Privacy Policy

This text describes how the service works today. The owner reviews it with a lawyer before launch, and this notice is removed once that is done.

This page explains what personal data the store collects, why, and how to have it removed. It covers this website and the account area.

What we collect

• Account details. Your email address and the name you enter at sign-up. Your password is stored only as an Argon2id hash; the plain password is never stored or logged.
• Order and payment records. The products you buy, the amount in rupiah, the order number, and the payment status. Card and bank details are handled by Midtrans and never reach this server.
• Session data. A refresh token per signed-in device (stored hashed), the user agent and IP address that created it, so a session can be revoked if it is stolen.
• Security logs. Sign-in attempts, one-time code sends, and admin actions, with the IP address and user agent, so abuse can be investigated.

Why we collect it

• To create and secure your account and to deliver the files you buy.
• To process payment through Midtrans and to send receipts and codes.
• To prevent fraud and abuse, and to meet accounting obligations.

Who we share it with

• Midtrans processes payments. They receive the order amount and your email, and they handle your payment details directly.
• The email provider sends one-time codes, receipts and password-reset messages.
• The hosting and storage providers run the servers and store the files. Product files are stored in a private bucket and are reachable only through a short-lived link issued to a signed-in buyer.

We do not sell your personal data.

How long we keep it

Account and order data are kept while the account exists and afterwards as long as accounting rules require. One-time codes are single-use and expire in ten minutes. Refresh tokens expire after thirty days or when a session is revoked.

Your choices

• Access and export. Your orders, licences and downloads are visible in your account.
• Deletion. You can ask for your account and its personal data to be deleted. Order records that must be kept for accounting are retained, with the personal data reduced to what the law requires.
• Cookies. The store sets session cookies that are needed to sign in and keep a cart. They are not used for advertising.

Contact

To make a privacy request, use the contact page. We answer within the period the applicable data-protection law allows.