Privacy Policy

Part A — All kafein.id services

1. One account for every service

A kafein.id account is a single login shared by all the Services: sign up once, on any of them, and the same account signs you in everywhere. Each Service only stores its own data (such as a link page or a shop order) once you start using it.

2. Account data we collect

• Email and password sign-up: your name, email address, and password. The password is stored only as a salted hash by our authentication provider — we never see it.
• Sign in with Google: if you choose “Continue with Google”, Google shares your name, email address, profile picture URL, and Google account ID with us, using only the basic openid, email, and profile permissions. We do not request access to your Gmail, Google Drive, Contacts, Calendar, or any other Google service, and we never receive your Google password.

3. Google user data

If you sign in with Google, the name, email address, and profile picture we receive are used only to create and identify your kafein.id account, pre-fill your name, and sign you in to the Services. We store them with your account record at our authentication provider (Supabase). We do not share Google user data with anyone except the service providers listed in section 6 that are needed to run the Services, and we do not transfer or use it for advertising, resale, or credit-worthiness purposes.

kafein.id’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect kafein.id from your Google account at any time at myaccount.google.com/connections. To also delete the data we already hold, see section 8.

4. How we use data

• To create and secure your account and sign you in.
• To provide each Service you use, as described in Part B.
• To send service email — sign-up confirmation, order and invoice emails, and messages about your account or important changes.
• To prevent abuse, investigate reports, and enforce our Terms.

We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models.

5. Stored in your browser

We use your browser’s local and session storage to keep you signed in and to remember things you’d be annoyed to lose on reload (a cart, saved items, an unfinished form). We do not use advertising or cross-site tracking cookies.

6. Who we share data with

We share data only with the providers that run the Services for us:

• Supabase — database and authentication for all Services.
• Cloudflare — website hosting and image storage (media.kafein.id).
• Google — only if you choose to sign in with Google.
• Resend — delivery of invoice emails and Circle invitations on link.kafein.id.
• Paddle — payment processing and merchant of record for the kafein.id shop.

We may also disclose data if required by law, or to protect the rights, safety, or property of our users or the public. Our providers may process data outside Indonesia; we rely on their contractual and security safeguards when they do.

7. How long we keep it

We keep account data for as long as your account exists, and each Service’s data as described in Part B. When an account is deleted, its data across all Services is deleted with it — including the images and files uploaded to it — except records we must keep by law (such as tax records of purchases). Backups roll off within our providers’ standard backup windows.

8. Your rights and choices

Under Indonesia’s Personal Data Protection Law (UU No. 27 of 2022) and similar laws elsewhere, you can ask to access, correct, export, or delete your personal data, or withdraw consent. Much of your data can be edited directly in each Service. To delete your account entirely, or for any other request, email team@kafein.id from the address on your account. We’ll respond within 14 days.

9. Security

Data is encrypted in transit (HTTPS). Access to each user’s private data is enforced at the database level so only that user can read it, and uploads go through a server-side check rather than giving browsers storage credentials. Only the operator of kafein.id can access account data, and only for support, orders, and abuse handling. No system is perfectly secure; if we learn of a breach affecting your data we’ll notify you as required by law.

10. Children

The Services are not directed at children under 13, and we don’t knowingly collect their data. Users under 18 need a parent or guardian’s permission to create an account. If you believe a child has given us personal data, contact us and we’ll delete it.

11. Changes

We may update this policy as the Services change — including when a new service joins the kafein.id account. We’ll change the effective date above, and for material changes we’ll notify account holders by email or in the Service before they take effect.

12. Contact

kafein.id — team@kafein.id

Part B — Service-specific details

B1. link.kafein.id

link.kafein.id lets account holders (“owners”) publish a page at link.kafein.id/<username>, run preorder forms, or both — some owners use only the preorder forms.

Owners’ page content

Everything an owner adds — username, display name, bio, avatar and cover images, links, social profiles, headings, shop items, prices, preorder forms and their photos, invoice settings (including a payment image such as a QRIS code), and theme choices. Unpublished edits are saved as a draft on our servers until the owner publishes them. Most of this is public by design: it is shown to anyone who visits the page while it’s published. Kept until the owner removes it or deletes their account.

Visitors to a page

To give owners traffic charts, we record each page view and link click with only: which page, link, or form it was; the time; the referring website’s domain (e.g. “instagram.com”); and whether the device is mobile or desktop. We do not store visitors’ IP addresses, full user-agent strings, or any identifier that follows a visitor across pages or sites. Owners’ visits to their own page aren’t counted. Kept for as long as the page exists.

If an owner adds a YouTube, Spotify, or Apple Music link, their page may show that provider’s embedded player; those providers’ own privacy policies apply to what the player collects.

Buyers who submit a preorder

The details the owner’s form asks for — typically name and email, and optionally phone number, shipping address, answers to custom questions, and uploaded images (for example, a screenshot as proof of payment) — along with the items and quantities ordered and the order’s status. Uploaded images are stored at an unlisted address that isn’t shown on any public page, but anyone who has that exact address can open the image.

If the owner sends an invoice, it is emailed to the buyer through Resend. The invoice shows the owner’s payment image, and replies go to the owner’s account email address.

Circles: people helping run an event

An owner can invite other people by email to help run one preorder event (a “Circle”). We store each invitee’s email address and send the invitation through Resend, even if they don’t have an account yet. Once they accept, Circle members can see and manage that event’s orders, including buyers’ details, under their own login. Removing someone from the Circle ends their access.

The owner is responsible for their buyers’ data. The owner decides what to collect, who in their Circle can see it, and what to do with it (fulfilling the order, contacting the buyer, exporting it as a spreadsheet, and so on); we store and process it on the owner’s behalf to run the Service. Owners must collect only what they need, use it only for the order, keep it and any exports secure, and handle buyers’ requests to access or delete it. Buyers with questions about an order should contact the owner first; we’ll help where we can, and owners can ask us to delete a specific order.

Orders, and the images uploaded with them, are kept until the owner’s account is deleted or the owner asks us to delete them. Deleting a preorder form does not delete its orders: they stay in the owner’s order history under the form’s name.

B2. kafein.id shop

The kafein.id shop at kafein.id/shop is where kafein.id sells its own physical goods. It is separate from link.kafein.id: preorders taken on a link.kafein.id page are the page owner’s sales (see B1), not kafein.id shop orders.

• Your account area: shipping addresses you save to your address book, and your order history.
• Orders: the items, prices, and shipping address for each order, linked to your account, so we can fulfil and support it.
• Payment: checkout is handled by Paddle, our merchant of record, which collects your payment details and billing address and handles tax and invoicing. We never receive your full card details. Paddle’s own privacy policy applies to the data it collects.
• In your browser: your cart, saved items, and recently viewed products are kept in local storage on your device, not on our servers.

Saved addresses are kept until you delete them or your account. Order records are kept as long as needed for fulfilment, support, and our legal and tax obligations.