Privacy policy

Data controller: Madelynn Imagination, run by an individual developer in Indonesia.

Data we process

• Parent account: email and Google/Apple account ID (sub), language, country.
• Child profiles: nickname, age band, avatar, reading progress. No real names, photos, voice or location.
• Purchases: product, amount, and the receipt from the store or Midtrans. We never store card numbers.
• Creator applications: the name, email, roles, portfolio link and message you send.

Legal basis

Parental consent, performance of a contract (accounts and purchases), and legal obligations (financial records), under UU PDP.

Where your data is stored

All our servers, databases, files and backups run with DigitalOcean in Singapore (region SGP1). DigitalOcean has no data centre in Indonesia, so storing data there is a transfer of personal data outside Indonesia. We rely on the safeguards UU PDP (Law 27/2022, Article 56) requires for such transfers: Singapore's level of protection under its Personal Data Protection Act 2012, a data processing agreement with DigitalOcean, and our own safeguards below. We do not move your data to any other country, except where a service you choose to use is run abroad (see the list of processors).

Who processes data for us

We never sell data and never share children's data for advertising. The reader app contains no third-party analytics or advertising tools.

How we protect data

Connections use TLS (HTTPS). Personal data such as email addresses and bank details is encrypted in the database (AES-256-GCM), and paid stories are stored encrypted. Backups are encrypted with a key that is kept offline. Staff access is limited, needs two-factor sign-in and is logged.

How long we keep data

• Account and child profiles: while the account exists; deleted when you delete the account.
• Reading activity and download licences: up to 180 days.
• Purchases and financial records: as long as tax and accounting law requires.
• Backups: 35 days, then deleted automatically.

Children

Children never create accounts, never pay and never see links that leave the app. A parent creates up to 5 child profiles with a nickname and age band only, behind a parental check, and can delete a profile at any time.

If something goes wrong

If a data breach affects you, we will tell you and the authority within 3 × 24 hours as UU PDP requires, with what happened and what you can do.

Your rights

View, correct, export and delete your data, and withdraw consent. Reach us from the Contact page.

This website

No tracking cookies, no third-party analytics and no ad pixels. Forms use a spam check that runs on your device.