LiNKLiNK

Back to the age check

Privacy Policy

Last updated

Last updated: 12 October 2026 (2026-10-12)

1. Who we are

This notice explains how LiNK collects and uses your personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).

  • Data controller: LiNK Studio
  • Address: We operate online through linkstudio.games only. We have not published an office address.
  • Privacy contact: a support ticket at /me/help (choose payment, account or other; you must be signed in), where staff reply, or the studio Discord linked from the same page when it is shown
  • Data Protection Officer (DPO): not appointed

2. Data we collect

Account and sign-in

  • Display name, username and email (if you sign up with email), password (stored only as a hash; we cannot read your real password)
  • If you sign in with Discord or Patreon: your account ID at that provider and the email it sends us (we ask only for identity and email access)
  • Profile picture (if you upload one) and account settings such as language, theme and notifications
  • Two-factor authentication (2FA) data, if you turn it on
  • A record of when you confirmed you are 18 or older and accepted the Terms, and which version
  • If you are a tester: a flag that marks your account as a tester

Using the service

  • Games and play rights in your library, wishlist, trophies, progress and data the games send to be saved, notifications
  • Messages and attachments you send to support

Payments

  • Orders, price, amount received, time
  • The payment slip image you upload and the slip check result (slip reference, amount, receiver). A slip can show your name and part of your account number as your bank displays it
  • We do not accept credit cards, so we do not store card numbers. Today payment is by PromptPay transfer only

Security and system operation

  • Security event records, such as sign-in, password change, 2FA on/off, purchase, refund, with your real IP address, browser type and time
  • System request records (which page, when, result), where the IP is kept only as an irreversible hash
  • Your signed-in sessions and devices, and devices you chose to trust (skip 2FA)
  • Device fingerprint: the sign-in and sign-up pages run a browser-characteristics script (open-source FingerprintJS, served from our own server and sending nothing to an outside company). It produces a device ID and a confidence score, stored with your session to help spot repeat sign-ups or unusual account use. It is a hint, not proof of identity
  • Data the games send while you play (game events), for statistics and troubleshooting

We do not collect: national ID, card data, financial data beyond what is on the slip, or precise location.

3. Why we use it, and on what legal basis

  • Provide accounts, library and purchases (contract): sign-up, sign-in, slip checks, granting play rights, support
  • Security and fraud prevention (legitimate interest): security records, IP, device fingerprint, sign-in rate limits, duplicate slip checks. There is currently no separate switch to turn the device fingerprint off. If you do not want it, contact us as described in section 1 before signing up
  • Comply with law (legal obligation): keep financial and accounting records
  • Age confirmation and record of accepting the Terms (contract and legitimate interest): so we can show age was confirmed before adult content
  • Non-essential notifications, such as announcements (consent): turn them off at /me/settings. Security emails and password resets are part of the service

If you do not give required data (for example email and password at sign-up, or a slip when buying), we cannot create the account or complete the sale.

4. How long we keep it

  • Security event records (with real IP): 365 days
  • System request records (hashed IP): 90 days
  • In-game event data: 180 days
  • Sign-in sessions: expire after 30 days without use, and at most 90 days after sign-in
  • Accounts you ask us to delete: a 30-day waiting period so you can cancel, then personal data is deleted or anonymized (name, email, picture, linked accounts, support messages, slip images)
  • Payment and financial records: kept for 5 years, a period we set to match accounting and tax law, no longer linked to your identity after account deletion. There is no automatic job that deletes them when the period ends; staff do it by hand
  • Records of when you confirmed your age and accepted the Terms: today these are not removed when you delete your account. They are kept as proof that the 18+ confirmation and acceptance happened
  • Staff action (audit) records: kept permanently, because by design they cannot be edited or deleted, for transparency and later review. These records do not contain your IP
  • Anything not listed: kept only as long as needed for the purposes above, then deleted or anonymized

5. Who we share it with

We do not sell your data. We use only the providers needed to run the service.

  • Server: the website runs on a rented virtual server (VPS) operated by the studio. Visitors connect over HTTPS directly, not through an outside CDN or proxy
  • Analytics: we use no third-party analytics service and embed no outside scripts in our pages
  • Resend: sends account confirmation, password reset and security alert emails (sees your email address and the message)
  • SlipOK: checks payment slips (receives the slip data you submit)
  • Discord and Patreon: if you sign in or link with them, we fetch your identity and email from them. If you buy a game that carries a Discord role, we ask Discord to add or remove that role on the Discord account you linked
  • Banks and PromptPay: when you transfer money, your bank and ours handle the transfer data as controllers in their own right
  • Government bodies, courts or authorities: when the law requires it

Some of the providers above may store or process data outside Thailand. We do not control where, and we have not signed extra contracts beyond each provider's own terms. If you want details, contact us as described in section 1.

6. Your rights

Under the PDPA you may ask for access and a copy, to receive or transfer your data in a machine-readable form, to object to use, to have data deleted or anonymized, to restrict use, to correct it, and to withdraw consent you gave.

How to use them:

  • Download your account data (JSON): at /me/settings (this file does not include security event records or system request records; open a ticket at /me/help if you want those)
  • Change name, picture, settings, notifications, and unlink accounts: at /me/settings
  • Delete your account: at /me/settings, with a 30-day waiting period in case you change your mind
  • Anything else: open a ticket at /me/help or reach us on the studio Discord. We will reply within 15 days (the law allows at most 30). We may ask you to verify who you are

We may refuse a request where the law allows, for example data we must keep under accounting law. We will tell you why.

If you are not satisfied, you may complain to the Personal Data Protection Committee Office (PDPC) of Thailand.

7. Cookies

We use only cookies needed for the site to work. There are no advertising cookies and no cross-site tracking. There is no third-party analytics.

  • Sign-in: the session (lasts 30 days without use, at most 90), short-lived cookies while signing up or signing in with Discord/Patreon (a few minutes), trusted device (30 days)
  • Form security: CSRF token
  • 18+ confirmation: 30 days
  • Language: 1 year
  • Device fingerprint: two cookies lasting 5 minutes, used to pass values from the browser to the server when you press sign in, as in section 2

8. Children

This service is for people aged 18 and over (it has adult content). We ask for age confirmation before adult content and at sign-up. This is self-declared; we do not check documents. If we find someone under 18 using an account, we will close it and delete data where we can. If you are a parent or guardian and find this, please contact us as described in section 1.

9. Security

  • Passwords are hashed, sign-in cookies are HttpOnly, connections use HTTPS
  • 2FA is available, sign-in attempts are rate limited, important actions are logged
  • Only the system owner can see real IP addresses; other staff see only hashes, and every lookup is logged
  • Authorized staff may view your account on your behalf to solve a support issue; the system records every such session
  • If a data breach affects your rights, we will notify the PDPC and you within the time the law sets

No system is 100% secure. Please use a password you do not use elsewhere.

10. Changes to this notice

If we make a material change, we will announce it on the website and change the date above.

11. Contact

LiNK Studio · linkstudio.games · Contact: a support ticket at /me/help (choose payment, account or other; you must be signed in), where staff reply, or the studio Discord linked from the same page when it is shown