Privacy policy

sendkan is a submission platform for competitions, classes and other programs where people hand in work. It was started by Rachata Suksereekul in Bangkok, Thailand. In this policy, “we” means sendkan.

Some data is ours to look after: your account, and how you use the website. Some belongs to the people running a space (a simple submission, a competition or a project). They decide what to ask participants for and what to do with it, and we process it for them. In data protection terms, we are the controller for the first and a processor for the second.

• Account details: your name, email address, and anything you add to your profile, such as a photo, username, organization or bio. If you set a password, we keep only a secure one-way hash of it, never the password itself.
• If you sign in with Google or Discord: the name, email address and profile photo they share with us. Nothing else from those accounts (not your contacts, servers or messages), and we never post for you.
• What you do in a space: your registration and the answers to an organizer’s questions, your team, the files, links and text you submit, and a receipt for each version.
• Project work: your team’s plan, your peer ratings of teammates, and the grades and feedback organizers give.
• Entry fee slips: when a space charges an entry fee, the payment slip you upload, kept so its organizers can check your payment. sendkan doesn’t process payments; you pay the organizers directly.
• What organizers and judges add: checks, scores, comments, decisions and announcements.
• Messages you send us by email, live chat or Facebook.
• Technical data: your IP address (used briefly to stop abuse), error reports when something breaks, and page views and loading times counted without cookies.
• Your devices: the browser and rough location (city and country) of each device you’re signed in on, so you can see them under Security and sign any of them out.

• To run your account and the spaces you organize or take part in.
• To show each space’s organizers and judges the work and registrations for that space, and only that space.
• To send the emails you need: sign-in codes and links, and invitations to an organizing team.
• To keep sendkan safe and working: stopping spam and abuse, finding and fixing errors, and seeing which pages are slow.
• To answer your messages.

We don’t sell your data, show you ads, or use what you submit to train AI models.

• Organizers see the registrations and submissions in their own space. Judges see the work they’re given. With independent scoring, they don’t see each other’s scores until they’ve given their own.
• Peer ratings are private to the organizers. Teammates never see what you gave them or what they were given.
• Grades and feedback are shown to you only once the organizers release them.
• A space’s page can be public. Anyone with the link sees what the organizers publish there. Your profile shows only what you choose to make public.
• A small number of people at sendkan can open accounts to give support or keep the service safe. Every such access is recorded.

We run sendkan with a few providers. Each one handles data only to provide its service to us, under its own security and data processing terms.

Your account and everything in a space are stored in Tokyo, Japan (PlanetScale, region ap-northeast-1), uploaded files in the Asia-Pacific region (Cloudflare R2), and the app runs on servers in Tokyo.

Some of this happens outside Thailand. Where it does, we rely on each provider’s contractual commitments and safeguards to protect it. We’ll update this list before we add a new provider.

We use only the cookies sendkan needs to work:

• Your sign-in session.
• Your language and currency choices.
• An access code you entered for a space, so you don’t type it again.
• A short step while you sign in with Google or Discord.
• The support chat (Crisp), so a conversation you started is still there on the next page.

No cookies for advertising or tracking. Some pages also remember small choices in your browser, such as the view you last used for a plan.

What’s in a space stays as long as the space does. When its owner deletes it, everything in it is deleted too: registrations, submissions, files, plans, grades and reviews.

Your account stays until you ask us to remove it, or until it’s removed for breaking our Terms. Removing an account deletes the spaces you own and your entries in other spaces.

Backups and logs are kept for a limited time, then deleted.

Security logs of who opened which file are kept for 12 months, then deleted.

Under Thailand’s Personal Data Protection Act (PDPA), you can ask to see the personal data we hold about you, correct it, get a copy, object to or limit how we use it, or have it deleted. Where we rely on your consent, you can withdraw it. You can also complain to Thailand’s Personal Data Protection Committee.

Most details can be changed on your Account page. For anything else, write to us through the Contact page. For data inside a space, you can also ask its organizers, who decide how it’s used.

If you’re in the EU or the EEA, the GDPR also applies to the personal data we look after. We rely on:

• Our contract with you, to run your account and the spaces you use.
• Our legitimate interest, to keep sendkan safe and working and to answer your messages.
• Your consent, where we ask for it. You can withdraw it at any time.

You can ask to access your data, correct it, delete it, get it in a format you can take elsewhere, or object to how we use it. You can also complain to the data protection authority where you live.

Your data is stored in Japan, and some providers work from the United States. These transfers are covered by our providers’ standard contractual clauses.

Write to support@sendkan.com for any of this.

Email support@sendkan.com from the address on your account, or ask in the live chat, and say you want your account deleted. We confirm by email, then delete your account, the spaces you own and your entries in other spaces.

Signed in with Google or Discord? Deleting your sendkan account removes what they shared with us too. You can also take sendkan off your Google account (Security, Your connections to third-party apps) or your Discord account (User Settings, Authorized Apps, Deauthorize).

Files sit in private storage and open through links that expire within minutes, only after sendkan checks you’re allowed to see them. Connections are encrypted. What each person can do follows their place in a space: owner, organizer, judge or participant.

• Uploads are checked by what’s really inside them, not only by their name, so a file can’t pretend to be another type.
• Opening a submission or downloading a submission round is recorded, so we can answer who saw what.
• The database is closed to browsers. Every read and write goes through sendkan’s server, which checks who you are and what you may do.
• Sign-in codes, passwords and private links have limits on tries, so they can’t be guessed by trying again and again.
• Turn on 2-step sign-in: a code from an app on your phone as well as your password, with recovery codes in case you lose the phone.
• See every device you’re signed in on, and sign out of any of them.
• We follow the OWASP guidance for web applications and Thailand’s Personal Data Protection Act (PDPA).
• The software sendkan is built on is updated regularly.
• Access to production is limited to the founder, with 2-step sign-in.

No system is perfectly secure. If a security incident puts personal data at risk, we tell Thailand’s Personal Data Protection Committee within 72 hours of finding out, and the people affected, as the law requires.

If it affects a space, we tell its owner without delay, so they can act for their participants.

Found a security problem? Write to security@sendkan.com. Please give us time to fix it before telling others, and don’t open or change other people’s data while testing.

When the way we handle data changes, we’ll update this page and the date at the top. If a change matters, we’ll tell you by email or in sendkan before it takes effect.