the short version: (you)r room is (you)rs. we cannot read (you)r messages — they are encrypted before leaving (you)r device. we do not sell (you)r data, run ad targeting, or build behavioral profiles. thaypley is funded by subscriptions, not surveillance.
what we collect
account info: email, username, account type, and age verification data. birthday is encrypted at the application layer (AES-256-GCM) — we store ciphertext, not plaintext.
content (you) create: music, videos, posts, artwork, and messages (you) choose to share. messages are E2E encrypted — the server stores ciphertext only.
payment info: processed by Stripe. we receive only confirmation of purchase and an anonymous payment ID — never card numbers or banking details.
technical logs: IP address, device type, and timestamp for security and abuse prevention. retained for 90 days, then deleted.
what we do not collect
we do not read (you)r private messages — ever. they are encrypted before leaving (you)r device and can only be decrypted by (you) and (you)r recipient.
we do not build behavioral profiles, track (you) across the web, or sell data to third parties.
we do not serve ads. thaypley is funded entirely by subscriptions and creator revenue shares.
we do not store (you)r private key. it lives on (you)r device only. if (you) lose it, (you) lose access to past messages — by design.
E2E messaging
thaypley uses libsodium crypto_box (X25519 + XSalsa20-Poly1305) for all direct messages. (you)r key pair is generated on (you)r device. the public key is shared with recipients so they can encrypt messages to (you). the private key never leaves (you)r device.
what the server stores per message: ciphertext (encrypted blob), nonce (random value), sender ID, recipient ID, and timestamp. nothing readable. a database breach exposes no message content.
content tiers & age verification
thaypley is an 18+ platform. we verify age at signup and store an encrypted birthday + an age-verified flag. creators may label their content general, mature, or explicit. explicit content requires age verification and is never shown to any account without it. thaypley does not censor expression — the tier system is a gate, not a judge.
data sharing
Stripe: payment processing. governed by Stripe's own privacy policy.
Hostinger VPS: our server infrastructure. data is stored in the EU.
Open-Meteo: anonymous weather data for the sky engine. no account, no tracking.
no other third parties receive (you)r personal data.
deletion: delete (you)r account from settings. all (you)r content, messages, and personal data are permanently removed within 30 days.
correction: update (you)r profile info in settings at any time.
portability: export (you)r content via the dashboard.
security
we use HTTPS with HSTS, AES-256-GCM for sensitive fields, and rate limiting on all endpoints. our API enforces strict CORS and origin validation. we do not log message content. security incidents are disclosed within 72 hours to affected users.