Privacy Policy

This policy covers the website at nene.thaiplot.com and the “Nene Royal Fan” mobile app. Both are run by the same operator and share one backend.

This is an unofficial fan project. It is not affiliated with, endorsed by, or connected to Nene Royal, her family or management, America’s Got Talent, NBC, Fremantle or Syco Entertainment.

Accounts

Reading the feed needs no account. To post, comment or upload on the website you create an account with only a username and a password — we never ask for your email address, phone number or real name. The mobile app has no accounts at all.

Your password is stored only as a bcrypt hash, which cannot be turned back into the password. When you log in, the site sets one essential cookie (nene_session) that keeps you logged in for up to 30 days. It is httpOnly, used for nothing else, and removed when you log out.

What is stored

• Your account. Your username, the password hash, the date you joined and which posts are yours. The username and join date are shown publicly on your posts and profile. We also note which usernames were active on a given day, to count daily active members; that record is deleted after three days.
• An anonymous id. The first time you open the site or app, a random id is generated and kept on your device (browser localStorage, or app storage). It exists only to stop the same device voting twice, liking the same post twice, or checking in twice in a day. It is not linked to you, and clearing site data or reinstalling the app replaces it with a new one.
• What you post. Messages, captions and comments, and in the app the display name and country you type. This is public by design — do not put anything private in it.
• Photos and videos you upload. Stored on Vercel Blob and shown publicly in the feed as soon as you post them. Photos sent from the app are reviewed before they appear. Do not upload photos or videos of other people without their agreement.
• IP address, briefly. Used only for rate limiting, to stop flooding. It is stored as a short-lived counter that expires within an hour, and is never attached to your posts.
• Aggregate page views. We use Vercel Web Analytics to count how many people open each page. It is cookieless and does not follow you across sites or build a profile: Vercel derives a short-lived, non-reversible hash from the request to tell repeat visits apart within a day, and discards it. It is never joined to your posts or your anonymous id.
• Notification subscription. If you turn on web notifications, the browser-issued endpoint is stored so alerts about new posts and the finale can be delivered. It is not linked to your account. Turning notifications off deletes it.
• App notification token. If you turn on notifications in the Android app, the app registers with Google’s Firebase Cloud Messaging, which issues a random device token. We store that token and your app language so news and new-post alerts can be delivered through Firebase. It is not linked to an account, a name or your anonymous id, and switching notifications off deletes it. Finale and daily reminders are still scheduled entirely on your device.

What is not done

• No advertising, and no advertising SDKs.
• No cross-site tracking and no third-party cookies — the login cookie is the only cookie.
• No profiles built about you, and nothing sold or shared.
• No location data, contacts or device identifiers collected.

Who processes the data

Hosting, serverless functions and the page-view counts run on Vercel. Content and accounts are stored in Upstash Redis, and uploaded photos and videos in Vercel Blob. Notifications to the Android app are delivered by Google Firebase Cloud Messaging. The news feed is fetched from Google News and the video list from YouTube; those requests are made by our server, not by your device, so those services do not see your IP through us. Opening a news article or a video link does take you to that third party, where their own policy applies.

Reporting and removal

Every post, comment, photo and chat message has a report control. Reported content is hidden automatically once several different people report it, and reviewed after that. The moderator can remove any post.

To have something you posted removed, to delete your account, or to ask what is stored about your account or anonymous id, email leerthaismetmij@gmail.com with your username (or the approximate time and display name you used in the app). Requests are handled within 30 days.

Children

This community is not directed at children under 13. No personal detail is required to use it, and an account needs only a username. If you believe a child has posted identifying information, email the address above and it will be removed.

Changes

If this policy changes, the date at the top changes with it. Material changes will be noted on the home page.