Privacy policy, Garasi Lab

Who controls the data

The data controller is Handiyan Juansah, an individual in Indonesia. Garasi Lab is not a registered company. Questions and requests about personal data: privasi@garasilab.com.

The garasilab.com site

This site is static pages only: no accounts, forms, cookies, or analytics.
The Pause motion button stores your choice in your own browser (localStorage); it is not sent anywhere.
The site is delivered through Cloudflare, which processes IP addresses and technical browser data to serve pages and stop attacks, under Cloudflare's privacy policy. We keep no visitor logs.
Email sent to privasi@garasilab.com is forwarded by Cloudflare to the controller's Gmail (Google) inbox, where it is read and answered.
The Send an idea button opens the contact section on juansah.com. Your message is used only to reply and to weigh your idea.

RuteKita

No account. Timetables, maps, and routes work without signing up or logging in.

Data	Why	Where, how long
Phone location for near me	Shows the nearest stations and stops	Stays on your phone, never sent
What you type in place search, with a rounded approximate location	Finds addresses and places	Sent to the RuteKita search server. Briefly kept in the server's technical log without your IP address, then removed automatically on rotation
Card balance (NFC)	Shows the remaining balance	Read on your phone, never sent
Favourites and settings	Convenience	Stored on your phone

Community features

Sharing train positions and Info Lintas run only if you agree, separately for each.

Your device gets a random ID and a secret key; the server keeps only a hash of that key. Deleted automatically after 180 days of no use.
Your location when you tap I'm on this train lives only in server memory and is discarded within 3 minutes. It is never written to disk or shown to anyone; only the train's delay is shown.
Info Lintas reports are shown without names for 2 hours. The link to your device is removed after 7 days, the report after 30 days.
Your IP address is used briefly for rate limiting and is not stored.
For ages 17 and over, or with a parent's or guardian's permission.
View, delete, or withdraw consent at any time: Info Lintas → My data.

Other services the app contacts

These services see your IP address, with no other data from us:

OpenFreeMap: map images.
Expo: app update checks.
GitHub Pages: the list of public CCTV cameras.
CCTV camera owners: video is loaded directly from their servers when you open it.

Data sources: KRL timetables from KAI Commuter, Transjakarta GTFS data (with written permission), and OpenStreetMap (© OpenStreetMap contributors, ODbL). RuteKita is not an official KAI Commuter, MRT Jakarta, or Transjakarta app.

Kaskita

Kaskita is being prepared for the public. This section applies once Kaskita sign-up opens.

Kaskita is a family money record. Under the PDP Law, personal financial data is specific personal data, so we give it stricter protection.

Data we store

Category	Data	Why
Account	Phone number, name, 6-digit PIN (stored as an Argon2id hash, unreadable), time zone, currency, month start day, price region, two-step verification code if you turn it on	Create and secure your account
Money	Accounts and wallets, transactions, notes, categories, budgets, goals, debts, recurring transactions	The core of the app
Other people's data you record	Contact names (for example for debts), phone numbers of people you invite to your family	Track debts, invite family members
Device and security	Device ID and name, phone type, IP address, user agent, time and type of login events	Recognise devices, detect suspicious logins, prevent abuse
Notifications	Device notification token	Send notifications
AI assistant, if you turn it on	Questions, answers, and the data sources used	Answer questions about your records
Anonymous usage counts	Only how often a menu is opened, with no name, phone number, or money amounts	Improve the app. Can be turned off in Menu → Security

We do not collect your location, phone contacts, or files. App permissions: internet, notifications, the microphone only when you choose voice input, and the camera or gallery only when you scan a receipt.

Legal basis: our agreement with you when you create an account, to run the app; and separate consent for the AI assistant and usage counts.

Who can see your data

Each family's data is separate; other families cannot see it.
When you join a family, its members can view your financial records but cannot change them. This access ends when you leave the family.
You keep ownership of your data; joining a family does not move it.

Third parties involved

Party	What it receives	Notes
Google (Firebase Cloud Messaging)	A short notice such as “New entry from a family member”, with no money amounts	Google's servers may be outside Indonesia
Google Drive	Database backups encrypted on our server before upload. Google cannot read the contents or file names	Kept 30 days
Your phone's speech recogniser (may be Google's)	Your voice when you use voice input, turned into text	Only the resulting text is sent to the Kaskita server
Google ML Kit	Receipt photos are read on your phone; photos are not sent	Only the resulting text is sent
Anthropic (Claude AI assistant)	Only if you turn the AI assistant on: your question and the data needed to answer it, such as transactions (amount, date, note), balances, and budgets	Servers in the United States. Can be turned off at any time
Tailscale	An encrypted path between the app and the server	Data stays encrypted all the way to the server

We share data with no one else unless the law requires it.

Where data is stored and how it is protected

A database on the controller's own server in Indonesia, not exposed to the internet.
HTTPS everywhere, hashed PINs, rate-limited logins, and two-step verification available.
Daily backups on a second disk in the server (14 days) and an encrypted copy on Google Drive (30 days).

How long data is kept

Account and money data: while your account is active.
Login security records: 90 days.
AI assistant history: until you delete it, at most 90 days.
After you delete your account, your data leaves the database immediately and the backups within 30 days. One record that the account was deleted (phone number, time, IP address) is kept for 90 days for security.
Shared transfers with other family members stay in their records, without your identity.
If you own a family that still has members, ownership passes to the longest-standing member.

Age: Kaskita accounts are for people aged 18 and over.

Your rights

These apply to all Garasi Lab apps. Under the PDP Law you have the right to:

be told how your data is processed (this page);
access and get a copy of your data and its processing record, within 3 × 24 hours of us receiving your request;
correct wrong data;
delete your data and account: in Kaskita through Delete account (confirmed with your PIN), in RuteKita through Info Lintas → My data;
withdraw consent (AI assistant, usage counts, community features) at any time;
object, and complain to the personal data protection authority.

For anything you cannot do in the app, write to privasi@garasilab.com. We may ask for proof that the account is yours, so that data does not reach the wrong person.

If a data breach happens

We notify you and the personal data protection authority in writing within 3 × 24 hours of learning of it, through the app and the contact details we have, saying what data was exposed, when and how, and what we are doing about it.

Changes to this policy

Important changes are announced on this page and in the apps at least 14 days before they take effect. The version at the top of the page always changes with them.