Privacy policy

• You can browse the whole site without an account or an email.
• We do not run advertising, we set no tracking cookies, and nothing here follows you to another website.
• We do count how often each listing is viewed, saved and shared, as a daily total per listing, with nothing recorded about who did it.
• We only ask for an email when you want something back from us: the weekly digest, an account, or a heads-up about a city.
• You can ask us to delete anything we hold about you.

Nothing about you, if you just browse. No account, no email, no profile, and nothing that identifies you across visits.

Your email, if you subscribe to the weekly digest, or ask to be told when we open in a city. For the city waitlist we also store which city you asked for, because that is how we decide where to expand.

Account details, if you sign up as a shop or an organizer: your email and a password, held by our authentication provider and never visible to us in readable form.

What you publish, if you run a shop page or a market: names, descriptions, tags, social handles, photos and event details. This is public by design.

Applications and messages, if a shop applies to a market: the application and the conversation on it, visible to both parties and to us.

Counts of actions on listings. Opening a listing, or saving, sharing or adding one to a calendar, adds one to a total for that listing on that day, which we show to the organizer who runs it. The stored row is the listing, the kind of action, the date and a number. There is no visitor identifier, no session, no IP and no account attached to it, so it cannot be traced back to anyone and we could not tell you what you personally have looked at even if you asked. We are describing it here because "we don't use analytics" would be the wrong impression to leave.

Page views, counted without identifying you. Our host, Vercel, counts visits and records which site sent you here, so we can tell whether the links we share are being opened. It sets no cookie, stores no identifier on your device, and cannot recognise you on a second visit or on any other website. There is no profile to ask us for, because none is built.

Standard server logs kept by our hosting provider, including IP addresses, for security and debugging.

Your IP address, briefly, when you submit something. Forms anyone on the internet can post to, such as applying to a market, subscribing or signing in, are rate-limited per address so one script cannot flood them. Those counters live in server memory, expire within the hour and are never written to the database.

Notifications we owe you, if you have an account: the in-app list of things that happened on your applications and markets.

Some market listings, organizer profiles and shop pages are put up by us before the business has any account with us, built from what is already public: an Instagram post announcing a market, a venue's own page, a vendor named in an organizer's lineup. What we store is business information: the name, the area, the dates, a public social handle or LINE ID, and a photo already published in public.

We do this because a directory nobody has joined yet is useless to the people it is meant to serve, and because it is how a shop gets found by an organizer in the first place. But it means there may be a page about your market or your shop that you did not make.

If that is you, you have three options and all of them are yours to choose: claim the page and take it over, tell us what to correct, or tell us to take it down. We do not require you to create an account to ask for a correction or a removal, and we do not ask for a reason. One email to the address below is enough. For a one-person shop, a personal Instagram or LINE handle is personal data as much as it is business contact information, and we treat a request about one that way.

We do not collect payment details, because nothing on the site is paid for. We do not buy or sell personal data, and we do not build advertising profiles.

When your shop applies to a market, the organizer sees your shop page, the contact you put on the form and whatever you wrote. That is the point of applying, but it is worth being explicit: the contact address on an application goes to that organizer, and we cannot un-send it afterwards.

An open call can be public before its market is listed for shoppers. If you are an organizer, everything you put in the call, including the note, the prices, the deadline, the floorplan and any photos, is public from the moment you open it, even while the market itself is still a draft.

Organizers can add photos of a market: the stalls, the venue and the crowd. Crowd photos can contain identifiable people who had no part in uploading them, so our terms require the uploader to have permission. If you appear in a photo on this site and would rather not, email us and it comes down. You do not need to explain why, and you do not need an account.

We set a cookie to remember your language choice, and our authentication provider sets cookies to keep you signed in. Both are necessary for the site to work, and neither is set until you do something that needs it, so we do not show a consent banner. Nothing on this site sets an advertising or tracking cookie.

Markets you save are kept in your browser's local storage on your own device. That list is never sent to us, which is also why it does not follow you to another phone.

A page address can also carry ?lang=th, which selects the Thai version for that visit without setting anything. It exists so a Thai link can be shared and so search engines can find the Thai site at all, because a crawler sends no cookies.

We use a small number of providers to run the service, and they process data on our instructions:

• Supabase for the database, accounts and uploaded images
• Vercel for hosting, server logs and the cookieless page counts described above
• Resend for the email we send: the weekly digest, and the welcome mail when a shop or organizer account is set up
• Supabase Auth also sends the sign-in codes and password-reset links, which is the only mail that goes out before you have an account

Some of these store data outside Thailand. We use them because they are the standard tools for building this kind of site, and we keep what we send them to the minimum.

Newsletter and city-waitlist emails stay until you unsubscribe or ask us to remove them. Account data and anything you published stay while your account is open. When you close an account we delete your profile and your uploads; applications and their messages may be kept longer where the other party needs their own record.

The per-listing action counts are kept for as long as the listing is, and are deleted with it. Since they identify nobody, there is nothing in them to return or erase on request, which is the trade we made by not recording who did what.

Under Thailand's Personal Data Protection Act you can ask us to show you what we hold about you, correct it, delete it, or stop using it. Email hello@popapp.me and we will respond as quickly as we can.

Every digest email carries an unsubscribe link, and using it stops the emails without you needing to ask us anything.

The site is not aimed at children, and we do not knowingly collect data from anyone under 13. If you believe we have, tell us and we will delete it.

If we start collecting something new, or add a provider that handles personal data, we will update this page and change the date at the top.

Questions, corrections and deletion requests go to hello@popapp.me. See also our terms of use.