This is an English translation provided for convenience. If there is any difference between this translation and the Indonesian version, the Indonesian version prevails.
In short
Who we are
ArusHarian (“we”) is a daily money-tracking app for Android and iOS, together with its supporting services on this
website. This policy applies to the ArusHarian app (id.arusharian.app), its sync service, and this
website. We process personal data in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection
(the “PDP Law”).
ArusHarian can be used in two modes. Offline mode requires no account. Online mode requires an account and stores data on our servers so it can sync across devices and be shared in shared books.
Data in offline mode
In offline mode, the app does not send your financial data to any server. All of the following is processed and stored on your own phone:
| Data | Purpose | Where it is stored |
|---|---|---|
| Wallets, categories, transactions, budgets, goals, debts & receivables, tags, shop/people names, notes, journals | Core app functions | Encrypted database (SQLCipher) on the phone; the encryption key is in Keystore (Android) or Keychain (iOS) |
| Receipt photos (optional) | Transaction attachments | The app's folder on the phone, automatically downsized |
| App lock PIN | Locking the app | Only its hash, in Keystore/Keychain; the PIN itself is never stored |
| Settings (theme, language, reminder time) | Convenience | Locally on the phone |
Data only leaves your phone when you choose to do so: creating a backup file (locked with a password only you know), exporting CSV, or sharing a file through an app of your choice.
Data in online mode
When you create an account and turn on sync, we process the following data:
| Type of data | Details |
|---|---|
| Account data | Name, email address, password (stored as a bcrypt hash, never in plain text), email verification status, and temporary OTP codes for verification or password reset. |
| Financial data you sync | Books, wallets, categories, transactions and their details, journals, budgets, goals, debts & receivables, tags, shops/people, and the notes you write. |
| Shared books | The list of book members and their roles (owner, editor, viewer), and the email addresses of people you invite. |
| Devices & sessions | A device ID generated by the app, platform (Android/iOS), device name, last sync time, session tokens (stored as hashes), and the IP address and browser/app information at sign-in. |
| Subscription | Plan, status, validity period, and proof of purchase (transaction token) from Google Play or the App Store. We never receive your card number or payment details; payment is handled entirely by the app store. |
| Security logs | Records of activity such as sign-in, sign-out, data changes, and access by our team, including IP addresses; records of emails we send you (e.g. OTP codes, invitations). |
Receipt photos currently remain on your phone and are not uploaded to our servers. If a cloud attachment feature is launched, this policy will be updated first.
How we use your data
- To provide the service you asked for: storing, syncing, and displaying your financial records on your devices and in shared books.
- To manage your account: email verification, sign-in, password reset, and managing connected devices.
- To verify subscriptions directly with Google or Apple, so premium status cannot be faked.
- For security: preventing unauthorized access, limiting sign-in attempts, and investigating incidents.
- To send service messages such as OTP codes, shared-book invitations, and important notices about your account or subscription.
- To meet legal obligations that apply in Indonesia.
The legal bases for processing are your consent, performance of the service agreement (Terms of Service), legal obligations, and our legitimate interest in keeping the service secure, as provided in the PDP Law.
What we never do
- We do not sell, rent, or trade your data to anyone.
- We do not show ads or use your data to target ads.
- We do not include third-party analytics SDKs or trackers in the app.
- We do not use your financial data for credit scoring, lending, or offering financial products.
- We do not read SMS messages, contacts, or notifications from other apps on your phone.
Third parties involved
To run online mode, we use service providers that process data on our behalf and only for that purpose:
- Server and storage providers where our database and service files run.
- Email service providers to send OTP codes and invitations.
- Google Play and the Apple App Store for subscription payments and purchase verification. Data you give them is subject to their own privacy policies.
Members of a shared book can view (and, depending on their role, edit) the data in that book. We may also disclose data when required by law or by an order from a competent authority.
How we protect your data
- The database on your phone is encrypted (SQLCipher) with a key stored in the device's Keystore/Keychain.
- The app can be locked with a PIN, fingerprint, or face. Biometric data is managed by the operating system and never reaches the app.
- Communication with our servers uses encrypted connections (HTTPS).
- Passwords and session tokens are stored as hashes; sessions can be revoked per device.
- Every request is checked on the server: you can only read and change books you belong to, according to your role.
- Our team's access to your financial data is only for support or legal obligations, is read-only, requires a stated reason, and is logged. Our team cannot change your transactions.
No system is completely immune. If a personal data protection failure occurs, we will notify you and the relevant authorities as required by the PDP Law.
How long data is kept
- While your account is active, account data and the financial data you sync are kept so the service works.
- If your subscription stops, server data is not deleted; the cloud becomes read-only after the grace period. Data on your phone remains fully usable.
- If you delete your account, it is closed immediately and all server data is permanently deleted within 30 days. Security logs may be kept longer for auditing, but are no longer linked to your identity.
- Sync logs are discarded after 90 days.
- System backup copies may still contain data until those copies are replaced in the regular backup cycle.
Your rights
Under the PDP Law, you have the right to:
- Be informed about how your data is processed (this page).
- Access and obtain a copy of your data, including through the CSV export and backup features in the app.
- Correct inaccurate data, directly in the app.
- Delete your data and account.
- Withdraw consent and stop processing, for example by no longer using online mode.
- Object to or file a complaint about the processing of your data.
To exercise these rights, use the features in the app or contact us at arusharian@firmansyahdiar.my.id. We will respond within the time limits set by applicable regulations.
Deleting your account & data
From the app: open Settings → Account & sync → Delete account, then confirm with your password. Your account is closed immediately, all sessions on other devices are revoked, and all account data on our servers (including books you own and their contents) is permanently deleted within 30 days.
Without the app: email arusharian@firmansyahdiar.my.id from your account's email address with the subject “Delete account”. We will verify that the request comes from you before processing it.
Data on your phone is not removed by deleting your server account; remove it by clearing the app's data or uninstalling the app. Backup or CSV files you created are wherever you saved them and need to be deleted by you.
Device permissions
- Camera & gallery — to take or pick receipt photos, only when you choose to.
- Notifications — daily entry reminders, due dates, and budget alerts, scheduled on your phone.
- Biometrics — to unlock the app with your fingerprint or face.
- Internet — used only in online mode for sync, accounts, and subscriptions.
All permissions are optional and can be revoked at any time in your phone's settings.
Children
ArusHarian is intended for users aged 18 and over. We do not knowingly collect data from children. If you become aware that a child's data is stored in our service, please contact us so it can be deleted.
Changes to this policy
We may update this policy, for example when launching new features. The effective date above will be updated, and for significant changes we will notify you in the app or by email before the change takes effect.
Contact us
Questions, requests, or complaints about personal data can be sent to arusharian@firmansyahdiar.my.id.
See also the ArusHarian Terms of Service.