This document is still waiting on legal review before wide publication. Its contents have been matched against the software that actually runs, not against a product plan. If you find a statement here that does not match what you experience, that is our mistake; tell us at halo@jeejak.id.

Jeejak records shipping evidence for marketplace sellers in Indonesia. The service is the JejakPaket mobile app and the web console at paket.jeejak.id.

How much data leaves your device depends entirely on how you use the service.

How you use it	What leaves the device
Free, no account	Nothing. Resi numbers, photos and videos stay on your device.
Free, with an account	Account identity and usage counts. Photos, videos and resi numbers are not sent.
Pro Lite / Pro / Pro Team / Enterprise	Evidence records, order data, and the photo and video files themselves, synced to our server. That is the point of the paid plans.
Paid, with the evidence quality check on	On top of the above: up to four packing photos per parcel go to Google Cloud to be checked, outside Indonesia. Only if your organisation asks for it. See section 1.6.

We do not sell your data, we run no third-party analytics SDK, and we show no ads.

1. What we collect

1.1 Without an account

Nothing. The app sends nothing to our servers. The whole evidence workflow can be used without ever creating an account.

1.2 If you create an account

An account is optional on the Free plan and required on the paid plans. What we receive:

Account identity: display name, plus email and/or WhatsApp number, depending on how you sign in (WhatsApp number, Google account, Apple ID, or email and password). If you sign in with Apple, we also keep the account identifier Apple gives us and the token we need to revoke that access when your account is deleted. An email from Apple may be a private relay address if you chose to hide yours.
Device data: model, platform, operating system version, app version, and an installation identifier. Used for the device list, so you can sign out a lost device, and for the per-plan device limit.
Usage counts: for example, how much of this month's quota you have used. It carries noresi numbers, recipient names, addresses, photos or videos. That limit is enforced on the server: a usage report containing data like that is rejected rather than quietly filtered.

1.3 If you subscribe to a paid plan

Cloud sync is the main feature of the paid plans. What is synced:

Evidence records: resi number, courier, status, time, note, session, and number of koli.
Order data: order number, marketplace, recipient name, phone number, address, product summary, and total value.
Evidence photo and video files, uploaded to our object storage.
Subscription data: active plan, payment status, and remaining quota.

On Pro Team and Enterprise, team members you invite can see evidence data inside your organisation according to the role you give them: Owner, Admin, or Operator.

1.4 If you connect a marketplace shop

In the web console you can connect a Shopee or TikTok Shop account. If you do, we pull order data from that marketplace on your behalf, including buyer names, phone numbers and delivery addresses.

That is your buyers' personal data, not yours. You act as the data controller for it and are responsible for your obligations towards those buyers; we process it for you. Connecting a shop is optional and you can disconnect at any time.

1.5 Payments

Payments are processed by Xendit. If the Xendit configuration is unavailable, the system may fall back toMidtrans; that choice is made by the system, not by you. Card numbers and payment credentials are handled directly by them, and we never receive or store them. We receive only the transaction status and a payment identifier.

1.6 Evidence quality check (optional, paid plans)

The evidence quality check tells you whether your packing photos are likely to hold up in a dispute: whether a photo is too dark or blurred, whether the resi label is visible and matches the order, whether the goods are visible, and whether the parcel is sealed. This feature is off unless your organisation asks us to turn it on, and it applies only to evidence recordedafter that request. To turn it on or off, contacthalo@jeejak.id.

When it is on, for each parcel we send to Google Cloud Vertex AI:

Up to four packing photos, scaled down on our server (longest side 1024 pixels) before they are sent.
The number of koli and the courier name.

What is not sent: videos, courier handover photos, proof-of-receipt photos, resi numbers from your records, recipient names and addresses from your order data, operator names, device data, and shop names.

What you need to know: if the resi label is visible in a photo, that label usually carries thebuyer's name, phone number and address. That data goes with the image and we cannot separate it out. The model reads the resi number printed on the label and our server then compares it with the order; the model is never told which resi number it should expect.

Where it is processed. Photos are processed by Google outside Indonesia, in [KONFIRMASI: Amerika Serikat / Uni Eropa / lokasi global tanpa jaminan wilayah, sesuai endpoint yang dipilih]. Google Cloud does not yet offer this model in the Jakarta region.

What is kept. We keep no copy of the scaled-down photos anywhere. What we do keep is the per-parcel observations (for example "label visible: yes"), the resi number read off the label, the result of the check (strong evidence, needs a look, or weak evidence) with its reasons, and a count of model usage. [KONFIRMASI: ketentuan retensi dan pemakaian data untuk pelatihan model dari Google Vertex AI untuk model dan wilayah yang dipilih.]

The result is advice only. It does not change an order's status, it does not hold back sync, and it does not go into the evidence PDF. The text you read is our own fixed wording, not the model's.

2. Data kept on your device

On every plan:

The evidence database in the app's private area: resi, courier, status, notes, sessions, and order data.
Photo and video files in the app's private directory. By default they do not go into the device's public gallery.
XLSX or PDF files you import are not copied or kept; only the values that were recognised go into the database.

If you sign in, the session token and a copy of your account identity are kept in the operating system's secure storage, Keychain on iOS and KeyStore on Android, rather than in an ordinary preferences file.

Delete All Data in Settings removes all three: the database, the media files, and the account material in secure storage.

3. Permissions the app asks for

The Android app we ship asks for four permissions, no more:

Camera: to scan resi barcodes and take evidence photos or videos. This is the only one that will put a prompt on your screen.
Internet: only for accounts and paid sync.
Network state: to know whether you are online or offline, so sync waits instead of failing.
Keep the screen awake: used while an upload is running, so it is not cut off halfway.

The app does not ask for storage permission. Evidence photos and videos are written to the app's private area, which needs no permission and cannot be read by other apps. The app also does not ask for notification, location, contacts, microphone or other sensor permissions. We do not track where you are and we do not see your browsing outside the app.

4. Who your data reaches

We do not sell your data and we do not share it for advertising. Your data reaches someone else only in these cases:

When you share it yourself. When you tap Share PDF or Share to WhatsApp, the file is created on your device and the operating system opens the share sheet. You choose where it goes, and from then on the receiving app decides what happens to the file.
Payment providers: Xendit, with Midtrans as a fallback, only when you pay.
Google: only if you choose to sign in with a Google account.
Apple: only if you choose Sign in with Apple on an iPhone.
Marketplaces: Shopee or TikTok Shop, only if you connect a shop, and only to pull your orders.
Google Cloud (Vertex AI), as a processor acting for us, only if your organisation turns on the evidence quality check: up to four packing photos per parcel, processed outside Indonesia. See section 1.6.
Meta: if sign-in codes over WhatsApp are enabled, your number and the content of that code message pass through their service. That path is currently switched off.
Infrastructure providers running our servers and object storage, as processors acting for us.

We may disclose data where the applicable law requires it.

5. No third-party trackers

There is no analytics SDK and no tracker inside the app: no Crashlytics, no Sentry, no Mixpanel, no Facebook SDK, nothing of that kind. This is a design decision, not a setting that can change quietly.

The only third-party components are Google Sign-In and Sign in with Apple (both optional), the Xendit or Midtrans payment page when you buy, and the barcode scanning and PDF reading libraries, which run entirely on your device.

6. Security

Traffic to our servers uses HTTPS.
Data on the device sits in the app's private area, protected by the operating system sandbox.
Session tokens are kept in the operating system's secure storage, not in an ordinary preferences file.
Android automatic backup is turned off, so evidence and account material are not copied into your Google account backup.
Every piece of business data on the server is tied to your organisation and cannot be read across organisations.

What we do not claim. Synced photos and videos sit in our object storage without an additional cipher layer whose key you hold yourself. Exported PDF files carry no cryptographic safeguard either. If we ever add one, this page will be updated first.

On a rooted or jailbroken device, the operating system's guarantees do not hold. No system is free of risk; if an incident happens that requires notification, we will tell the users affected.

7. How long data is kept

On the device: until you remove it with Delete All Data, or uninstall the app.
On the server: while your account is active.
Evidence quality check results: for as long as the evidence record they belong to exists, and they are deleted with it. Turning the feature off stops the checking and hides the results.
After account deletion: you can delete your account yourself from the app, under Akun → Hapus akun & semua data. If you own the account it is deactivated immediately on every device, including team members' devices, and then permanently deleted30 days later. Once that deadline passes, your records, photos and videos are removed from our servers automatically. The delay exists so an accidental deletion can still be undone: signing back in does not cancel it, so contacthalo@jeejak.id before the deadline. If you are a team member, only your own account is deleted immediately; shop data stays with the account owner. Data on the device you used to delete from is removed at the same moment. If you signed in with Apple, we also revoke Jeejak's access to your Apple ID.

Cancelling a subscription does not delete your data; use account deletion if that is what you want.

8. Your rights

Access and correction: evidence data can be viewed and changed directly in the app and in the console; account data is on the Akun page.
Deletion: Delete All Data for the copy on the device, Hapus akun & semua data on the Akun page for the copy on the server.
Portability: the evidence PDF export is available at any time.
Withdrawing consent: you can sign out at any time and go back to using the app locally.

For anything you cannot do yourself in the app, contacthalo@jeejak.id.

9. Children

Jeejak is meant for sellers and businesses, not for children under 13. We do not knowingly collect children's data.

10. Changes to this policy

If this policy changes, the effective date and version number above are updated. For changes that widen what we collect, we will tell you inside the app before the change takes effect.

11. Contact

Email: halo@jeejak.id
Data controller: CV. Adisatya IT Consultant, Kediri, Indonesia, aitc.co.id