VISITOR INFORMATION
Privacy Policy
Effective date: October 30, 2026 · Last updated: October 30, 2026
This policy describes how Muay Thai Trip Planner at muaythaigymsinthailand.com handles visitor information. The website is operated by Higuera Services LLC, based in California, USA. Questions and privacy requests: muaythaigymsinthailand@gmail.com.
Your planning information
The budget calculator uses expense amounts, currencies and trip length in your browser. The visa checklist uses U.S. passport nationality, duration, purpose and optional arrival and departure dates. The tools do not ask for your name, passport number, uploaded documents or payment information.
Requested planning answers, destination, budget inputs and checklist task keys are saved in this browser tab’s session storage so the calculator, entry guide and My Thailand Trip Summary can reuse them across navigation and reloads. Closing the tab normally ends the session, but browser restore can retain it. Use Clear my trip on the summary page to remove these planning answers and checkmarks; cookie choices and public-data caches are kept. If session storage is blocked, answers may be lost on navigation or reload. The current entry form uses this session snapshot rather than saving a separate browser-history draft. Older versions may have left duration, unit and purpose in browser history entries, controlled by your browser. New checklist and summary links do not put answers in the URL. Older checklist links containing duration, unit and purpose remain supported; those URLs may be received by hosting and retained in browser history. Avoid sharing them if you do not want others to see those selections.
Budget Calculator and Visa Checklist PDFs are generated on your device using the current planner data and remain downloadable without an email address. Your browser and any storage or synchronization service you choose may retain these downloaded files. The online Trip Summary reuses the same session data. Optional verified email delivery of its PDF is described in the Trip Summary email section below. When delivery is unavailable, your online plan and the original PDF downloads remain available.
Services that receive requests
Delivering pages and external data requires network connections. The receiving service can see connection information such as your IP address, request time, browser information and requested URL. A referrer may be sent according to browser policy.
- Open-Meteo: your browser requests forecasts and modeled air quality for a selected Thailand destination using the site's fixed reference coordinates. It does not request your device's GPS location. Historical seasonal averages are served from a site-hosted file. See Open-Meteo's terms and privacy information.
- ExchangeRate-API: your browser requests reference exchange rates with THB as the fixed base. Your entered expense amounts are not included in this request. See its service and privacy terms.
- OpenAQ: your browser requests a supported city from this site's server. The server queries nearby stations using the operator's API key and destination coordinates; it does not forward your planner entries or visitor IP as an application parameter. See the OpenAQ Privacy Policy.
- U.S. Department of State: this site's server requests the Thailand advisory from its official API or RSS feed. No traveler answers are sent as application parameters. Following official source links opens those external services. See State Department privacy information.
- Google Fonts: the site requests the DM Sans font from Google Fonts to display its existing typography. This connection occurs even when optional analytics is rejected. See Google Fonts privacy information.
- Hosting: OpenAI Sites and Cloudflare infrastructure deliver this website and its server endpoints. Network/request data may be processed for delivery, diagnostics and security. See OpenAI's Privacy Policy and Cloudflare's Privacy Policy. Provider policies and service settings govern technical logs and their retention; those practices can change independently of this website.
External social-media and government links are ordinary links, not embedded social widgets. Their operators receive requests when you follow them. Optional Trip Summary delivery uses Resend and Cloudflare Turnstile as described below. There is no newsletter sign-up, marketing-list integration or payment checkout.
Optional Google Analytics
After you allow analytics, the existing GA4 measurement configuration is used on the homepage and training article to understand page use, traffic sources and website performance. Analytics is not newly enabled on the visa guide or these legal pages.
GA4 may process browser and device information, approximate location, page and referrer information, timestamps and usage events, with cookie identifiers that distinguish browsers and sessions. Google says GA4 uses IP addresses during collection to derive location, then discards them before logging. See Google's regional collection documentation.
This update does not intentionally send typed budget amounts, traveler dates or checklist answers as custom analytics events. The page URL and referrer supplied to the analytics configuration omit query strings and fragments. The tag explicitly disables Google Signals and advertising-personalization signals; advertising consent stays denied.
As of October 30, 2026, the GA4 account settings specify two months for event data and 14 months for user data, with reset on new user activity enabled. This reset can extend user-data retention when a user returns. These settings do not impose the same expiration on standard aggregated reports; cookie lifetimes are separate.
Google Signals is off. One Google Ads account is linked, with personalized advertising disabled for that link. An Ads link can support measurement and data exchange even without personalized advertising. Enhanced measurement is enabled and includes page-view measurement. The operator has enabled Google’s email-address redaction as an additional, best-effort safeguard.
Cookies, local storage and choices
Optional analytics and YouTube embeds stay off until you choose. The initial choices are not preselected. Use in the footer to accept, reject or change them later. Rejecting optional services does not disable the planner, PDFs, weather, AQI or official-source links.
| Item | Purpose and duration |
|---|---|
muayThaiPrivacy.v1 | Remembers your optional-service choices and choice time for up to 180 days on this browser. You can change them sooner or clear browser storage. If storage is unavailable, choices apply only to the open page. |
_ga, _ga_… | GA4 browser/session identifiers, only after analytics consent. Google's documented default cookie lifetime is two years, subject to browser limits and GA4 settings; this is not a claim about this property's analytics-record retention. |
| Exchange-rate, weather and AQI cache entries | Store public response data and fetch timestamps, not budget entries. Freshness checks use one hour for exchange rates, 30 minutes for forecasts, 30 days for historical averages, and short model/station cache windows. These are freshness periods, not guaranteed deletion times; entries can remain until overwritten or browser storage is cleared. |
muayThaiTrip.v1 (session storage) | Requested trip selections, budget inputs and checklist completion keys for this tab’s session. Survives reloads; browser restoration can retain it. Clear my trip removes this entry. No email address, passport number or PDF is stored in it. |
| Older homepage history state and guide URLs | Earlier versions could retain duration/unit/purpose in browser navigation history. Older answer links remain supported; these entries are controlled by your browser’s history lifecycle. |
When you withdraw analytics permission, the site disables measurement, removes readable first-party GA cookies for this domain and reloads if the analytics tag had loaded. Removing a loaded video permission also reloads the page. Download your checklist first if you need to keep unsaved entries. Withdrawing permission does not erase data already sent to a provider.
The site treats Global Privacy Control and a Do Not Track value of 1 as instructions to keep analytics off, even over an earlier analytics choice. A visitor may still separately enable requested video embeds. This is an implementation choice, not a claim that the same legal obligation applies everywhere.
Google Fonts and requested API/hosting connections continue without optional analytics. Browser or platform security cookies may also be used by hosting infrastructure for service delivery and protection; the linked provider policies describe their practices.
Optional embedded videos
The training guide uses YouTube's privacy-enhanced embed domain. No embedded player or thumbnail is requested before you allow YouTube videos. Enabling videos connects to Google/YouTube, which can receive your network/device information and use storage or identifiers under its own policies. Privacy-enhanced mode does not mean there is no data processing. You can use the original external video link instead. See YouTube's embedding documentation and Google's Privacy Policy.
Messages, retention and security
If you email muaythaigymsinthailand@gmail.com, the operator and the email services involved receive your email address, message and any attachments you choose to send. The contact address uses Gmail. Please send only information needed for your question; do not email passport scans, payment details or medical records.
The application has no visitor account or marketing subscriber database. Optional Trip Summary requests use the temporary encrypted storage and security records described below. Analytics retention settings are described above. Contact correspondence and hosting logs are handled separately. How long correspondence is retained depends on the purpose of the request, necessary follow-up and applicable recordkeeping requirements. You can contact the operator to ask about retention or request deletion of your correspondence. Infrastructure providers also apply their own retention policies and service settings. Browser caches do not establish their retention periods.
External providers may process information in countries outside your own. The linked provider notices describe their processing practices and available privacy mechanisms; contact the operator with questions about your information. No website, email system or transmission method can be promised completely secure.
Your choices and privacy rights
You can change optional-service consent, clear browser cookies/storage, and contact muaythaigymsinthailand@gmail.com with a privacy question or request. Depending on the law that applies, you may have rights to access, correct or delete personal data, obtain a portable copy, restrict or object to processing, withdraw consent, or opt out of certain sale, sharing or targeted advertising. You may also be able to complain to your local data-protection regulator. Rights have conditions and exceptions; identity verification may be needed using only proportionate information.
California's CCPA applies only when its coverage requirements are met; other California disclosure rules can have different scope. Other U.S. state laws and EU/UK rules also have their own coverage tests. Which rights apply depends on the relevant law and the circumstances of the processing. Contact the operator to ask about or exercise your applicable rights.
The planning tools do not submit budget amounts or checklist entries to an advertising system. The Analytics property has the Google Ads link described above; Cookie Settings controls optional analytics on this website. We do not ask visitors to provide sensitive information or children's personal details to use the tools.
Trip Summary email and temporary storage
When available, you may request a free personalized Trip Summary PDF by email. This is a requested transactional service, not a newsletter. We do not automatically add your email address to Resend Contacts, Audiences or any marketing subscriber list. The planning tools and Budget Calculator and Visa Checklist PDF downloads remain available without email.
Verification and delivery: we receive your email address and the planning information needed for the report, including destination, duration, selected dates and purpose, budget inputs, reviewed public-data values and checklist completion keys. We validate the snapshot and prepare a PDF using the same planning calculations. Later edits do not change a pending report; request a new summary for an updated plan. We send a six-digit code first, then send the PDF only after successful verification. Codes expire after 10 minutes; up to two resends replace earlier codes, with a 60-second wait. Five verification attempts are allowed per code. Turnstile receives your IP address and security-check data to help prevent abuse; see Cloudflare’s Privacy Policy.
Temporary website storage: Cloudflare D1 holds an encrypted envelope containing your email address, PDF and brief report label. We store a keyed code hash, not the code in plaintext. The encrypted envelope and code hash are cleared from the live request row when Resend accepts the report or you cancel it, or by cleanup after expiry. Pending codes and reports expire after 10 minutes, extended by valid resends to at most 30 minutes from the original request. Cleanup is scheduled every minute, with an additional sweep on email requests. This is an operational target, not a guarantee of deletion at the exact second of expiry: outages may delay physical removal, but expired requests cannot be used. Delivery pauses if the scheduled-cleanup heartbeat is missing or more than five minutes old.
Security and duplicate prevention: a minimal request record remains for up to 48 hours from creation, then is removed by cleanup. It contains a random request reference, keyed email identifier, hash of the submitted snapshot, status, attempt/resend counts, timestamps and provider message identifiers; it does not retain the email/PDF envelope after clearing. Keyed identifiers are pseudonymous personal data, not anonymous data. We use them to enforce limits and prevent duplicate sends and misuse. Keyed email/IP rate-limit counters expire at the end of their UTC hour or day (at most 24 hours); probe counters expire at the end of their minute. Aggregate daily/monthly send counters contain no individual email or IP identifier; monthly counters expire 32 days after the start of the UTC month. Expired counters are removed by cleanup. A single latest-cleanup timestamp contains no visitor information. Our application does not deliberately log submitted emails, codes, planner values or PDF bodies. Hosting providers may separately retain network/security logs.
Resend: verification and delivery emails are processed by Resend, including the recipient address, message content, the code in the verification email, the attached report in the delivery email, timestamps, delivery status and related events. Expiring a code here does not erase the verification email held by Resend or your inbox. Resend’s standard Free-plan email/log retention is 30 days; its published security information describes backups kept for seven days. These are provider retention periods, not a guarantee of physical erasure on a particular date. Resend may separately retain suppression records for bounced or complained-about addresses to protect delivery; their retention is governed by Resend. Suppression is not a marketing subscription. Resend states that customer data is stored in the United States. See Resend’s privacy and security information and service limits and retention.
Backups, your browser and requests: deleting a live D1 record does not immediately erase provider backups. Cloudflare D1 Time Travel normally retains recoverable history for seven days on Workers Free or 30 days on Workers Paid; managed-host settings determine the applicable window. Hosting security logs have separate provider-controlled retention. Email/code form values are held in page memory rather than the planner’s session-storage entry; browser autofill and your inbox may retain their own copies. Use the form’s Change Email action to cancel a pending request where sending has not started. Clear my trip clears local planning data; it does not erase sent emails or provider records. Contact muaythaigymsinthailand@gmail.com with a privacy or deletion request; we may need proportionate verification and will explain provider limitations and any necessary security retention. We do not promise complete security or guaranteed inbox delivery.
Changes and questions
Material changes to data handling should be explained before they take effect and require fresh consent where applicable. The effective date and last-updated date appear at the top of this policy. Contact Higuera Services LLC at muaythaigymsinthailand@gmail.com for questions.