Data we collect

• Guest gifters: a display name (optional), an email or phone number (at least one, for payment receipts and status updates), and the message you write to the creator.
• Signed-in gifters: we use your account's email, so you don't enter contact details again.
• Creators: account data (via Google, Discord, or email), public profile, wishlist, shipping address with recipient name, your legal name (self-declared; used only to check that a withdrawal bank account is yours, and shown back only partly masked), and a bank account for withdrawals.
• The status and amount of your payment transactions.
• Technical data: error logs and anonymised usage statistics, so we can fix problems and improve the service.

Who holds your payment data

jjajan NEVER stores your card number, e-wallet details, or bank account details as a payer. That data is processed and stored directly by our third-party payment providers in their own systems — we only receive the status and amount of the transaction, never the payment details themselves.

Who can see what

• Gifters never see a creator's address.
• Creators never see a gifter's email, phone number, or payment details. If you choose to send anonymously, creators don't see your display name either.
• If you don't choose anonymous, your display name can be shown publicly: on the creator's page, in widgets and alerts while they stream, and in their wishlist panels (for example on Twitch). A creator can also choose to show a list of their top gifters, and decides for themselves whether the amount of your gifts or how many you sent is shown next to your name. Not choosing anonymous means you agree to your name being shown this way. Choose anonymous if you don't want your name shown anywhere.
• The store we buy the gift from and its courier receive the creator's shipping address and recipient name, because they deliver the parcel. The sender on the parcel is jjajan, not the gifter.
• The jjajan team accesses personal data only as needed to operate the service, such as resolving a delivery problem or a payment dispute.

Third parties that process data

We use these providers to run jjajan: third-party payment providers (payments), Supabase (sign-in), Google Cloud (servers and storage, Singapore region), Resend (email), Sentry (error tracking), PostHog (usage statistics), Google Maps (address lookup), and third-party AI services (such as Anthropic, OpenAI, and Together AI running DeepSeek models), which may be given a wishlist item's title, description and link to check it against our prohibited-items list. Gifters' personal data is never sent to them. They process data only as needed for the service they provide.

We do not sell your personal data. We may disclose data to authorities where the law requires it, for example in a fraud or money-laundering investigation.

Security

Creators' shipping addresses and bank account numbers are stored encrypted, and a bank account number is never shown in full again once saved.

How long we keep data

We keep transaction/financial records for as long as Indonesian tax bookkeeping rules require. Guest gifter contact details that aren't needed for tax purposes (email, phone) are deleted or anonymised no later than 18 months after an order is completed, once the payment-dispute window has passed. If you delete your account, it has a 30-day grace period (sign back in to cancel). After that we erase it or, where there is any payment or payout history, anonymise it: we keep the transaction records we are required to keep and remove or anonymise the personal details they don't need. If you still have a balance to be paid out or funds under review, the account isn't erased until that has been paid out.

Your rights

Under Indonesia's Personal Data Protection Law, you can request access to, correction of, or deletion of your personal data, and withdraw consent. Creators can change most data directly in account settings, including deleting their account. For anything else, contact us.

Cookies and browser storage

We use cookies to keep you signed in and remember your language, and your browser's local storage to keep your cart. If analytics is switched on, our analytics provider (PostHog) also stores a random identifier in a cookie and in your browser's local storage to count visits; it contains no name or email.

Changes to this policy

We may publish addenda to, or otherwise update, this policy from time to time — for example when a new feature processes data differently. We will announce significant changes; the date above always reflects the current version.