SoDa Book Privacy Policy
Last updated: 11 November 2026 · Effective from: 12 November 2026
This Policy explains what personal data SoDa Book collects, why, who we share it with, and what rights you have. It follows Vietnam's Law on Personal Data Protection No. 91/2025/QH15, Decree 356/2025/ND-CP and other applicable Vietnamese laws.
1. Who is responsible for your data
SoDa Book (sodabook.app) is the controller and processor of your personal data when you use the Service. Contact for personal data matters: sodabooksupports@gmail.com. Once SoDa Book is registered as a business, its legal details will be added here.
2. Data we collect
| Category | Data | Source |
|---|---|---|
| Account | Name, email, profile picture and Google account ID | Google, when you sign in |
| Profile | Display name, confirmation that you are 16+, invite code, in-app settings | You |
| Reading activity | Stories read, choices, text you type, progress, turns used, play times, ratings/reports | Generated as you use the Service |
| Wallet and payments | S-Point balance, Pass, top-up and usage history; order code, amount, time, transfer reference; sender's name and bank account number (if sent by the bank/SePay) | You, SePay and banks |
| Technical | IP address, device type, browser, operating system, access and error logs, data stored on your device (local storage) | Your device |
| Support | Emails you send, screenshots | You |
We do not ask for national ID numbers, photos of ID documents, biometric data or precise location. Please do not type real or sensitive personal information (yours or anyone else's) into the free-text box while playing.
3. Why we use your data
We use your data to:
- Provide the Service: sign-in, saving progress, generating the story with AI based on your choices, counting turns, managing your Wallet and Pass.
- Process payments: confirm transfers, add Pass/S-Point, issue refunds, reconcile, and keep records as required by accounting and tax law.
- Keep the Service safe and lawful: detect fraud, abuse and prohibited content; handle reports; respond to requests from competent authorities.
- Operate and improve: fix bugs, measure cost and quality, and improve stories, prompts and the experience. For improvement analysis we prefer de-identified data (without name, email or account ID).
- Train AI — only with your separate consent (see Section 4).
- Communicate: send necessary notices about your account, transactions and changes to our terms. Promotional messages are sent only with your consent, and you can unsubscribe at any time.
By signing in and accepting this Policy, you consent to processing for purposes 1–4 and 6 (necessary notices). Some processing takes place without consent where the law allows it (for example to perform our contract with you, meet accounting obligations or comply with authorities).
4. AI and your data
4.1. Generating stories. To continue the story, your choices, the text you enter and the preceding story are sent to AI model providers through OpenRouter. We do not send your email or Google account name to model providers. Where possible, we choose settings that do not allow providers to use this data to train their own models.
4.2. Shared story paths. Passages generated from pre-set choices may be saved and shown to other readers who take the same path; these passages are not linked to your identity. Passages generated from text you type yourself are not shown to others.
4.3. AI training (optional). We do not currently use your data to train AI models. In future, we may use your reading history and input to train or fine-tune AI models for SoDa Book, only if you turn on "Allow my data to be used to train AI". This setting is off by default. Data is de-identified before being used for training. You can turn it off at any time on the Profile page; turning it off does not affect your use of the Service and applies from that point on (de-identified data already incorporated into a model may not be separable).
4.4. We do not use AI to make automated decisions that have legal or similarly significant effects on you.
5. Sharing your data
We do not sell your personal data. We share only what is necessary with:
| Recipient | Role | Where processed |
|---|---|---|
| Sign-in with Google | Outside Vietnam (mainly USA) | |
| Supabase | Database, authentication, storage | Outside Vietnam |
| Vercel | Website hosting and delivery | Outside Vietnam (USA and global edge network) |
| OpenRouter and AI model providers (e.g. OpenAI, Anthropic, Google) | Generating story text, images and audio | Outside Vietnam (mainly USA) |
| SePay and banks | VietQR codes and transfer confirmation | Vietnam |
| Competent state authorities | When required by law | Vietnam |
If we add analytics or error-monitoring services, we will update this list before using them. Processors acting on our behalf may use data only on our instructions and must keep it secure.
6. International transfers
As shown above, some of your data is stored and processed outside Vietnam. We prepare a cross-border personal data transfer impact assessment as required by law, transfer only what is necessary, choose providers with appropriate security, and encrypt data in transit.
7. How long we keep data
- Account and reading activity: for as long as you use the Service. When you delete your account, data is deleted or de-identified within the time stated in Section 9.
- Text you type and play logs: up to 24 months from creation, then deleted or de-identified.
- Transactions: for the record-keeping period required by accounting and tax law.
- Backups: overwritten on a rolling basis, at most 30 days.
- Shared story passages (Section 4.2) are not linked to your identity and may be kept.
8. Security
We use appropriate technical and organisational measures: encryption in transit (HTTPS), database access controls, limited staff access and logging. If a personal data breach occurs, we will notify the competent authority and, where needed, you, within the time required by law. No system is completely secure, so please keep your Google account safe.
9. Your rights
You have the right to: be informed about processing; give or refuse consent; withdraw consent; access, correct or obtain a copy of your data; request deletion; restrict or object to processing; and complain, report, sue and claim compensation as provided by law.
How: use the options on the Profile page (for example deleting your account) or email sodabooksupports@gmail.com from your account email. We may need to verify your identity first.
Response times (under Decree 356/2025/ND-CP), from receipt of a valid request: withdrawing consent, restricting or objecting — within 15 days; access, correction or a copy — within 10 days; deletion — within 20 days. Some data may have to be kept where the law requires (for example transaction records); we will tell you if so.
10. Children
The Service is for people aged 16 and over. We do not knowingly collect data from anyone under 16. If we find such data, we will close the account and delete the related data. Parents or guardians can contact us to request deletion. Users aged 16 to under 18 need consent from a parent or guardian to buy a Pass or S-Point.
11. Cookies and on-device storage
We use necessary cookies and local storage to keep you signed in, remember settings, support installing the app (PWA) and show prompts at the right time. We do not currently use advertising cookies. If we later use analytics or advertising cookies, we will ask for your consent first.
12. Changes to this Policy
When we update this Policy, we will change the "Last updated" date and notify you in the app or by email of material changes. If a change requires new consent (for example a new purpose), we will ask for it first.
13. Language
This Policy is available in Vietnamese and English. If they differ, the Vietnamese version prevails.
14. Contact
SoDa Book · sodabooksupports@gmail.com · sodabook.app