Privacy Policy
Effective 14 July 2026 · Last updated 14 July 2026
This policy applies to the KRUNG website, reader accounts, newsletter, contact forms, and Ask KRUNG. KRUNG is a publication name; a verified registered operator and service address have not yet been supplied. Paid services remain closed until the responsible legal counterparty is identified. Privacy contact: support@krung.news.
1. Information we collect
- Account information: your name, email address, a one-way password hash, account role, subscription status, and account dates.
- Session information: a random session identifier stored in a secure cookie so you can remain signed in. We do not place your password in a cookie.
- Newsletter and contact information: your email address and any name, company, package interest, or message you choose to submit.
- Research and preference information: signed-in search history only when you enable it, saved/followed items, collections, district and transport labels, and bounded usage counters. Public-route rate limits use a one-way hash derived from connection information; the raw address is not stored in KRUNG's rate-limit table.
- Technical information: our hosting and security providers may process IP address, browser and device details, request time, requested pages, and security events to deliver and protect the site.
- Payment information: if paid subscriptions are activated, the payment provider processes card or bank details. Krung receives transaction status and plan information, not full payment-card numbers.
2. How we use information
We use information to create and secure accounts, keep readers signed in, provide subscriptions and Ask KRUNG, deliver requested emails, respond to messages, administer the publication, prevent abuse, comply with law, and improve reliability. We do not sell personal information.
3. Cookies and similar technologies
Essential cookie: krung_session keeps a signed-in session active for up to 30 days. It is marked HttpOnly, SameSite=Lax, and Secure on HTTPS. Signing out expires it.
KRUNG does not load third-party advertising or analytics scripts in this release. Any later addition requires a documented data-flow review, an updated policy, and any consent controls required for the reader's region before non-essential storage is used.
You can control browser cookies in your browser settings. Blocking the essential session cookie means the site cannot keep you signed in. Google explains its partner-site data practices at How Google uses information from sites or apps that use its services, and ad personalization choices at Google Ads Settings.
Optional product analytics
KRUNG can record a small allow-listed set of product events—such as an article being completed, a source being opened, or a search returning no result—to improve usefulness rather than maximize pageviews. This is disabled unless you opt in. Anonymous events use a random identifier stored on this device; the server stores only its one-way hash. Event records exclude the full URL you opened, IP address, free-text searches, form messages, and precise location.
Community submissions
If you use the contribution form, KRUNG stores the selected submission type, message, optional links, optional name/email, account ID when signed in, moderation status, and editorial notes. Submissions are private by default and are never published automatically. They are used to evaluate questions, corrections, sources, local issues, and coverage ideas; editors may contact you only when you provide an address. Do not use the ordinary form for highly sensitive identities or files. Closed or declined submissions should be reviewed for deletion within 24 months unless an editorial, safety, legal, or corrections record requires longer retention.
4. When we share information
We share information only as needed with service providers that host, secure, email, measure, or process payments for Krung; with professional advisers; in a business transfer; or when law, a court, or a lawful government request requires it. Current infrastructure may include Cloudflare for hosting, security, and database services. Providers process information under their own terms and privacy commitments.
5. Retention
Active sign-in sessions expire after 30 days. Account records are kept while the account is open and for a limited period afterward where needed for security, disputes, tax, or legal obligations. Newsletter details are kept until you unsubscribe. Contact and closed community submissions are normally reviewed for deletion within 24 months. Product analytics older than 180 days are removed during event ingestion. Research and abuse-prevention counters are kept only as long as reasonably needed to enforce limits and diagnose abuse. Backups and platform security logs may persist for a limited additional period.
6. Security
Krung uses salted password hashing, restricted database access, secure server-issued cookies, transport encryption on the live site, and reasonable administrative safeguards. No online service can guarantee absolute security. If you believe your account or information is at risk, contact us promptly.
7. International processing
Service providers may process information outside Thailand. Where required, Krung will use appropriate contractual or legal safeguards and limit transfers to what is needed to provide the service.
8. Your choices and rights
Depending on applicable law, including Thailand's Personal Data Protection Act, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and to complain to the relevant data-protection authority. Some rights have legal exceptions. Email support@krung.news with enough information for us to verify the account. You may unsubscribe from marketing email at any time.
9. Children
Krung is a general-audience news publication and is not directed to young children. If a minor needs parental or guardian consent under applicable law, that consent must be obtained before creating an account or purchasing a subscription. Contact us if you believe a child submitted personal information without valid permission.
10. Changes
We may update this policy as services or legal requirements change. The updated date will appear at the top, and material changes may be announced on the site or by email where appropriate.