Privacy Policy

Koinaku is a financial education platform operated by Koinaku for users primarily in Indonesia. Contact us at hello@koinaku.com.

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have.

Anyone who visits or uses the Service. The Service is for people 16 and older. If you are under 18, a parent or guardian must consent to your use. We do not knowingly collect personal data from children under 16; if we learn we have, we will delete it.

• Account data: email address, password (stored only as a cryptographic hash by our auth provider), username, display name, avatar.
• Profile data: age range, financial goals (up to 3), preferred language.
• Learning data: assessment answers and scores, lesson attempts, progress, quiz answers, recommendations shown.
• Gamification data: XP events, levels, streaks, badges, Koin Points.
• Simulated trading data: virtual portfolio, holdings, trades, watchlist, risk profile.
• Social data: friend connections, invite codes, cohort memberships, leaderboard rankings.
• Settings: notification preferences, streak reminder time, weekly report opt-in, leaderboard visibility.
• Usage and analytics events: in-app events, event properties, session identifiers, timestamps.
• Communications: support requests, feedback, content flags.
• Technical data: IP address, device and browser type, approximate region derived from IP (collected transiently by hosting providers).

What we do not collect: real-money payment or bank details, government ID numbers, precise location, phone contacts, or data from real brokerage accounts.

• Directly from you: signup, onboarding, settings, support emails.
• Automatically: gameplay, learning and analytics events as you use the Service.
• Not from third parties: we do not buy data or receive data from data brokers.

• To create and manage your account and authenticate you.
• To deliver lessons, quizzes, streaks, XP, badges and Koin Points.
• To operate the paper-trading sandbox and graduation.
• To personalise your learning path and recommendations.
• To run leaderboards, friends and cohorts.
• To send streak reminders, weekly reports and service emails.
• To understand and improve the Service.
• To keep the Service secure and prevent abuse.
• To meet legal obligations and enforce our Terms.

Automated decision-making: your risk profile and lesson recommendations are generated automatically from your activity, but they only affect which educational content you see.

We use only strictly necessary cookies, including secure session cookies that keep you signed in. We do not use advertising cookies, cross-site trackers or third-party analytics cookies.

We share personal data only with the service providers that run the Service:

• Supabase — database, authentication, file storage (Japan/Singapore).
• Netlify — web hosting and content delivery (United States and CDN edge locations).
• Google Workspace — transactional email from hello@koinaku.com (United States).
• Fontshare (CDN) — delivery of brand fonts (CDN edge locations).

We also disclose data if the law requires it, to protect rights and safety, or as part of a merger or asset sale with notice to you. We do not sell your personal data.

We operate from Australia and our providers process data in the locations listed above. For Indonesian users, cross-border transfers are made in line with UU PDP requirements. For EU/UK users, we rely on adequacy decisions where available and otherwise on Standard Contractual Clauses.

• Account and learning data: kept while your account is active.
• Analytics events: up to 24 months, then deleted or aggregated.
• Email and support records: up to 24 months after the conversation closes.
• Logs and security records: up to 12 months.
• Backups: deleted data may persist in encrypted backups for up to 30 days.

When you delete your account, we delete or de-identify your personal data within 30 days, except what we must keep by law.

• Encryption in transit (HTTPS everywhere) and at rest (provider-managed).
• Row Level Security on all user tables.
• Passwords handled by Supabase Auth and stored only as cryptographic hashes.
• Input validation and least-privilege access; secrets never committed to code.

If a data breach occurs that is likely to harm you, we will notify you and the relevant regulator within the timeframes required by law.

Everyone can exercise these rights by emailing hello@koinaku.com from their account email:

• Access, correct or delete your personal data.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Receive your data in a structured, machine-readable format.

Indonesian users have additional rights under UU PDP. Australian users may request access and correction under the Privacy Act. EU/UK users have GDPR rights. California users have CCPA/CPRA rights. We will not discriminate against you for exercising your rights.

The Service is for people 16 and older. Users aged 16–17 may use the Service only with a parent or guardian's consent. If you believe a child under 16 has created an account, email us and we will delete the account and its data.

Lessons cite external sources, and graduation may list OJK-registered brokerages. We are not responsible for the privacy practices of third-party sites.

We will post changes here with a new “last updated” date. For material changes, we will notify you by email or prominent in-app notice at least 14 days before they take effect.

Data controller: Koinaku
Privacy contact: hello@koinaku.com