Privacy Policy
Version 1.1. Effective from 5 November 2026.
This policy explains what personal data we process, why, and what your rights are, in line with Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP). It is a translation of the Indonesian original; if the two differ, the Indonesian version prevails.
1. Our main principle
Lokashaka is designed so that your most personal data never leaves your device. Your chats, character memories, reminders and the things you tell a character are not sent to our server. We only process the data needed for your account, licenses and payments.
2. Data controller
The personal data controller is Lokashaka Studio, based in Indonesia. Privacy questions and data requests, including for our data protection contact, go to halo@lokashaka.id with the subject "Privacy".
3. Data we collect
| Data | Examples | When it is collected |
|---|---|---|
| Account data | Email address, password (stored as a hash we cannot read), email verification status, sign-up date | When you sign up |
| Age and consent statements | The 13+ checkbox, the 18+ or parent/guardian approval statement, the terms version you accepted, date and time | When you sign up, buy or redeem a code |
| Purchase data | Order number, character bought, price, payment status, transaction ID from the payment provider | At checkout |
| License data | Characters you own, their source (purchase, redeem code, admin) and date | When a license is granted |
| Trial data | A hashed identifier calculated from your computer's hardware (the original serial numbers never leave your computer and cannot be recovered from the hash), the character you are trying, and the trial start date | When you start a character's free trial in the app, even without an account |
| Device data | A hashed device ID (not the real serial number), device name, operating system, app version, last active time | When you sign in from the app or an extension |
| Security data | IP address, sign-in times, failed sign-in attempts, code redemption attempts | When you use the website, app or extensions |
| Correspondence | The content of emails you send us, such as refund requests | When you contact us |
4. Data we do not collect
- Chats with characters, character memories, reminders, birthdays you mention and closeness levels: all of these are stored in the app folder on your device.
- The content of web pages you open while the browser extension is active, or the code you write while the VS Code extension is active.
- Card numbers or payment account details: these are processed directly by the payment provider.
- Advertising tracking data. We do not use third-party ad trackers or analytics.
5. Purposes and legal bases
| Purpose | Legal basis (UU PDP) |
|---|---|
| Creating and managing accounts, granting and checking licenses, enforcing the 3-device limit | Performance of a contract (the Terms of Service) |
| Processing payments and refunds, keeping transaction records | Performance of a contract and legal obligation |
| Recording acceptance of terms, age statements and parental consent | Legal obligation (including Government Regulation 17/2025) and consent |
| Preventing fraud, piracy and attacks on accounts | Legitimate interest |
| Limiting each character's free trial to 3 days per computer | Legitimate interest and performance of a contract |
| Sending important emails: verification, password reset, changes to terms, security notices | Performance of a contract |
| Sending news about new characters or promotions | Consent, only if you opt in; you can stop at any time |
6. Children's data
6.1. The Service is not for children under 13. If we learn that we hold data of a child under 13, we delete the account and its data.
6.2. Data of users aged 13 to 17 is only processed with the consent of a parent or guardian. Parents and guardians can request access to, correction of, or deletion of their child's data at halo@lokashaka.id.
7. Who receives data
We do not sell your personal data. Data is shared only with the following parties, and only as much as needed:
| Recipient | Data received | Purpose |
|---|---|---|
| Website hosting provider (Rumahweb, servers in Indonesia) | All data in section 3 | Running the website and database |
| Cloudflare (R2) | IP address and download time when you download an AI brain | Storing and delivering AI brain files |
| Payment provider (once active) | Email, order number, amount | Processing payments and refunds |
| Email provider | Email address and the content of service emails | Sending verification emails and notices |
| Law enforcement or government agencies | Data lawfully requested | Complying with legal orders |
Some providers (such as Cloudflare) may process data outside Indonesia. We only use providers that apply data protection equal to or higher than UU PDP.
8. How long we keep data
- Account, license and device data: while your account is active.
- Order and payment data: up to 10 years, to meet bookkeeping and tax obligations.
- Security data (IP addresses, sign-in logs): 90 days.
- Trial data: up to 2 years after the trial started.
- After an account is closed, its data is deleted within 30 days, except data the law requires us to keep.
9. Data security
9.1. We use HTTPS for all connections, store passwords as hashes, restrict database access and limit sign-in attempts.
9.2. If a personal data protection failure occurs, we will notify you and the competent authority within 3 x 24 hours of becoming aware of it, as required by UU PDP.
10. Your rights
Under UU PDP, you have the right to:
- get information about who we are, why we process data and how your data is used;
- access and get a copy of your personal data (available through the "Download my data" button on the My account page);
- correct data that is wrong or incomplete;
- ask for your data to be deleted and your account closed;
- withdraw consent you have given, for example to stop receiving promotions;
- object to or restrict certain processing;
- object to decisions made solely by automated processing (we do not make such decisions about you).
Send requests to halo@lokashaka.id from your account email. We respond within 3 x 24 hours and complete requests as quickly as possible within the time limits of UU PDP. If you are not satisfied, you can complain to the competent personal data protection authority.
11. Cookies
The website only uses cookies needed to keep you signed in and keep forms secure (a session cookie and CSRF protection). There are no advertising or third-party analytics cookies. If we ever add other cookies, we will ask for your consent first.
12. Data on your device
Chat data and character memories are stored in the Lokashaka app folder on your device. You can delete them at any time with the "Erase memories" button in the app, or by choosing to remove your data when you uninstall the app on Windows. On Linux, delete the folder ~/.local/share/Lokashaka. Because this data is not on our server, we cannot recover it if it is lost.
13. Changes to this policy
If this policy changes, we will notify you by email and on the website at least 14 days before the change takes effect. Previous versions remain available to read.
14. Contact
Lokashaka Studio, Indonesia, halo@lokashaka.id (subject: Privacy).