Privacy Policy
Last updated: November 5, 2026
This policy explains what TRASON collects when you use it, why, who else handles it, how long it is kept, and what you can ask us to do with it. TRASON is operated from Klaten, Central Java, Indonesia, and this policy is written with Indonesia's Personal Data Protection Law (Law No. 27 of 2022) in mind.
1. What we collect
- Account details: your email address, name, an optional profile photo, and a password, which is stored only as a one-way hash by our sign-in provider.
- Settings: language, currency, timezone, theme, which modules are on, and your notification choices.
- What you record: transactions, budgets, subscriptions, instalments, investment positions, schedule entries, tasks, reminders, workouts, job applications, interview notes, and saved insights.
- Images you upload: receipt photos and payout statements you scan, and your profile photo.
- Notification details: for each device where you turn on notifications, the address your browser gives us for delivering them, and a record of which reminders were sent so none is sent twice.
- Technical data: IP address, browser type and request times in our hosting providers' logs, and anonymous page load timings.
We do not collect your location, contacts, or bank credentials, and TRASON does not connect to your bank.
2. Why we use it
- To run your account and show your records on every device you sign in on.
- To send the reminders, notifications and email digest you turned on.
- To calculate scores such as Life Score and streaks. These use fixed rules, not AI.
- To produce AI drafts and summaries, but only when you use a feature that asks for one.
- To keep the service secure, for example by stopping automated sign-up attempts.
The legal basis is the agreement you enter when you create an account, and your consent for optional features such as notifications and AI drafts. You can withdraw consent at any time by turning the feature off.
We do not sell your data, use it for advertising, or share it with anyone except the services listed below.
3. AI features
Smart Input, receipt scanning, driver payout import and the summary on the Insights page send what you submit to Google's Gemini API, which returns a draft. You review and correct the draft before anything is saved, and totals are checked by our own code, not by the AI. TRASON uses the Gemini API without paid billing. Under Google's terms for that tier, Google may keep what you submit, use it to improve its products, and have people review it. Do not use these features for anything you would not want handled that way: enter it by hand instead. Every AI feature is optional, and nothing is sent to Google until you use one.
4. Who processes your data
These services handle data on our behalf, each only for the purpose shown. Some of them store or process data outside Indonesia.
| Service | Used for | What it receives |
|---|---|---|
| Supabase | Database, sign-in and file storage | Everything in your account, including uploaded images |
| Vercel | Hosting and performance measurement (Speed Insights) | Requests to the site, IP address, page load timings |
| Google (Gemini API) | Drafts from Smart Input, receipt and payout scans, and weekly summaries | Only the text or image you submit to that feature, plus the records a summary is written from. Google may use it to improve its products |
| Cloudflare | Bot check on sign-in pages, and a check that your email domain exists | Browser signals for the bot check; the domain part of your email at sign-up |
| Resend | Email digest and account emails | Your email address and the content of the email |
| Your browser’s push service (Google, Mozilla or Apple) | Delivering notifications | A device address and the encrypted notification |
| CoinGecko, Alpha Vantage, Yahoo Finance | Investment prices | Ticker symbols only, never amounts or your identity |
| open.er-api.com | Exchange rates | The currency codes requested |
| Clearbit, wger, dayoffapi | Company name suggestions, exercise library, public holidays | What you type in the company field, exercise searches, country and year |
5. How long we keep it
Your records are kept while your account exists. Items you delete inside the app are marked as deleted and no longer shown. When you delete your account, your account and the records tied to it are removed; hosting logs held by our providers expire on those providers' own schedules.
6. Security
All traffic uses HTTPS. Every record is tied to your account, and the database itself rejects requests for records that belong to someone else. Passwords are never stored in readable form. Access to the production systems is limited to the people who run TRASON. No system is perfectly secure; if we learn of a breach that affects your data, we will tell you by email.
7. Your rights
- See and correct your data at any time in the app, or ask us for a copy by email.
- Delete your account in Settings, under Security, or ask us to do it.
- Withdraw consent by turning off notifications, the email digest, or the AI features you use.
- Object or complain by writing to us; you may also contact Indonesia's data protection authority.
We answer requests as soon as we can, and always within the time the law requires.
8. Children
TRASON is not meant for children. If you are under 18, use it only with permission from a parent or guardian.
9. Cookies and local storage
We use only what is needed to keep you signed in and remember your settings, and no advertising or tracking cookies. The full list is in the Cookie Policy.
10. Changes
When this policy changes, the date at the top changes too. If a change affects how your data is used, we will tell you in the app or by email before it takes effect.