Privacy

Short version: you are not the product. There is no analytics script and no advertising pixel, and no card number ever reaches this site — payment happens on Midtrans's SNAP page. What we hold is what an order needs: your email, the WhatsApp number you gave us for support, your orders, and one row per enrolled device.

What we store

• Enrolled devices — the device id, the account id it is linked to, first and last seen, the client version and an enrolment count. No IP address is retained; an activation or enrolment may record a salted hash of one, never the address itself.
• Accounts and orders — the email you signed up with and a password hash (PBKDF2, salted, never the password), a session row keyed by the hash of a random cookie value, and one row per order: plan, period, amount and the payment reference. That order row is your receipt, and it is the reason the account exists.
• Your WhatsApp number — asked for at signup and used for one thing: the invitation to the support group. It is not sold, not shared, and not put on a mailing list. It is stored in one normalized form (+62…) on your account row, and it is what we delete first if you ask us to close your account.
• Which terms you accepted — the version of the terms in force when you signed up, and the moment you ticked the box. Nothing else about the signup form is kept.
• Your licence key, briefly — while it is waiting to be collected it is stored encrypted under a wrapping key that lives only in this deployment's environment, and the row is destroyed the moment you reveal the key on its order page. Nothing holds it after that.
• Licences — the licence id, its plan, its features, its term, and the device it is bound to. A licence key is stored only as a SHA-256 hash, so we cannot read yours back to you.
• Events — one audit row per enrolment, activation, revocation and pack fetch. Ids, types and statuses; never a body and never a credential.

What we never store

• Your Stockbit or Carina credentials. They pass through the relay and are never read, buffered or logged by it.
• Request or response bodies of any kind, in either Worker.
• Payment details. Checkout sends you to Midtrans's SNAP page, so no card number ever reaches this site — there is no payment form here to fill in and nothing of ours to intercept. Midtrans tells us only that a payment settled, for which amount and under which reference.

The operator console

The console at /console sets one HttpOnly, SameSite=Strict cookie, signed with the deployment's own admin credential. It carries an expiry and nothing else: no identifier, no email, no session row to leak. Signing out — or rotating the admin credential — invalidates it.

Deleting your device row stops your token working. Ask and we will do it.