What we keep, what we never keep.

Enough to make the app work — nothing decorative. The list below is exhaustive at the time this page was last updated:

• Account: your name, email, password (stored as a one-way bcrypt hash — never as plain text), email-verified timestamp, account status (pending / approved / blocked), and role.
• Onboarding profile: the answers you gave in the welcome wizard — panggilan, age range, region, role, audience, focus topics, language preference. Used to tailor briefs to your context.
• Briefs you generate: topic, segment, tone, locale, the retrieved daleel, and the AI-generated content. These belong to you.
• Anonymous page-view rows: which path you visited (locale-stripped, e.g. `/briefings/x`, never with query strings), referer, user-agent string, locale, an httpOnly session cookie ID, and your user_id if signed in. Used for analytics; never sold, never enriched.
• Cost / usage events: which paid API call was made, how much it cost, when. No user content goes into this table.
• If you sign in with Google: the Google-issued account ID, profile name, and avatar URL. We store no Google access tokens beyond what NextAuth needs to keep your session valid.

Calling these out explicitly because the usual web defaults capture them, and we don't:

• Your IP address. We never log it, never store it in a database column, never pass it to a third party.
• Fingerprints (canvas, WebGL, font lists, audio context — any of the techniques used to identify you across sites). No third-party JavaScript SDK runs on Dakwah-Lens.
• Precise location — no GPS. What we keep: the broad region you self-declared in onboarding, plus a coarse region code (e.g. province) derived from your IP solely for anonymous visitor analytics — the IP itself is never stored.
• Anything you write in a brief draft and don't save. Drafts that aren't submitted never reach our database.

Both are first-party. There are no third-party cookies. There is no marketing cookie consent banner because there is nothing to consent to beyond these:

That's it. No Google Analytics. No Meta pixel. No Hotjar. No advertising cookies.

To do its job, the app sends specific data to a small set of services. What each one sees is listed plainly:

• OpenAI — The topic text of a brief, sent for embedding (so we can find relevant Qur'anic verses). No user account info goes with it.
• Google Gemini — Social-media post text (for the relevance classifier) and brief topics + retrieved daleel (for synthesis). The automated weekly briefings include no account info. When you (signed-in) generate your own brief, your profile — preferred title, region, audience, da'wah focus — is also sent so the draft can be tailored.
• Anthropic Claude — Brief topics + retrieved daleel, only when Gemini is unavailable (fallback). When you generate your own brief, your profile is sent the same way it is to Gemini.
• Resend — Your email address + the verification/reset email content. Sent only when you sign up or request a password reset.
• Google (OAuth) — Only if you choose Google sign-in. Google handles authentication; we receive your email + name + avatar back.
• Apify — Hashtag and keyword queries we run to fetch public posts. Never any of your personal data.
• YouTube Data API — Search queries we run to fetch public da'wah-related videos. Never any of your personal data.

Every provider above is bound by their own privacy policy. We never send them your account-level identity unless their service requires it (Resend, Google OAuth). Cost-tracking metadata for each call lives in our usage_events table; none of it includes your data, only the API call shape.

All databases (Postgres + Qdrant + Redis) are hosted inside Indonesia. Specifically, at IDCloudHost VPS facilities in Jakarta. This is a deliberate choice per UU PDP No. 27/2022 §17 — Indonesian personal data should stay in Indonesia unless there is a specific cross-border arrangement.

The third-party services in the previous section process data on their own infrastructure (which is typically outside Indonesia — OpenAI, Anthropic, Gemini, Resend are mostly US-based). They receive the minimum needed to do their job, never your account identity unless required, and never your full database row.

Per UU PDP No. 27/2022 §6, you have specific rights over your own data, and we honor every one of them without arguing:

• Access — see everything we have on you in human-readable form.
• Correction — fix anything wrong. You can edit most of it yourself; for what you can't, email us.
• Deletion — wipe your account and every row tied to it, full stop. We will keep aggregated analytics rows that have already been de-identified.
• Portability — export your briefs, your onboarding profile, your usage history in JSON. Just ask.
• Restriction — temporarily disable processing while we sort out a dispute, without losing the data.

To exercise any of these, reach us via the contact information on the about page. We aim to respond within 7 working days.

Default retention by data type:

• Account + profile + briefs: until you delete them, or until you ask us to delete the whole account.
• Page-view rows: 18 months, then truncated. You can ask us to scrub yours sooner.
• Email verification + password-reset tokens: deleted on use, or after 24 hours / 1 hour respectively (whichever comes first).
• Cost / usage events: kept indefinitely for budgeting and audit, but contains no personal data — only API metadata.