Draft storage and upload receipts
Local drafts contain captions, sound choices, media copies and status. Other accounts’ drafts are not shown; copies remain on the device after logout until removed or app data is cleared. GARAZI does not sync drafts across devices; operating system backups follow device settings. After confirmed publication, queue-owned media copies are cleaned up; you can remove the local result record. The server keeps request ID, account, destination, payload hash, status and times to prevent repeat publication; this journal does not separately store captions or media contents and is deleted with the account. Transferred files may remain in Storage after failed publication; cancellation attempts to remove files that are not referenced by content. Failed cleanup is marked for retry.
Music Library and journey images
At your choice, the app extracts the full video audio track and prepares videos with sound on your device. Separate audio, title, duration, source account/post references, reuse permission, private saved-sound references and reports are stored in Supabase. Audio is private and read through time-limited signed access; discovery and new reuse follow source-post access and permission status. Revocation prevents new retrieval/reuse after server checks, but cannot guarantee recall of downloaded files or audio in published videos. Saving a sound to an account stores a reference, not ownership or an unrestricted licence. Temporary device files support preview/processing and are cleaned when practical after use or during cache cleanup; exact-time deletion is not promised. Journey-image exports use data you review; saving to Photos/Gallery requests add access where required without reading the whole gallery through this saving feature. Images shared to other services follow those services’ settings and policies.
Scope and contact
PT Tiga Jago Labs operates GARAZI and is the personal data controller for processing whose purposes and means GARAZI determines. Operator address: Jl. Terusan No. 16 Cimahi Tengah, Kota Cimahi 40525. The application is developed by Hendriyana Nugraha. This policy covers the GARAZI features you use, not every practice of external services. Direct privacy questions, data-rights requests or incident reports to the operator channel listed in the app: WhatsApp +62 896 1111 9090. Provide only necessary account details; do not send passwords, OTPs, PINs or full identity documents without a clear verification need.
Accounts and authentication
Account data includes email, user ID, name, username, profile image/bio and information you provide. Email/password authentication uses Supabase Auth. Google/Apple may provide identity, email or relay email and profile information you permit; GARAZI does not request their passwords. Session tokens enable account access. Sign-in security records may include account identity and technical information needed to detect misuse.
Social content and communication
Posts, images/video, comments/replies, reposts, reactions, Stories, messages, attachments, follows, blocks, reports and timestamps are processed to provide those features. Recipients may keep copies. A Story no longer shown as active is not necessarily immediately removed from archives or storage. DM uses backend storage; do not assume end-to-end encryption.
Vehicles and personal records
Garage may contain vehicle type/model, images, plates, tax/registration dates, service, modifications, costs, journeys and attachments you enter. Share only necessary information and check each feature's visibility. Do not upload documents exposing unnecessary addresses, identity numbers, accounts or other information; redact other people's information before upload.
Precise location, background use and routes
When relevant permissions and features are enabled, GARAZI processes coordinates, timestamps, movement and trails for Touring, Free Riding, navigation, group positions and distance statistics. Tracking may operate in the background or with the screen off while the session/feature is active, subject to permissions and settings. Authorized participants can see shared positions. Stop the session/sharing and revoke OS permissions to stop future use; existing history is not automatically deleted.
Place search and Maps
Place search, nearby communities, maps and routing may send queries, coordinates, origin/destination and technical information to Google Maps/Places/Routes and related backends. Avoid unnecessary sensitive addresses. Information received by external services is also governed by their policies and your device settings.
Microphone, Voice and audio sharing
With microphone permission or system audio-sharing authorization, voice/audio is transmitted for Voice/Ride Radio through communications infrastructure such as LiveKit. Session IDs, participants, network addresses and connection metadata may be needed. Connected participants can hear the audio; microphone permission is not consent to record or redistribute others' voices. This policy does not promise end-to-end encryption or prevent participant recording.
Communities, administrators and transactions
Community features process membership, roles, applications, events/attendance, albums, orders, dues, ledgers and payment evidence according to use. Authorized administrators and transaction parties may access relevant information. Financial information and receipts may be sensitive; minimize and redact unnecessary details. Community operators/sellers may bear separate responsibilities for data they control.
Community emergency help
When you confirm Send in community SOS, GARAZI stores the problem category, GPS/manual pin or landmark, timestamps, note and selected photo. Active incident data is available to authorized community members subject to membership and blocking. The requester can still view and close their own incident after leaving the community. Helper names, timestamps, states and updates form the event history; an unable-to-help response is visible only to the requester and responder. Coordinates, accuracy, fix timestamp and landmark on the incident record are cleared when the requester closes it. Notes, private photos and recipient copies follow the retention section; text or images may contain locations you enter yourself. The app removes EXIF/GPS metadata from images uploaded through this form. An uncertain write may keep an account-scoped local request; expiry is checked on access and nothing is resent automatically. Push contains generic notices without coordinates/photos. Opening navigation sends the destination to Google Maps. This feature uses an explicitly confirmed location and does not enable continuous location tracking.
Notifications, devices and diagnostics
Device/push tokens, platform and technical information support notifications. Notification previews may appear on the lock screen; change OS previews on shared devices. Firebase Crashlytics in release builds may process crash/device diagnostics. The reviewed GARAZI integration sends generic error codes and stacks rather than deliberately attaching chat text, coordinates, email or tokens; SDKs and servers may still process standard technical metadata.
Purposes and legal bases
Necessary data supports account creation/security, requested features, relevant notices, reports and legal obligations. The applicable basis depends on the activity: contract performance, consent for particular processing, legal obligations or legitimate interests assessed against your rights. This is not blanket consent for every purpose. Incompatible new uses require notice and an appropriate lawful basis.
Permissions, preferences and visibility
Camera/media, microphone, location and notifications have their own OS and feature controls. Refusing a permission may restrict that feature without automatically closing the account. Private accounts, blocking, visitor-history preferences, rankings and trip sharing operate according to their respective features. Others can view public content; access controls cannot recall screenshots or copies already made by recipients.
Providers and limited disclosure
Visible integrations include Supabase for authentication/database/storage, Firebase for push/diagnostics, Google for sign-in/maps, Apple for sign-in and LiveKit for communication. Backend infrastructure/email providers may process information within their assigned services. Disclosure is limited to service purposes, incident/dispute handling or lawful requests. Sponsorship does not give sponsors rights to your DM contents or live location.
Cross-border processing
As checked on 4 November 2026, GARAZI’s primary Supabase database project is in the Singapore region (ap-southeast-1). Other providers, backups, support, delivery networks and related services may process information in other countries according to their configurations and contracts; the database region does not guarantee that all data stays only in Singapore or Indonesia. Cross-border transfers must meet applicable legal requirements, including adequate protection or binding safeguards, and consent when required. Ask the operator about relevant processing locations and safeguards.
Retention, caches and deletion
Data is retained for necessary features, security, obligations or applicable legal reasons, and must be deleted/destroyed when its retention basis ends. Archives/history differ from active content. Local caches, backups, recipient copies and other parties' transaction records may have different handling cycles. Account deletion does not mean all such copies disappear simultaneously; continued retention must be limited to lawful purposes and periods. Ask the operator for category-specific retention details and deletion status.
Your rights and requests
Subject to applicable law and lawful exceptions, you may request information and access/copies, correction, ending/restricting processing, consent withdrawal, deletion/destruction and portability where applicable, and raise objections, complaints or remedies. Use in-app controls or contact the operator. Identity is checked proportionately without passwords/OTPs. Requests must be handled within applicable legal deadlines and lawful restrictions/refusals explained.
Account deletion and permission withdrawal
Account Settings provides deletion with confirmation. Uninstalling, signing out or revoking permissions does not automatically erase backend data. Verify with your current GARAZI password or sign in again with the linked Google/Apple account. Apple accounts require Apple verification so the service can revoke the Apple authorization. Deletion still requires separate confirmation. If you cannot access that email or complete the process, contact the operator for verification and assistance. Deletion is not confirmed until the server acknowledges it. Legally required records and third-party copies follow the retention section rather than an unconditional erasure promise.
Security and incidents
GARAZI uses authentication and access controls in relevant features; absolute security cannot be guaranteed. Protect your device and report suspected unauthorized access through official contacts. Data-protection failures require response and notice to required parties within legal deadlines, including the PDP Law's 3 x 24 hour requirement where applicable, with relevant incident and recovery information.
Children, external services and changes
Social accounts are not intended for children under 16. Information about children aged 16–17 requires special safeguards and valid parent/guardian consent, without overriding legal or feature-risk restrictions. This policy does not claim automated age verification or guardian-consent systems are already available; report child use so the operator can restrict processing and handle it lawfully. WhatsApp, browsers and external links have their own policies. Policy version/date appear in the app; material changes and new processing bases require notice as required by law.
Running activity and fitness data
When you use running mode, GARAZI processes your account/session, activity title/destination/plans, distance or pace targets you enter, GPS points, accuracy, speed, times, routes and distance/duration/pace statistics for records and group features you choose. Data and routes are sent to the Supabase backend; fitness data and location traces may reveal habits and sensitive places. Authorized participants or recipients of shared results may see information according to the feature. Stop the session/sharing and manage location permission to stop future collection; stored history follows retention and account deletion. GPS statistics are not a diagnosis, medical service or measurement-accuracy guarantee.
Moderation, evidence and restricted access
To review reports, copyright and safety, authorized moderators may process relevant content/attachments, account/content IDs, reporter and reported accounts, reasons, times, media revisions and decision notes. Queued social media, identity images and audio may be held from other accounts during review. DM evidence and private attachments must be accessed only within authority and handling needs; reporting does not make that evidence public. Blocking sends necessary information to moderators and hides content from the blocking user. Legal requests or defending claims may require limited preservation of evidence with a lawful basis and retention period; this does not authorize indefinite retention of all data.
Ranking and social visibility
Profile/name, follow relationships and shared interactions support social features. When an account appears in the public Top Rider ranking, related profile information and total distance may be visible to other users. Review public-ranking controls under Privacy & Connections; disabling them limits subsequent display according to the feature rather than recalling screenshots or copies already made. A private account or OS permission setting does not automatically replace every community, trip or ranking-sharing choice.
Website privacy
Public pages do not require sign-in or use advertising trackers, analytics scripts or non-essential cookies. The restricted admin page uses GARAZI account authentication through Supabase. The hosting provider may process technical access logs such as IP addresses, requested URLs, browser information and access times for delivery and security. External contact links open WhatsApp only when you choose them. Admin credentials are sent to Supabase Auth over HTTPS when an administrator signs in. Contact the operator for hosting log retention details.