible notification the whole time.
- “A shop you follow has opened” and “Tell me when a <category> cart comes near” are delivered through Google’s notification service (Firebase Cloud Messaging) as “topics”. Your phone subscribes, directly with Google, to the topic of each shop you follow, or to the topic of a roughly 20 km area × the category you chose. Our server does not know who subscribes to which topic and does not know where you are. A message carries only the shop name, category and a rounded shop position (about 100 m); your phone decides whether to show it based on distances computed on the phone.
- Google can see that a phone (identified by a notification token) is subscribed to certain topics. The app creates this token only when you start using these alerts and deletes it when you no longer use them.
- The point you set for “Tell me when a cart comes near” stays on your phone. While the app is closed, the phone periodically (about every 30 minutes) downloads the public shop-list files for the areas around that point — the same files everyone sees on the map — which does not tell us who you are.
- You can turn alerts off in the app or in your phone’s notification settings.
4. Signing in with Google (vendors and customers)
| Data | Stored in | Purpose | Visible to |
|---|---|---|---|
| Your Google account ID and email as one-way coded values (cannot be turned back into your email) | Our database on Cloudflare | Recognise your account, let only owners edit their shop, keep banned accounts out | Nobody |
| Google name, email and profile photo | On your phone (and in the old system during the transition — section 14) | Show which account you are signed in with; the starting display name when you call a shop | You only |
| App sign-in keys (stored as one-way coded values, expire automatically), phone platform, last use | Database on Cloudflare | Stay signed in | Nobody |
When you sign in, the app asks Google Play to confirm it is the genuine app installed from Google Play (to stop fake sign-ups).
5. Vendors and shops
| Data | Visible to | Notes |
|---|---|---|
| Shop name, category, menu and prices (up to 20 items) | Public | An edited name or menu that trips the automatic word check waits for our team; customers see the previous version meanwhile |
| Shop phone number (must be a Thai number) | Signed-in users only | No longer in the public files; shown in the app to signed-in users, at most 60 lookups per account per day, never between people who blocked each other |
| Shop photo (optional): the app crops it to a circle, makes 640 px and 160 px versions and removes hidden data (such as where it was taken and the phone model) before upload | Public after approval | Every new photo waits for a team check and is kept in private storage meanwhile. Cloudflare’s automatic image check (Workers AI) adds labels such as “food?”, “person?”, “contact details?”; a person always decides. Approved photos are served from cdn.rotkhen.com and the old photo is deleted |
| Open/closed flag, random install ID, the roughly 20 km area the shop is in, open/close/last-contact times | Open/closed is public | No coordinates · the install ID tells which phone is sending the location |
| Shop location, speed, heading, accuracy | Public, only while open | See “How shop location works” below |
| Saved selling spots (up to 10): spot name, landmark and the pin you placed yourself on the map | Customers see the spot name, landmark and pin only while your shop is open at that spot | Kept on our server until you delete the spot. The app never saves a spot from GPS without you confirming · Use public places where you are allowed to sell, not your home |
| Weekly schedule: days, times, selling mode, spot, days off and the auto-open switch | You only (customers never see it) | Stored on our server so it survives a new phone; reminders and auto-open run on your phone |
| The “Take customer calls” switch and internal call counters (accepted, arrived, unanswered, declined, expired, no-show) | Our team only | Never shown to customers or anyone else; used to spot problems such as repeatedly accepting and not coming |
| Which version of the terms you accepted, and changes waiting for review (what changed, reason for a rejection) | You and our team | Rejection reasons are kept for 30 days |
| Banned accounts (only accounts that were banned): one-way coded account and email, time, reason | Our team only | Stops that account from coming back, even after it was deleted in the app |
How shop location works
- Location is shared as the shop’s position only between tapping “Open shop” and “Close shop”. A persistent notification with a “Close shop” button is shown the whole time.
- The exact position is kept only in server memory and is never written to a database. The public shop-list file holds only an approximate position (about 100 m) that is overwritten each time. We do not record where you have been.
- A shop opened as “Park at my spot” shows the pin of the saved spot. The app uses low-power location to check that you are still there; if you move more than 100 m away, it asks whether you moved.
- Closing the shop removes its location from the server within seconds and from the public file within about 20 seconds. If you close while offline, the app sends the close command when the connection returns.
- If the phone disconnects, the app is swiped away or the phone dies, the shop can stay on the map for up to about 10 minutes, then its location is removed. If no new position arrives for 60 minutes, the shop is closed automatically. Signing out on the phone that is sending location closes the shop first.
- Background location (“Allow all the time”) is requested from vendors only, after an in-app explanation, so the shop keeps updating with the screen off, and for “Open my shop automatically when I reach my spot on schedule” if you turn that on yourself (off by default). You can refuse and still open a shop.
- Places where people tapped “I’d like … around here” are shown to vendors as rough areas with a head count — no names or phone numbers. Street names come from your phone’s own place-name lookup service.
- Voice: call details are read aloud with your phone’s text-to-speech. If you tap the microphone to reply by voice, the app hands over to your phone’s voice typing (for example Google’s, depending on your phone settings). The app does not record audio itself.
6. Calling a shop (“Ask this shop to come to me”)
| Data | Visible to | How long |
|---|---|---|
| Your display name (starts from your Google name on the phone, editable, up to 30 characters) and phone number | The vendor you call, during the job (removed from the vendor’s screen when the job ends) · the app tells you this before you enter the number | The phone number is deleted automatically after 6 months without calls (you enter it again on your next call) · the name is kept until you delete your account |
| Meeting pin = your GPS position when you call | Before the vendor taps “On my way”, they see only a rough area (about 100 m, with a 150 m circle) · the exact pin is sent to the vendor only after they accept | Not written to any storage; held in the memory of the live connection during the job and gone when it ends |
| What you want to buy, quantities, budget and a short note | The vendor you call | Inside the call only; gone when the job ends |
| Call state (account, name, phone, note, times, status — no coordinates) | The system | Deleted when the job ends · the reason it ended is kept for 30 minutes · account and name (no phone, note or pin) kept for 24 hours so problems can still be reported |
| Cancellation, no-show and suspension history, and call counts | Our team · you see your own suspension status in the app | Cancellations count over the last 30 days · suspensions as shown in the app · permanent suspensions and totals until you delete your account · used under the terms of use |
- During a call the customer’s app keeps running in the background (with a visible notification) to show the status and the cart approaching; it stops when the job ends.
- The server decides “the vendor has arrived” by comparing the cart’s real position with the meeting pin held in memory.
- Meet by the road or in a public place. Vendors do not come into customers’ homes, rooms or hotels.
7. In-app chat
- Chat is available from the vendor’s “On my way” until the job ends. Messages are relayed instantly over the existing connection; our server does not store chat messages. If a message cannot be delivered, the sender sees “not delivered yet”.
- Messages stay on both phones until the job ends. The vendor’s phone remembers the customer’s name and the chat of recently finished jobs for 24 hours so problems can be reported (cleared on sign-out).
- An automatic word check blocks links, phone numbers and forbidden words. If a message contains doubtful words, our team is told only which category — not the text.
- When you report a problem, you may attach the latest chat messages from your own phone (you see them first and can untick them) — see section 9.
8. “I’d like … around here”
- Requires signing in (so the “people waiting” number reflects real people). The app sends your position, the category and the shop you chose (if any). The server keeps only a coarse square of about 220 m, never your coordinates, plus a one-way coded value of your account (not your account ID itself) to count people once.
- A request expires after 40 minutes · vendors see only “around … · N people waiting”, never your name or number · the daily counter (up to 10 per account) is deleted after 2 days.
9. Reports, blocking and content checks
- Reporting a shop from its page (no sign-in needed): we keep the shop ID, reason, any text you type and the time — nothing that identifies you (only a one-way coded install ID for up to 48 hours to stop repeat reports). The app asks Google Play to confirm it is genuine before sending.
- Report / block during a call or in chat: we keep the reporter’s account, the reported person, the call concerned, the reason, your text and any chat messages you chose to attach (up to the latest 30 from your phone). The reported or blocked person is never told who reported them.
- Reports and attached chat are kept until our team closes the case, plus 90 days, then deleted (cases never closed are deleted after 400 days). Only our team can read them.
- Block list: who blocked whom and the name seen at the time, kept until you unblock or delete your account. A signed-in customer who hides a shop also blocks it.
- An automatic word check covers shop names, menus, prices, the shop phone field, spot names, display names, notes and chat. Forbidden content cannot be saved or sent; doubtful content goes to our team.
- Our moderation log (what was reported, when, what we did, when) is kept for 400 days to show that we acted in time as the law requires. It contains no reporter identity and no chat text. See the notice and takedown policy.
10. Traffic log (90 days)
Thailand’s Computer Crime Act requires service providers to keep computer traffic data, so we keep a minimal traffic log:
- What: the hour, your account ID in our system, the type of request (sign-in, shop, customer, report/block, account, vendor live connection, call), your IP address (stored encrypted), the first and last time in that hour, and a count.
- Not kept: location, chat content or the details of individual requests · people browsing the map without signing in and anonymous shop reports are not logged at all.
- Who can open it: only on a formal written request from an authority with legal power, and every opening is recorded (those records are kept for 400 days).
- Deleted automatically after 90 days · Cloudflare’s database keeps an automatic recovery copy of deleted rows for up to 30 more days (this cannot be turned off) · the log is not in our own backups.
- Separately, Cloudflare sees the IP address of everyone using the app and website in order to deliver data and block attacks, under Cloudflare’s own policy.
11. What other people can see
Shop name, category, menu, prices, shop photo and the shop’s location while open (including the name and pin of the spot it is selling at) are public — anyone can see them without signing in, because that is the core purpose of the app. A shop’s phone number is shown only to signed-in users. We keep no location history, but people who view the map could record it themselves. Please use a photo of your own cart or shop, avoid other people’s faces and licence plates, and never save your home as a selling spot · Your Google name, email and photo are never shown to anyone · A customer’s display name and phone number are shown only to the vendor they call.
12. Android permissions
| Permission | Why |
|---|---|
INTERNET | Load maps and shop lists; send shop location, calls and chat |
ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION | Customers: distances on the phone, the meeting pin when calling · Vendors: share the shop’s location while open |
ACCESS_BACKGROUND_LOCATION | Vendors only: keep updating with the screen off while open, and auto-open at a spot on schedule (if you turn it on) · requested after an in-app explanation |
FOREGROUND_SERVICE, FOREGROUND_SERVICE_LOCATION | Tasks with a visible notification: sending the shop’s location while open · checking arrival at a scheduled spot · customers’ “Wait for this shop” (up to 45 minutes) and calls in progress |
POST_NOTIFICATIONS | Shop-near, shop-opened, call and chat alerts, and vendor shop-status notifications |
WAKE_LOCK, RECEIVE_BOOT_COMPLETED | Deliver pending commands (such as “close shop”) when the connection returns · resume sending or re-arm the schedule after a restart (does nothing if the shop is closed and no schedule is set) |
SCHEDULE_EXACT_ALARM | Vendors: close the shop at the time you set and run schedule reminders/auto-open on time (you grant it yourself) |
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS | Vendors: ask the battery saver not to stop the app while the shop is open (so customers keep seeing it) |
| (No camera, photo-library or microphone permission) | For a shop photo the app opens the system camera or photo picker and receives only the photo you choose · voice replies use your phone’s voice typing, so the app needs no microphone permission |
Android auto-backup is disabled (allowBackup=false), so on-device data is not copied elsewhere.
13. Legal bases
- Consent — device location and notifications; give or withdraw it at any time in your phone settings, or by closing the shop / stopping a wait.
- Providing the service you ask for (contract) — accounts, shop details, spots, schedules and calls (including passing your name, phone number and meeting pin to the vendor you call).
- Legitimate interests — the safety of users and the system: server checks on every command, request limits, app genuineness checks, word and photo checks, reports and blocks, cancellation and suspension history.
- Legal obligations — the 90-day traffic log, the moderation log for reported content, and answering formal written requests from authorities.
We do not use data for advertising or profiling, and we do not sell, rent or share it for marketing.
14. Service providers
- Cloudflare, Inc. — servers, database, file storage and the automatic image check (Workers AI) for the app and this website. Servers may be outside Thailand, in the Asia-Pacific region or elsewhere. Cloudflare processes data as our service provider.
- Google — sign-in with a Google account · Google Play checking that the app is genuine (at sign-in and when reporting a shop) · topic notifications (Firebase Cloud Messaging, section 3) · fonts (Google Fonts), which see your IP address as with any web request · Google Maps, only when you tap Navigate.
- OpenFreeMap (tiles.openfreemap.org) — map images; receives requests for the area you are viewing and your IP address, like any web request. It does not receive your GPS position.
- Telegram — sends our team a message when a shop waits for review or a problem is reported. The message says only which shop/account and what kind of issue — no reporter identity, phone numbers or chat text.
- Services on your own phone — the dialer, text-to-speech, voice typing and place-name lookup, working under your phone’s settings.
- Transition period: the old system on Google Firebase (Singapore) is still running as an emergency backup and for older app versions, and still holds shop data from before the move. Anyone who signs in with Google in the current app is also signed in to the old system (Google name, email and profile photo). When the old system is shut down, all data in it will be deleted and we will update this page.
The app contains no advertising or analytics SDK. We disclose data to authorities only on a lawful written request, and only what is asked (see notice and takedown policy, section 7).
This website uses no tracking cookies or analytics. It is served by Cloudflare and uses fonts stored on this website itself, not loaded from another provider. The site only remembers the language and colour theme you picked, in your own browser.
15. How long we keep data
| Data | Kept for |
|---|---|
| Rough area sent while browsing the map | Only while connected; not recorded |
| One-way coded install ID and IP address (abuse limits, repeat-report check) | At most 48 hours |
| Shop location | Only while open; removed on closing (within about 20 seconds), signing out, account deletion or after the silence limits in section 5 · no route history |
| Shop details, menu, photo, spots and schedule | Until you edit or delete them, or delete your account |
| Content waiting for review (new text or photo) | Until our team decides · rejection reasons 30 days |
| Account (one-way coded values) | Until you delete it in the app or ask us to · sign-in keys expire 60 days after last use |
| Customer display name | Until you delete your account |
| Customer phone number | Deleted automatically after 6 months without calls (counted from when you last entered it or last called), or on account deletion |
| Meeting pin, order and call details | Until the job ends (end reason 30 minutes · account and name of a recent call 24 hours for reporting) |
| Chat messages | Not stored on the server · on phones until the job ends (vendor’s phone 24 hours) · anything attached to a report follows the report |
| “I’d like … around here” | 40 minutes · daily counter 2 days |
| Cancellation, no-show and call-suspension history | Cancellations count over 30 days · suspensions for the period shown in the app · permanent suspensions and totals until account deletion |
| Block list | Until you unblock or delete your account |
| Reports (including attached chat) | Until closed, plus 90 days · cases never closed at most 400 days |
| Moderation log | 400 days |
| Traffic log (encrypted IP addresses) | 90 days (plus up to 30 days in the database’s recovery copy) |
| Record of who opened the traffic log | 400 days |
| Banned-account list | Until our team lifts the ban; kept even after the account is deleted in the app |
| Backups | Cloudflare’s database keeps automatic recovery copies for 30 days (cannot be turned off) · our own daily backups 14 days · deletion/ban records and shop-photo copies at most 35 days · no backup contains shop locations |
| Data on your phone | Until you clear the app’s data or uninstall |
| Old Firebase system (transition) | All deleted when the old system is shut down |
16. Security
- All data travels over encrypted connections (HTTPS, and encrypted connections for live location, calls and chat).
- The server checks every command; only the owner can edit or delete a shop · we do not store readable emails or Google account IDs on the server · IP addresses in the traffic log are stored encrypted.
- No system is 100% secure. If a data breach puts you at risk, we will notify as the Personal Data Protection Act requires.
17. Your rights
You may request access to and a copy of your data, data portability, correction, deletion, restriction, objection, and withdraw consent at any time (withdrawal does not affect what was done before).
- In the app, right away: edit your shop, menu, spots and schedule · close the shop to stop and remove location · turn calls off · unblock · sign out · delete your account and data · turn off location and notifications in your phone settings.
- Other requests: contact us (section 18). We reply within 30 days and may ask you to confirm you own the account.
- If you think a call suspension or a hidden shop is a mistake, contact our team to check again.
- You may complain to Thailand’s Office of the Personal Data Protection Committee (PDPC).
Children and young people
The app has no age limit and is not designed specifically for children. For users aged 10 or younger, a parent or guardian should sign in, enter the phone number and make calls for them. Parents can contact us (section 18) to see or delete a child’s data.
Changes to this policy
We will update this page and the effective date when the policy changes, and tell you in the app or ask for new consent where needed for significant changes.
18. Contact
- Message the Facebook Page “รถเร่ใกล้ฉัน” (RotRe)
- Email kampanatth0222@gmail.com (privacy requests: access, correction or deletion of your data)
Read next: Terms of use · Notice and takedown policy · Delete account and data