Perpustaka
DATA PROTECTION

Privacy Policy

We respect your privacy and are committed to protecting the personal data you share with us while using Perpustaka.

Last Updated: November 2026

1. Introduction & Scope

This Privacy Policy describes how Perpustaka ("we", "our", or "us") collects, stores, protects, and handles your personal information when you access our digital library, register an account, read digital content, or purchase VIP subscriptions.

2. Information We Collect

We only collect information necessary to provide, secure, and improve our services:

  • Account Registration Data: When you sign up, we collect your full name, preferred nickname, date of birth, gender, email address, phone number, and chosen username.
  • Authentication Credentials: Your password is cryptographically transformed using secure, one-way bcrypt hashing before being saved. We never store, transmit, or have access to plaintext passwords.
  • Subscription & Transaction Metadata: When you subscribe to a VIP membership, we record the order ID, selected plan, transaction amount, duration, payment status, and timestamp.
  • Device & Session Logs: To enforce our anti-account sharing policy, our system logs your device category (Desktop vs. Mobile) and client IP address. We also record security-relevant events such as login attempts and audit logs to prevent brute-force attacks.

3. How We Use Your Information

Your personal data is strictly utilized for the following purposes:

  • To authenticate and maintain your active reading sessions across authorized devices.
  • To verify and activate your paid VIP membership privileges and calculate stacking subscription durations.
  • To enforce device concurrency limits (maximum 1 Desktop and 1 Smartphone per account).
  • To prevent unauthorized file hotlinking, scraping, and brute-force intrusion via in-memory rate limiting.
  • To provide customer support and notify you regarding critical account or service updates.

4. Payment Processing & Third-Party Security

PCI-DSS Compliant Payment Gateway:

All electronic payments on our Platform are handled through our authorized payment partner, Midtrans. When you transact via QRIS, Virtual Account, or Credit Card, your financial data is transmitted directly to Midtrans via encrypted SSL/TLS channels. We do not store, process, or view your credit card numbers, CVVs, or bank login credentials on our servers.

5. Cookies & Session Tokens

We employ minimal, privacy-centric cookies strictly required for platform operation:

  • HTTP-Only Authentication Cookies: When you log in, an encrypted session token is stored in an HTTP-only cookie (`user_session` or `admin_session`). HTTP-only cookies cannot be read or manipulated by client-side JavaScript, protecting you from cross-site scripting (XSS) token theft.
  • No Third-Party Advertising Trackers: We do not sell your personal data, nor do we deploy invasive third-party cross-site advertising cookies, tracking pixels, or data broker beacons.

6. Anti-Account Sharing & Session Management

To maintain fair content licensing for authors and publishers, our system checks device user-agent headers to classify sessions into Desktop/PC or Smartphone/Mobile. If a new session is initiated on a device category that is already active, the preceding session of the same category is automatically terminated. This mechanism ensures your credentials cannot be exploited simultaneously by unauthorized parties.

7. Data Retention & User Rights (Right to be Forgotten)

You maintain full control over your personal data:

  • Right to Access & Update: You may review and update your name, nickname, email, phone number, gender, and password at any time via the "Edit Profile" modal.
  • Self-Service Account Deletion: You have the absolute right to terminate your account and erase your personal records at any time. Clicking "Delete Account" in your profile dashboard (after confirming your password) permanently removes your account, personal data, and active sessions from our database in accordance with the Right to be Forgotten.

8. Protection of Minors

Our digital library provides educational and general literature. Minors under the age of 13 should access and subscribe to the Platform under the guidance and consent of a parent or legal guardian.

9. Policy Updates

We may update this Privacy Policy from time to time to reflect technological enhancements, operational changes, or legal requirements. Updated versions will be posted on this page with an updated revision date.

10. Contact Information

If you have inquiries regarding this Privacy Policy, your personal data, or data processing practices, please reach out to our privacy officer at support@library.local or visit our Contact Page.