Privacy Policy.
1. Overview
This site is operated by Kaung Ye Marn, an individual based in Thailand, who is the controller of the personal data described here. It's a personal portfolio and a public reference for a TCG collection, and it collects very little information about visitors.This policy covers visitors to this site, people who send an inquiry, and people who buy a card from me. It does not cover the personal data of a client’s own customers or subscribers that I handle while doing a client’s work. For that, the client is the controller and I am the processor, under a data processing agreement (section 10).
I follow Thailand’s Personal Data Protection Act, and I apply the same standard to visitors from Singapore, the EU, the UK and Myanmar, so the rights in section 9 are yours wherever you are.
2. Information I collect
Analytics: the site uses Vercel Analytics, which measures page views and traffic in aggregate without cookies or collecting personally identifiable information. If you accept the optional cookies described in section 4, the site also uses Google Analytics and the Meta Pixel.Contact: if you email me directly, I receive whatever you choose to include in that email.
Inquiry form: the Products page has a form for requesting a quote. It collects your name and email, optionally a company or project name and any notes you write, and a record of which packages and tiers you selected. Those fields are emailed to me so I can scope the work and reply, and are also saved to this site’s own database so an inquiry is not lost in an inbox. That record is private: it is readable only by me, through a password-protected admin page, and no part of it is ever shown publicly or shared. No payment details are asked for or accepted anywhere on this site, and selecting a package charges nothing.
One thing is captured that you do not type: the referring address, meaning the page you were on immediately before arriving here, if your browser sends one. It tells me whether you came from a search result, a social post, or somewhere else, which helps me answer you usefully. It is included in the inquiry email and saved with the stored record. Browsers often send nothing at all, and referrers from inside this site are discarded rather than recorded, so in many cases the field is simply empty.
When you submit that form, the server briefly holds your IP address in memory to limit how many submissions can arrive in a minute. It is not written to a database, not stored alongside your inquiry, not used to identify you, and is discarded within minutes.
WhatsApp: several buttons on the Products page open WhatsApp with a message already typed for you, naming the package or system you were looking at. Nothing is sent until you send it, and I receive nothing if you close the window. If you do send it, the conversation happens on WhatsApp rather than here, on Meta’s infrastructure and under Meta’s own privacy terms.
Inquiries are kept as long as needed to answer them and to keep a record of work quoted or agreed. Ask and I will delete yours, unless it relates to an engagement I am required to keep records of for tax or accounting purposes.
Buying a card: it happens on the Burmese Jones Card Vault page on Facebook, not here. Those conversations run on Meta's infrastructure under Meta's own privacy terms, and this site receives nothing from them. To send you a card I need a delivery address, a phone number for the courier, and a payment reference. I use them to fulfil and to keep a record of the purchase, I do not use them to market to you, and I do not pass them to anyone but the courier handling your parcel. If you win an auction and cannot be contacted or do not pay, I keep your Facebook name on a private list so you cannot buy from the page again. The list holds nothing else, and I do not share it.
Newsletter: the Newsletter page has a form that takes an email address and a tick to say you agree, and nothing else. It stores your address, the page you signed up from, which wording of the consent you were shown, and the times you asked, confirmed and, if you do, unsubscribed. It sends one email asking you to confirm, and nothing else is sent to you until you press the link in it. Every newsletter will carry a link to unsubscribe. As with the inquiry form, the server briefly holds your IP address in memory to limit how often the form can be used, and does not store it. Subscriber records are private: they are not readable by the public key the website ships with, and they are never shown publicly, and are shared only with the mail provider named in section 5.
No accounts: the site doesn't require you to sign up, log in, or submit personal data to browse the portfolio, blog, or TCG collection.
3. Why I use it, and on what basis
To answer an inquiry and scope the work you asked about: I use your name, email, notes and selections because you asked me to, and to take steps toward a contract at your request. Under the GDPR the basis is that step, or my legitimate interest in replying to a business inquiry.To keep a record of work quoted or agreed: I keep it because tax and accounting rules require records, and because I need proof of what was agreed.
To complete a card purchase: I use your delivery address, phone number and payment reference to complete the purchase you made with me.
To protect card purchases: the barred-bidder list holds a Facebook name so a person who did not pay cannot buy again. The basis is my legitimate interest in preventing non-payment fraud.
To keep the site running and understand traffic in aggregate: Vercel Analytics and server logs, which identify no one.
To see which pages and posts bring visitors, and to show my cards and services to people who looked at them: Google Analytics and the Meta Pixel, only if you accept them in the cookie banner. The basis is your consent, which you can withdraw at any time from Cookie settings in the footer.
To send you the newsletter: only if you ask for it and then confirm by email. The basis is your consent, which you give by ticking the box and pressing the link in the confirmation email, and which you can withdraw at any time by unsubscribing.
Apart from the newsletter and the optional cookies in section 4, I do not rely on consent for anything on this site, because I ask for nothing else that needs it. I do not sell personal data, I do not use it to build profiles, and I make no automated decision about you.
4. Cookies
The site stores a theme preference (light or dark mode) locally in your browser, and a cookie called kym_consent that remembers your cookie choice for six months. Neither is used for tracking and neither is shared with anyone.Nothing else is set by default. If you press Accept, or switch a category on under Pick, two third-party services load:
Analytics (Google Analytics 4). Google sets cookies (_ga and _ga_) and receives your IP address, your device and browser details and the pages you view, so I can count visits and see which pages and posts bring them. The data is kept in my Google Analytics property for 14 months. Google signals and ad personalisation are off.
Ads (Meta Pixel). Meta sets a cookie (_fbp) and receives the pages you view and a few actions: opening the Open Vault page, clicking through to my Facebook pages or WhatsApp, signing up for the newsletter and finishing a self-check. Meta uses that to show my cards or services to people who looked at them, and it may match it to your Facebook account if you are logged in to Facebook in the same browser. I never send your email address or anything you type into a form to Meta.
Neither service loads on the admin pages. If you press No thanks, or do nothing, neither loads and neither sets a cookie. You can change your choice at any time with Cookie settings in the footer. Switching a category off deletes its cookies and reloads the page.
5. Third-party services
Vercel handles hosting and analytics. Cloudinary hosts and delivers images (card photos, project images). Supabase stores three separate things: the TCG collection data shown publicly on the Collection page, which is my own card data and not visitor data; since Sep 2026, inquiry submissions and the client records that follow from them; and since Oct 2026, newsletter subscriber records. The last two are visitor data and are locked down accordingly. Those tables are not readable by the public key the website ships with, and are reached only through a separate server-side credential.Inquiry form submissions are sent to my own server and delivered to my inbox as email by Resend (resend.com), which acts as the mail provider and does not use the contents for anything else. Resend also sends the newsletter confirmation email and the newsletter itself. To do that I copy the addresses of people who have confirmed into Resend, which holds them as a mailing list and records who has unsubscribed. Where no mail provider is configured, the form instead opens your own email client with the details filled in, and nothing is transmitted to anyone but me.
Google, through Google Analytics, and Meta, through the Meta Pixel, receive data about your visit only if you accept them in the cookie banner, as section 4 describes. Each acts as an independent controller of what it receives, and its own privacy policy governs how it uses it. Google and Meta may process that data outside Thailand, including in the United States.
WhatsApp, operated by Meta, carries any conversation you choose to start from a WhatsApp button on this site. Those messages are handled by Meta, not by this site, and this policy does not cover them.
GitHub, owned by Microsoft, hosts the free software-style items offered here, and Google Drive hosts the free TCG tracker spreadsheet. Following one of those links takes you to GitHub or Google, where their privacy policies apply and not this one. Downloading a free item requires no signup and sends me nothing: no email, no identity, no record that you took it. I see only the public counts GitHub shows any repository owner, such as stars and clones, which identify nobody, and I do not look at who opens or downloads a public Drive file.
Free tools that run on this site, such as the Four-Beat Self-Check, work entirely in your browser. What you type into them is not sent to me and is not stored. If you accepted analytics cookies, finishing one is counted as an event with the tool’s name and nothing you typed.
These providers operate outside Myanmar, so submitting the form means your details are processed abroad.
6. Where your data goes
I am in Thailand, and the providers in section 5 run their services in other countries, including the United States. Submitting a form or messaging me means your details are processed abroad. Where the law requires a safeguard for that, I rely on the providers’ own data processing terms, which include the standard contractual clauses approved for transfers from the EU and the UK, and on contractual commitments to a comparable standard for data from Thailand and Singapore. I do not send personal data to anyone else beyond what section 2 describes.7. How long I keep it
An inquiry that does not become work is kept for up to twelve months and then deleted, so that I can recognise a returning enquirer and answer them properly. An inquiry that becomes work is kept for as long as the engagement and its accounting and tax records require. Card purchase details are kept for as long as the purchase and its records require. The barred-bidder list is kept for as long as the person is barred. The IP address held to limit form submissions is discarded within minutes. A newsletter signup that is never confirmed can no longer be confirmed after seven days and is cleared out by hand. A subscriber is kept until they unsubscribe, in my database and in the copy held in Resend. An unsubscribed address is kept as a suppression record in both places, so that it is not added again by mistake, until you ask me to delete it from both. Deletion before any of these points is yours to ask for, at the address in section 14. It is done by hand rather than on a timer: there is no automated purge, and saying otherwise would describe something that does not exist.8. Security
The inquiry records are private and readable only by me through a password-protected admin page. They are not readable by the public key the website ships with, and they are reached only through a separate server-side credential. Traffic to this site is encrypted. I limit access to what the work needs, protect my accounts with unique logins and multi-factor authentication where a provider offers it, and keep my devices encrypted and up to date. No system is perfectly secure. If a breach of your data is likely to harm you, I will tell you without undue delay and tell the regulator where the law requires it.9. Your rights
You can ask me to tell you what I hold about you, give you a copy, correct it, delete it, restrict how I use it, or stop using it for something you object to. Where I act on your consent, you can withdraw it. Where you gave me data in a form I process by computer, you can ask for it in a common format. I will act on a request, and answer it, within 30 days, unless the data relates to an engagement I am required to keep records of for tax or accounting purposes, in which case I will say so and tell you what is being kept.You have the right to complain to a regulator. In Thailand that is the Personal Data Protection Committee. In Singapore it is the Personal Data Protection Commission. If you are in the EU, it is your national data protection authority, and in the UK it is the Information Commissioner’s Office. I would like the chance to put it right first, so please write to me before you complain.
The only mailing list on this site is the newsletter, and the only way onto it is to ask and then confirm by email. Sending an inquiry starts a conversation about the work you asked about, not a marketing sequence, and buying a card or downloading a free item never adds you to the newsletter.