Privacy policy

Effective 6 November 2026.

This policy explains how personal data is handled in Natracker, the tracker application developed and operated by PT Nusantara Adidaya Teknologi ("we", "us"), including its public website at www.natracker.com and the single sign-on service at sso.natracker.com that Natracker uses for authentication.

1. Who we are

Natracker is a product of PT Nusantara Adidaya Teknologi (natindonesia.com), a company registered in Indonesia, which develops and operates it. We are the controller of the account data described below. Contact: [email protected].

2. Data we collect

Account data — name, email address, username, group and role assignments, and the Natracker features you are entitled to use.
Authentication data — a record of sign-in attempts, timestamps, source IP address, user agent, and the authenticators you enrolled (password, passkey or security key, time-based codes).
Federated identity data — if you choose to sign in with Google or Apple, the provider sends us your name, email address, profile picture URL (Google only), a provider-specific account identifier, and whether the email address is verified. For Apple, if you choose "Hide My Email", the address we receive is an Apple private relay address.

We do not receive your Google or Apple password, and we do not receive access to your mail, calendar, drive, contacts or any other content in those accounts.

3. Why we use it

To authenticate you and keep your session secure.
To decide which applications and data you may access.
To operate, secure and audit our systems (fraud and abuse prevention).
To provide support when you ask for it.

We do not use this data for advertising, profiling, or automated decisions that produce legal effects, and we do not sell it.

4. Google user data

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the openid, email and profile scopes, use that data solely to authenticate you and link your Google account to your existing account with us, and do not transfer it to third parties except as required by law or as necessary to provide the service.

5. Sharing

We share account data only with:

the applications you are authorised to use (to establish your session);
service providers that host and protect our infrastructure, under contracts that limit their use of the data to providing that service;
authorities, where we are legally required to do so.

6. Retention

Account data is kept while your account is active. Authentication logs are kept for up to 12 months for security and audit purposes. When an account is closed, identifying data is deleted or anonymised, except where a longer retention period is required by law or by a contract with your organisation.

7. Security

Traffic is encrypted in transit. Credentials are stored as hashes, access is limited to staff who need it, administrative actions are logged, and our production configuration is managed as code and reviewed before it is deployed.

8. Your choices and rights

You can revoke our access to your Google or Apple account at any time in that provider's security settings.
You can ask us for a copy of your account data, ask us to correct it, or ask us to delete it.
If your account is managed by your employer, we may need to refer your request to them.

Send requests to [email protected]. We answer within 30 days. If you are in Indonesia, you may also contact the Ministry of Communication and Digital Affairs regarding the protection of personal data.

9. Cookies

This website sets no analytics or advertising cookies. Our sign-in service sets strictly necessary session cookies so that it can complete the login flow and remember that you are signed in.

10. Changes

If this policy changes, the new version is published on this page with a new effective date. Material changes are announced to account holders by email.