Privacy

What LươngMình collects, what it is used for, how long it is kept and how you stay in control.

Draft, not yet released

This page describes how the service works today, but details of the operator are still missing (marked “Not published yet”). Don’t treat it as the official policy yet.

Summary

A salary check before you sign in: what you enter and the result are not saved, never become history or data for group figures, and are never linked to an account later.
We show group figures only, never one person’s pay. Groups with too few people are hidden.
Verification documents are never shown publicly or to other users. Only authorized verifiers can open them to review.
You can delete each salary you shared, each check, or your whole account.
The phone app has no analytics, advertising or tracking tools. The website uses anonymous analytics with no tracking cookie.
If you arrive from a campaign link, for example on Facebook or Zalo, its channel is only added to that channel’s total, never linked to you or your salary.

Who is responsible

This is who operates LươngMình and how to reach them about personal data.

Operator: Not published yet
Address: Not published yet
Email for personal-data requests: Not published yet

What we collect

Each item below happens only when you do that thing.

Before you sign in: you enter details into the checker to get an estimate. They are used to work out the result and are not saved. To stop abuse, the server counts requests by your device’s network address, only in memory and as a hash under a random key. The count is gone within an hour or when the service restarts, and it is never written to the database.
Account: your email. For an email sign-in link we store the link’s code as a hash; the link lasts 15 minutes and works once. With Google we receive the email Google returns. With Apple on iPhone we store your Apple identifier and email (which may be a private relay address Apple creates). We may also store Apple’s refresh token, encrypted, to revoke the Apple sign-in when you delete your account.
Sign-in session: on the web, a sign-in cookie that lasts 30 days. In the app, a 15-minute access token and a 30-day refresh token, up to 90 days from sign-in; the app keeps them in the phone’s secure storage. The server stores the session as a hash, with the app ID and operating system (iOS or Android).
Check history (only when signed in): role, company, years of experience, province, level, the pay and currency you entered, employment status and work type, and the result and market figures at the time of the check.
Salaries you share: company, role, experience, level, where pay is received, employment status, work type and work mode, the month it applies to, monthly gross pay, the bonuses, allowances and equity you enter, whether you agree to anonymized use, and verification status.
Verification documents (optional): files you upload to back up a salary, up to 10 MB, stored privately on the server. Only authorized verifiers can open them to review, and each view is logged.
Alerts (optional): the groups you follow, in-app notifications and a weekly email. Nothing is on by default.
Phone notifications (optional, only if you turn them on in Account in the app): the phone’s Expo push token, a random ID for this app installation, the operating system (iOS or Android), your preferred language, when it was registered, and a link to the account and sign-in that turned them on. For each notification we keep its delivery status, not its content. Nothing is on by default.
Level suggestions and company benefits you share, if you send them.
A share card if you create one: a percentile or band, role, broad region, confidence and data date. The pay gap is added only if you choose. Never actual pay, email or current employer.
Page feedback: the page you were on, the language, Helpful or Needs work, and a note if you write one. The saved answer has no account, email, network address or exact time; the time is rounded down to the hour. It is sent without cookies.
Campaign links: a link we share, such as on Facebook, Zalo, TikTok or through a partner, has a channel name and a campaign name at the end of the address. Like any page address, it reaches our server when you open the page; the website then removes the two names, and any ad-tracking code, from the address bar. Other websites you open from LươngMình see only our site’s name, not which page you were on. Your browser remembers the two names for up to 7 days. If you share a salary in that time, your browser sends the two names once, separately from the salary and without cookies, then deletes them. The server adds 1 to that channel and campaign’s total for the day only if it is a link we created; anything else is added to “other”. It stores no account, salary, network address or exact time. The phone app doesn’t do this.
Server logs: like any web service, the server or a proxy in front of it may record the network address, time and path of each request, including a page-feedback or campaign-tally request. These logs are separate from the anonymous feedback answers and channel totals that are saved, and how long they are kept is under “How long we keep it and how to delete it”.
On the phone, the app remembers your language choice on the device. It does not ask for location, contacts, photos, camera or microphone.
On the website, we record a few anonymous events about whether a check, contribution or sign-in finished, and generic error messages. It records no clicks or screens automatically, sets no analytics cookie and does not record where you came from.

What we use it for

Working out and showing how your pay compares.
Building group figures from qualifying salaries. Shared salaries are screened for duplicates and anomalies before they count.
Reviewing shared salaries and verification documents, so each gets the right verification label.
Letting you sign in, and sending sign-in links and the weekly alerts you turned on.
If you turn on phone notifications, sending at most one a week when the weekly digest for a group you follow has a change. The text is generic: no salary figures, role or company.
Preventing abuse, for example by limiting how many requests are accepted in an hour.
Improving pages from anonymous feedback.
Counting salaries shared per channel, to learn where to tell people about LươngMình.
The website and the app contain no advertising and no advertising trackers.

What is shown publicly

Group figures only: P25, P50, P75, group size, confidence and freshness. Groups with too few people are hidden to protect privacy, and in places only a range is shown instead of an exact number.
How many people have shared their salary, on the home page and the Share your salary page, only once at least 1,000 have, and rounded down, for example “More than 12,300 people”. Each person counts once, however many salaries they share. It is one total and says nothing about who shared.
The recently shared list is reduced: dates, places, levels or pay amounts are merged or hidden when their combination could identify someone.
Verification documents are never shown publicly or to other users, anywhere. Only authorized verifiers can open them to review.
Anything you don’t know, like a bonus or allowance, is never counted as 0.

How long we keep it and how to delete it

Checks before you sign in: not kept.
Salaries you share, check history, alerts, level suggestions and benefits: until you delete them or delete your account.
Current figures use only entries from the most recent 24 months; entries 25–60 months old are used only for trends; anything older than 60 months is neither shown nor used in calculations.
Verification documents: deleted as soon as there is a final decision, and deleted once they expire if they are still unreviewed 7 days after upload. Deleting a salary or your account deletes its documents too.
Sign-in sessions: 30 days on the web, up to 90 days in the app. Signing out or deleting your account ends them.
Phone notifications: until you turn notifications off on that phone, sign out of the app on that phone, or delete your account; then the phone and its delivery records are deleted. A token Expo reports as no longer valid is not sent to again. An account keeps at most 10 phones, the one updated least recently dropped first.
Share cards: expire after 6 months, or sooner if your unlock ends first. Deleting the salary behind a card deletes the card.
Page feedback: kept until an administrator deletes it. Because feedback isn’t tied to an account, we can’t find your own answer to delete it.
Campaign names in your browser: deleted after 7 days, or as soon as they are sent. You can also remove them by clearing this site’s data in your browser. Channel totals are kept as daily numbers; since they are tied to no one, no part of them is yours to delete.
After you delete, group figures are recalculated without your entry.
A log of document views and review decisions may be kept. It holds only the document ID, who viewed or decided, and when. It has no document content and no email of yours.

How long server access logs are kept: Not published yet
How long backups are kept: Not published yet

Your rights

Under Law No. 91/2025/QH15 on Personal Data Protection (in force since 1 January 2026), Article 4, you have the right to be informed about processing, to consent, refuse or withdraw consent, to view and ask to correct your data, to ask for your data to be provided, deleted or restricted, to object to processing, and to complain.

You can do much of this yourself in LươngMình:

See and edit the salaries you shared in Account.
Withdraw or give again your consent to anonymized use on each salary. A salary without consent doesn’t unlock access and doesn’t enter group figures.
Delete a salary, a check, or all of your check history. Deleting check history doesn’t delete a salary you shared.
Turn alerts off at any time, and turn notifications off on each phone in Account in the app.
Delete your whole account. See “Delete your account”.
For any other request about personal data, contact us using the details under “Who is responsible”.

Time to handle a data request: Not published yet