Mahalaiby EGO-Works

A community app for university students in Thailand

Your campus.
Your community.

Mahalai brings school communities, conversations and student planning into one app.

Explore MahalaiGet in touch

In development · testing and refinement ongoing

Illustrative previews

Home — fictional Mahalai example
Timetable — fictional Mahalai example
Posts and comments — fictional Mahalai example
GPA — fictional Mahalai example
Chat — fictional Mahalai example

Illustrative previews with fictional content, based on Mahalai interface designs. These are not live app screenshots. Implementation and availability may differ.

Built around student life

School communities

School-based boards for everyday questions, course discussions, events and marketplace posts, with comments, photos and polls.

Conversations

Continue a discussion in one-to-one chats, stay in touch with friends and coordinate in group conversations.

Student planning

Organize classes and personal plans in a timetable, compare schedules with friends and track course grades with GPA tools.

Developed by EGO-Works

Mahalai is developed and operated by EGO-Works, a sole proprietorship established in early 2026. Mahalai is the product; EGO-Works is the operating business. For product and business inquiries, contact [email protected].

Current development stage

Community, chat, timetable and GPA tools are part of the current app implementation. Testing and refinement are ongoing. The screenshot shows a development version and does not indicate public availability.

EGO-Works · Mahalai

Privacy and account deletion

Last updated · 2026-10-12 (Asia/Bangkok)

Privacy notice

Operator and contact

Mahalai is operated by EGO-Works. For support, privacy questions, or account and data deletion requests, contact [email protected].

Information Mahalai handles

Account creation uses your email address and authentication data through Supabase Auth. Your profile can include your school, faculty, student or staff status, entry year, nickname, and avatar. Enrollment verification handles submitted documents, their type and review status, and limited extracted text such as a name and student or admission number when found.

Mahalai handles posts, comments, photos, polls and votes, marketplace details, reports and appeals, support requests and attachments, chat messages and photos, friend and group relationships, timetable blocks, GPA course entries, and notification preferences that you create or provide. It stores device push tokens when you enable notifications, plus operational timestamps, moderation decisions, reports, and administrator actions.

Purposes and visibility

These records support sign-in, school membership, profiles, school feeds, chat and notifications, timetable and GPA tools, support, moderation, report handling, and prevention of duplicate enrollment-proof approvals.

Posts are limited to members of the same school and are anonymous by default. Posters can choose to show their nickname and avatar. Comments use anonymous labels, but the service processes account identifiers internally. Anonymous one-to-one chats can be opened from posts and comments; those rooms hide participant identity in the participant-facing view and disable photo sending. Friend chats and group chats are visible to their participants.

Accepted friends can see current-semester class names and locations for timetable blocks marked as classes. Other personal blocks show only day and time. Group timetable comparisons show busy/free time. A timetable image shared in a chat is visible to that chat's participants.

Enrollment documents and support requests are restricted to the submitting user and authorized administrators in the app. Chat messages and attachments are available to conversation participants and authorized report handling. Administrators can review reported or moderated content and enrollment documents.

Providers and external processing

  • Supabase provides authentication, database, storage, realtime updates, and server functions.
  • Google Cloud Vision receives enrollment documents for OCR and post images for OCR and safety review.
  • Google Vertex AI receives post/comment text and related context for moderation, and can receive attached post images and OCR text.
  • OpenAI is used by a legacy moderation route for submitted school-board names that reach its keyword check.
  • Expo Push receives device push tokens and notification payloads, which can contain short chat/comment previews. Android delivery is configured with Firebase Cloud Messaging.
  • Resend can receive administrator email addresses and generic moderation/legal-request alerts. The reviewed email body does not include reported content.

For questions about external processing or a privacy request, contact [email protected].

Retention currently configured

A daily scheduled job is configured to delete reviewed proof files 90 days after review, and clear extracted name/number candidates and per-submission document hashes after that period. The submission metadata row remains. A separate duplicate-prevention claim retains an HMAC identity key and approved-document hash while the account exists.

Orphaned proof files become eligible for cleanup after one day. Support attachments become eligible after their support request is deleted and they have been orphaned for one day. A failed job or missing storage credentials can delay cleanup; these are configured schedules, not verified deletion guarantees.

Original moderation text snapshots, report/moderation snapshots, and post-image OCR text have 90-day purge rules subject to active legal holds. Soft-deleted posts and comments are eligible for deletion after 90 days unless held. Administrator-role audits, moderation events, and legal-request records have no general automatic expiry in the reviewed migrations. These application cleanup schedules do not guarantee simultaneous erasure of service-provider logs or backups.

Ownership and permission to use User Content are described in the User Content Terms. Those terms do not replace this Privacy Policy. We process personal data contained in User Content, including its access, retention, and deletion, as described in this Policy and as required by applicable law.

User Content: Ownership and Limited Service License

Version: 1.2 · Publication date (Asia/Bangkok): 2026-10-12 · Effective at (UTC): 2026-10-12 11:15:00.000 UTC

Versioned copy: User Content Terms v1.2 (English text).

This section applies to content you submit through Mahalai, including posts, comments, images, and chat messages ("User Content"). Mahalai is operated by RYU WOOJIN, trading as EGO-Works, a sole proprietorship in the Republic of Korea ("we", "us"). Read this section together with our Community Guidelines and Privacy Policy.

The limited service license applies only to User Content you submit on or after the later of the stated effective date and the time you explicitly agree to these Terms. It does not cover content submitted earlier or authorize prior use.

1. Your ownership and other people's rights

You retain the copyright and other rights you hold in your User Content. Submitting it to Mahalai does not transfer ownership to us.

You must have the rights, permissions, or other lawful authority needed to submit your User Content, make it available to its intended audience, and grant the limited permission below. Your User Content must not unlawfully infringe another person's copyright, trademark, rights in their image or likeness, privacy, personal-data rights, or other rights. Obtain permission from the relevant rights holder or person when the law requires it. Giving credit alone does not necessarily authorize use of someone else's work.

2. Permission needed to provide Mahalai

For User Content submitted within the scope above, you grant us a non-exclusive, royalty-free license to store, reproduce, technically process, transmit, and display your User Content only to the extent needed to provide, maintain, secure, and moderate the Mahalai service.

We may engage service providers to carry out these operations on our behalf, only within the same purpose, access, and duration limits. They receive no independent right under this license to use your User Content for their own purposes.

This license does not authorize selling your User Content, using it in advertising or marketing, or training AI models. If we wish to use your User Content for any of those purposes, we will first obtain your separate, specific permission. It does not transfer your ownership or require you to waive your rights as an author.

3. Audience and access

We display and deliver your User Content according to the audience and access rules of the feature you use, including any user-selectable access settings, if available. Posts and comments are available only to users permitted to access the relevant feature. Chat messages are delivered to the participants permitted to access the relevant conversation. This license does not authorize us to make restricted posts or chats public.

Access by personnel and service providers is limited to what is necessary for service operation, support, security, moderation, or compliance with applicable law, as described in our Privacy Policy. The license does not replace the requirements of applicable privacy law or provide blanket consent to process personal data.

4. Reporting rights concerns and requesting review

If you believe content on Mahalai infringes your rights, or you are authorized to act for the affected person or rights holder, contact [email protected]. You may also use the Report action on a post or comment, or long-press a chat message and choose “Report this message.” If there is no specific copyright or privacy category, select “Other” and describe the concern. Identify the content or its location, explain the rights concern, and provide a way for us to contact you. Include relevant supporting information, but do not send unnecessary identity documents or other sensitive information.

We review reports and may ask for information needed to assess them. We may restrict access to or remove content while reviewing a report, and take appropriate action under the Community Guidelines and applicable law. Where appropriate and legally permitted, we tell the affected user what action was taken and why. We may suspend or terminate accounts for serious or repeated violations, subject to the applicable Terms and review process.

If you believe a decision was mistaken, contact [email protected] or use Profile → Settings → Request. Identify the content or decision and explain your reasons, with any relevant evidence. For eligible post or comment moderation decisions, the “Ask for another look” control opens an in-app review request. Its availability depends on the decision and any earlier review request. Chat decisions do not have that same in-app appeal control; use the contact routes above. A review request does not guarantee restoration. Applicable statutory notice and counter-notice procedures remain available and will be handled in accordance with the law; this general review process does not replace them.

5. Deletion, account closure, and the end of the license

Deleting content and closing your account have different effects.

Posts and comments: deleting your own post or comment hides it from ordinary service access. The text becomes eligible for scheduled cleanup 90 days after the post or comment is marked deleted, except where a legal hold applies. Associated photos are not necessarily purged on that same schedule: a photo remains stored while it has a post reference. Once no post reference remains, the photo becomes eligible for the daily cleanup when its file creation time is more than one day old. This one-day threshold runs from file creation, not from when the post reference is removed. Eligibility does not guarantee that the cleanup job will run or that deletion will complete; a failed or skipped run can delay cleanup. A request for complete deletion of posts and comments also covers their associated photos and thumbnails, as explained below.

Chat messages: “delete for me” hides a message only from your view. It does not remove the message from other participants' view and does not start the 90-day cleanup described here. The sender can use “delete for everyone” within 24 hours of sending. That action hides the message body and photo from the conversation and schedules content cleanup after 90 days. Closing a group also schedules its message-content cleanup after 90 days. Message identifiers may remain.

Account closure: deleting your account does not by itself delete the bodies of your posts and comments, their photos, or your chat history. The account's author identifier is reassigned. Identifying details in the content itself may remain. Retained content remains accessible only under the relevant feature's existing audience and access rules. Account closure does not authorize any new use.

Requests for complete deletion: during account deletion, you may select “Request complete deletion of my posts and comments.” This request covers your posts, comments, their photos, and thumbnails. Once we have verified your deletion request and your authority over the content, we remove the requested content from ordinary service access and complete its deletion, subject to the limited retention described below. Submitting a request is not confirmation that deletion is already complete. This option does not include chat messages or delete chat history from all participants' accounts.

For help with a deletion request or content you cannot manage yourself, contact [email protected]. While you can still access your account, you may also use Profile → Settings → Request. Contact the email address for a request concerning chat content; the post-and-comment deletion option does not apply to chats. We may ask for information reasonably needed to identify the content and verify the request. Do not send unnecessary identity documents or sensitive information.

End of the license: while your content remains available on Mahalai, including after account closure, the license continues only for the limited service purposes and permitted audience described in these terms. You may request removal through the routes above. When content is removed from ordinary service access following your deletion action or a verified deletion request, or is otherwise permanently removed, the ordinary service license for that content ends. “Delete for me” alone does not end the limited license needed for other conversation participants' permitted access. We do not retain an indefinite right to display removed content because it was previously submitted or because your account was closed.

Restricted retention after removal: any permission that remains after the removal described in the preceding paragraph is limited to handling restricted copies strictly as needed to complete technical deletion, retain backup copies, if any, until they are deleted under the applicable backup-retention cycle, or comply with a legal obligation or legally justified preservation requirement. It does not authorize ordinary service display, marketing, AI-model training, or any other new use. Copies kept solely for a legal preservation requirement are deleted when that requirement ends, unless another lawful requirement applies. Permission for each residual copy ends when it is deleted. Retaining a restricted copy does not extend the ordinary service license.

Copies kept independently by other users outside our service, such as screenshots already saved to their devices, may remain beyond our control. That does not give us an additional license or cancel anyone's obligations under applicable law. The Privacy Policy describes the applicable personal-data retention and deletion rules.

6. Versions and changes

We identify the version and effective date of these terms and provide notice of material changes through the service. If a change materially expands the rights we request in User Content, we will explain the change and obtain your agreement before relying on the expanded permission. Merely publishing an updated page does not itself grant us new rights in previously submitted content.

Version 1.2 · Published date (Asia/Bangkok): 2026-10-12 · Effective at (UTC): 2026-10-12 11:15:00.000 UTC.

Versioned copy: Community Guidelines v1.2 (English text).

Mahalai Community Guidelines (v1.2)

Mahalai is a community for university students in Thailand who have completed university verification. Please follow the rules below so that everyone can talk with peace of mind. 1. Respect the monarchy - You may not post text, comments, or images that insult, mock, threaten, or defame members of the royal family (including former kings and members of the royal family) or royal symbols (such as portraits). This also includes images in which portraits have been composited or defaced. - This follows Thai law (Section 112 of the Criminal Code and the Computer Crime Act). - Political debates related to the monarchy may be subject to moderator review. - You may freely post respectful content, such as graduation photos and anniversary greetings. 2. No violence or threats - Content expressing an intention to harm a specific person or group will be held from publication and may be deleted. 3. Do not target specific individuals - You may not attack or insult a person who can be identified by their real name, student ID number, photo, or similar information. 4. Protect personal information - You may not post another person's phone number or identification number. - Such numbers are automatically masked. - You may post your own contact information (for example, for second-hand transactions) at your own responsibility. 5. Sexual content - Explicit sexual descriptions and solicitation of prostitution are prohibited. 6. No illegal advertising - Advertisements for gambling sites, illegal loans, and similar services will be held from publication and deleted. 7. Ask for help when things feel difficult - Help information will be shown on posts that raise concerns about self-harm or suicide. - Thai mental health counseling hotline: 1323 (24 hours, free) 8. Political boards - Mahalai does not operate boards dedicated to politics. Please focus on campus life and academic topics. 9. Reporting - University-verified users may report each post once. - When three different people report a post, it is automatically hidden and reviewed by the moderators. - Repeatedly reporting the same matter or reporting in retaliation will be recorded as report abuse. 10. How moderation works and actions - Mahalai uses both an automated moderation system and moderator review. - Posts suspected of violating the rules may be visible only to their author until review is complete. - If violations for which the moderators have confirmed deletion accumulate during the most recent 90 days, the following actions apply: · 1 violation: warning · 2 violations: posting and commenting restricted for 7 days · 3 violations: use of the service suspended for 30 days - If you disagree with a deletion, you may appeal once per post; the second decision is final. - If a relevant authority makes a request under applicable law, the post may be made private and Mahalai may cooperate with the request. - Deleted posts are permanently deleted after 90 days. This does not apply when legal proceedings are ongoing. 11. Revisions to the guidelines - If the guidelines change, we will notify you in the app and ask you to consent again. Your content and other people's rights This limited service license applies only to User Content you submit on or after the later of this version's effective date and the time you explicitly agree to it. It does not grant permission retroactively for content submitted earlier. - You keep the copyright and other rights you hold in your posts, images, comments, and chat messages. - Only share content you have the necessary rights or lawful authority to share. Do not unlawfully use another person's work, image, or personal information. Credit alone may not be enough. - You give Mahalai the limited permission needed to store, process, transmit, and display your content to the audience allowed by the feature and any user-selectable access settings, if available. This is not permission to make restricted posts or chats public, use your content in marketing, or train AI models. - Report suspected rights violations through the Report action or [email protected]. We may restrict or remove content while reviewing a report. Serious or repeated violations may lead to account restrictions or termination under the Terms. - To ask us to review a decision, contact [email protected] or Profile → Settings → Request with the content or decision and your reasons. Applicable legal notice and counter-notice procedures remain available. - Deleting your account alone does not remove your posts, comments, photos, or chat history. The “Request complete deletion of my posts and comments” option covers posts, comments, their photos, and thumbnails. Once we have verified the request and your authority over the content, we remove and delete that content, subject to the limited retention in the User Content Terms. This option excludes chat messages. The ordinary service license ends for content removed from ordinary service access; restricted copies kept only for technical deletion, backup retention, or lawful preservation do not give us a continuing right to display it. Contact [email protected] for help, including after account closure. Read the User Content Terms and Privacy Policy for the different deletion effects and access rules. Version 1.2 | Effective 2026-10-12 11:15:00.000 UTC Related documents Community Guidelines: https://mahalai.app/?lang=en#guidelines User Content Terms: https://mahalai.app/?lang=en#user-content Privacy Policy: https://mahalai.app/?lang=en#privacy

Account and data deletion

Request in the app

Go to Profile → Settings → Delete account. The current flow asks for your password and calls the server-side account deletion function.

Request by email without installing the app

Contact [email protected] with the subject “Mahalai account and data deletion request”. Specify whether you want your account deleted, complete deletion of your posts and comments and their associated photos and thumbnails, removal of specific content containing personal information, or a combination. You may send a complete-deletion request by email if you cannot use the in-app option or have closed your account. Provide the account email address and, for a content request, a link or enough detail to locate the content. The post-and-comment complete-deletion request does not include chats. Do not send your password or enrollment documents.

The EGO-Works operating team receives these requests and verifies account ownership before processing them. For a request about specific content, include a link or other details that allow the team to locate it. You can also ask privacy questions at the same address.

What the current account deletion function does

It removes the authentication account and profile-linked information, including private profile, timetable, group memberships, bookmarks, proof-submission rows, and the student-identity duplicate-prevention claim.

Posts, comments, likes, votes, and chat messages remain with a newly generated account identifier. This does not remove personal information written in text or contained in photos, and does not prove that all retained records are anonymous. One-to-one chat rooms are removed when both former participants no longer have accounts; otherwise messages remain for other participants. Reports and appeals may remain without the deleted reporter's account reference.

Current limitation: account deletion does not automatically remove surviving content, media, or chat history. The current flow includes the optional “Request complete deletion of my posts and comments” control. Submitting that request does not confirm deletion is complete. A verified request covers the user's posts and comments, associated photos, and thumbnails; it does not include chat messages or remove chat history from all participants. The scope and restricted retention are described in the User Content Terms. If you cannot use the in-app control, contact us by email to request removal of your content. Existing content has no fixed automatic expiry through the account deletion function. Replacing an account identifier does not remove personal information from text, photos, or message history.

Child safety standards

Prohibited content and conduct

Mahalai prohibits child sexual abuse and exploitation (CSAE), including creating, requesting, uploading, distributing, or sharing child sexual abuse material (CSAM). This includes computer-generated depictions of a child engaged in sexually explicit conduct.

Grooming a child for sexual exploitation, sexually exploiting a child, sextortion or sexual blackmail involving a child, and child sex trafficking or prostitution are prohibited.

These standards apply to all content and activity in Mahalai, including posts, comments, private and group chats, and uploaded content.

Mahalai also prohibits nudity and non-newsworthy depictions of real graphic violence.

Report a concern

Use the in-app Report action on the relevant post or comment. To report another person's chat message, press and hold the message and choose Report this message.

Or go to Profile → Settings → Request. Enter a title and details, then choose Send request. Include a link or content ID, the approximate date and time with time zone, and a short description. Do not attach or re-upload image or video evidence.

You can also contact the Mahalai support team at [email protected]. Do not email image or video evidence.

Review and response

The designated child safety contact reviews reports received through in-app reporting and the support mailbox. If the operator confirms that content is CSAM, access to it is blocked and it is reported to NCMEC or the relevant local authority through the applicable reporting process.