Welcome to Thapaye (“we”, “our”, or “us”). Thapaye is a gamified cyber crime awareness platform that helps users in Nepal recognize and avoid common online scams (such as vishing, OTP fraud, gaming scams, and identity theft attempts on platforms like eSewa and Khalti).

Your privacy is important to us. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website https://thapaye.com, our application, and related APIs (collectively, the “Platform”).

By using our Platform or logging in through third-party accounts (like Google), you agree to this Privacy Policy. If you do not agree, please do not use our services.

1. Information We Collect

We collect information to provide and improve our services. This may include:

a. Information You Provide

• Name, email address, phone number, and other profile details when you register or log in.
• Game progress, quiz responses, scores, badges, and leaderboard rankings.
• Content you submit through forms, feedback, scam-report simulations, or contact requests.
• Any real-world scam reports you voluntarily submit for awareness or moderation purposes.

b. OAuth / Third-Party Login Information
When you log in using Google or other providers, we may receive your name, email address, profile picture, and unique user ID, along with any other data you grant permission to share via OAuth consent. We only use this data for authentication and to create your user account. You can revoke this access anytime through your Google Account settings.

c. Automatic Data (Usage & Logs)
When you use our app or website, we automatically collect IP address, device type, operating system, browser type and version, time and date of access, pages/levels visited, in-app actions performed, and error/performance logs to improve reliability.

d. Cookies & Analytics
We use cookies and analytics tools (like Google Analytics) to maintain sessions, remember preferences, and understand how users interact with the Platform. You can disable cookies in your browser settings, though some features (like saving your game progress) may stop working properly.

e. Gamification & Leaderboard Data
If you participate in leaderboards or challenges, your display name, score, and rank may be visible to other users. You may opt to use a pseudonym instead of your real name where the Platform allows it.

2. How We Use Your Information

We use your personal information to:

• Authenticate and manage your account (OAuth login).
• Provide, operate, and maintain the game, quizzes, and awareness modules.
• Track learning progress and personalize scam-awareness content and difficulty.
• Operate leaderboards and reward/badge systems.
• Communicate with you about updates, support, and security alerts.
• Analyze performance and usage trends to improve the Platform and its educational content.
• Comply with legal obligations and enforce our Terms of Service.

3. How We Share Information

We do not sell or rent your personal information. We may share limited data in the following cases:

• Service Providers: With trusted third-party partners (e.g., hosting, analytics, cloud storage) who help us operate our services.
• Legal Requirements: If required by law, court order, or government request — including cooperation with Nepal Police Cyber Bureau where relevant to reported scam activity.
• Protection: To detect or prevent fraud, security issues, or potential harm, including misuse of the Platform to spread real scam content rather than awareness material.
• With Your Consent: If you give explicit permission for certain integrations.

All third-party partners are required to keep your information secure and use it only as instructed by us.

4. Important Clarification — No Real Financial Transactions

Thapaye is an awareness and simulation tool. We do not process real payments, and any references to platforms like eSewa or Khalti within the app are for educational simulation purposes only. We will never ask you for your actual banking details, OTPs, PINs, or passwords through the Platform. Any message claiming to be from Thapaye requesting such information should be treated as fraudulent and reported to us immediately.

5. Data Retention & Deletion

We keep your personal data only as long as your account is active or needed to provide services. When you delete your account or revoke OAuth access, your personal information will be deleted or anonymized within a reasonable timeframe. Game and quiz data may be retained in aggregated, anonymized form for research and program-impact reporting. You can request full deletion of your account data anytime by contacting us at info@thapaye.com.

6. OAuth Token & Access Control

When you sign in via Google or other OAuth providers, we store access tokens securely using encryption and do not share them publicly. Tokens are used only for authentication. You may revoke access anytime through your Google Account: https://myaccount.google.com/permissions. After revocation, your account will no longer be linked, and we will delete related session data.

7. Security

We use technical and organizational measures such as HTTPS (SSL/TLS) encrypted communication, firewalls and restricted access controls, secure cloud storage, and regular system updates and security monitoring. No online service is 100% secure, but we continually improve our safeguards.

8. Your Rights

You have the right to:

• Access and obtain a copy of your personal data.
• Request correction or deletion of inaccurate data.
• Withdraw consent or revoke OAuth permissions.
• Request account deletion or data export.
• Opt out of leaderboard visibility.

To exercise these rights, contact us at info@thapaye.com. We will respond within a reasonable timeframe.

9. Children’s & Youth Privacy

Because Thapaye may be used in school or youth-education settings, we take extra care with users who may be minors:

• Where the Platform is deployed through a school or institution, that institution is responsible for obtaining any necessary parental/guardian consent.
• We do not knowingly collect more personal data from minors than is necessary for the educational experience (e.g., we avoid collecting phone numbers from users identified as under 18 where possible).
• If you believe a child has provided us with personal data outside an authorized institutional program, please contact us for immediate removal.

10. International Data Transfers

If you access our Platform from outside Nepal, your information may be transferred and processed in other countries where our servers or service providers are located. We ensure such transfers comply with applicable data protection laws.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any major changes will be notified via email or displayed prominently on our website. Continued use of our Platform after updates means you accept the revised policy.

12. Contact Us / Grievance Officer

If you have any questions, concerns, or requests related to this Privacy Policy, or wish to report suspected misuse of the Platform, please contact us at:

Thapaye
Email: info@thapaye.com
Website: https://thapaye.com
Location: Kathmandu, Nepal