Privacy Policy

1. Who we are

The controller of your personal data is [OPERATOR / LEGAL ENTITY NAME], [ADDRESS]. Privacy questions: [PRIVACY CONTACT EMAIL].

2. Data we keep

• Account: name, email address, password (stored only as an argon2id hash that cannot be read back), time zone, language, base currency, and your weekly summary choice.
• Security: your authenticator secret (encrypted), hashed recovery codes, and a list of signed-in devices: IP address, browser type and last-used time.
• Google (only if you choose Sign in with Google): your Google account ID and its email.
• Your finance records: account and category names, transactions (date, amount, currency, description, note), budgets, and the change history of transactions (before and after copies so you can undo).
• Import files: every cell of an uploaded CSV or XLSX is kept temporarily for review and rollback. The original file is not stored.
• Technical logs: request ID, user ID, route, status and duration. We do not log request bodies, amounts, descriptions, emails, tokens or passwords.
• Cookies: three session cookies, see section 9.

3. What we use it for

• Running the service: signing in, storing and calculating your finances, converting currencies.
• Security: preventing account abuse, limiting login attempts, and emailing you when your data is exported or your account changes.
• Service emails: email verification, password reset and security notices.
• A weekly email summary with your spending and income totals. You can turn it off in Settings or with the unsubscribe link in each email. [Legal basis and whether explicit consent is needed: to be confirmed with counsel.]
• We do not sell your data, show ads, or currently use third-party analytics.

4. Who receives data

We use these providers to run Dompet Oyen:

• DigitalOcean: application hosting, managed database and backup storage, in a Singapore data center.
• [EMAIL PROVIDER, not chosen yet]: sends service emails. It receives the recipient address and message content.
• Google: only if you sign in with Google.
• Frankfurter (reference rates): we send only public currency codes, no personal data.
• We may disclose data when the law requires it.

5. Data stored outside Indonesia

Our servers are in Singapore, so your data is transferred outside Indonesia. [Extra duties under the Indonesian Personal Data Protection Law and the transfer basis: to be confirmed with counsel.]

6. How long we keep it

• While your account is active, your records are kept until you delete them.
• If you delete your account, every row tied to you is permanently removed by our system, usually within minutes and at most 24 hours.
• The change history (audit log) is deleted together with your account. We do not delete inactive accounts automatically.
• Database backups are made every day and kept for at most 30 days, then expire. If a backup is restored, account deletions are replayed before the service reopens, so deleted accounts do not come back.
• The deletion record holds only a random ID with no name or email, and is kept as long as backups that might contain it exist.
• Sign-in sessions last 7 days. One-time tokens (verification, password reset) expire in 5 minutes to 24 hours. Idempotency keys are removed after 48 hours. Uncommitted import uploads are removed after 7 days.

7. Security

• Connections use HTTPS. The database is encrypted at rest by the hosting provider.
• Each user can read only their own rows; this is enforced in the database, not just in the app.
• Passwords are hashed with argon2id. Two-step verification is available. Sensitive actions (export, delete account, change password) ask you to confirm again.
• Your finance records are not encrypted inside the app because we need to sum them in the database. Our team's access to production data is restricted and logged.
• No system is perfectly secure. If personal data is breached, we will tell you and the authorities as the rules require: [notification deadline: to be confirmed].

8. Your rights

You have the right to access, correct, export and delete your data, and to withdraw consent. Most of it you can do yourself:

• Access and portability: Settings > Data > download JSON, CSV or XLSX. JSON is the complete, restorable copy.
• Correction: edit accounts, categories and transactions in the app; edit your profile in Settings.
• Deletion: Settings > Delete account.
• Withdrawing consent or objecting to processing: turn off the weekly summary in Settings, or contact us.
• Other requests or complaints: [PRIVACY CONTACT EMAIL]. We reply within 2 working days and complete your request within 7 days.

9. Cookies

• access_token and refresh_token (HttpOnly): keep you signed in.
• csrf_token: protects against forged requests.
• locale: remembers your language.
• No advertising or tracking cookies. The app can be installed as a PWA; our service worker does not store your financial data.

10. Age

Dompet Oyen is meant for people aged 13 and over. Anyone under 18 uses it with the consent of a parent or guardian. [How we make sure of parental consent: to be confirmed with counsel.]

11. Changes

If this policy changes in a meaningful way we will tell you by email or in the app before it takes effect, and update the date above.