Privacy Policy

This policy explains what data 1234app collects, what it’s used for, how long it’s kept and your rights over it. Our principle: collect as little as possible and never store raw IP addresses.

Who we are

1234app operates this site and is the controller of the personal data processed through the site and the staff console. For questions about this policy, use the form on the Contact page.

Data we collect

Visitors

• Hashed IP addresses. We never store raw IP addresses. IPs are turned into salted, one-way HMAC-SHA256 hashes for rate limiting, abuse prevention and counting unique downloads.
• Download events: the app and version downloaded, or a click on a download button that leads to another site, plus the time, the link source, the IP hash, and the country estimated from the IP address using a location database on our own server.
• Ratings: the star value, IP hash and device hash, to prevent duplicate ratings.
• Reports: the reason, message, version if chosen, IP hash, and your email address if you provide it.
• Contact messages: the name, email, subject and message you send.
• Page statistics: only if you agree to analytics, we count views per page per day. These are aggregates with no IP address or personal identifier.

Staff

Email, name, role, a hashed password, an encrypted two-step verification secret, login history, and an audit log of actions taken in the console.

How we use data

• To provide and secure the service, including downloads, ratings, reports and accounts.
• To prevent spam, fraud and abuse, including rate limiting.
• To calculate download statistics and popularity rankings.
• To review reports and enforce the rules.
• To send necessary emails, such as email verification, password resets and account notices.

We don’t sell personal data and don’t use it for targeted advertising.

Cookies

By default we only use necessary cookies:

• theme: your light or dark display choice.
• consent: your cookie consent choice.
• panel_lang: the language of the staff console.
• Session and CSRF protection cookies for the staff console, only after a staff member signs in.

Page statistics are only sent after you agree to analytics in the cookie banner. You can change that choice at any time.

Legal basis

We process data to provide the service you ask for (such as replying to a contact message), for our legitimate interest in keeping the service secure and preventing abuse, to meet legal obligations, and on the basis of your consent for page statistics.

Retention

• Raw download events are kept for 90 days. After that only daily per-app aggregates without IP hashes remain.
• Ratings and reports are kept while the related app exists.
• Staff account data is kept while the account is active, and afterwards as long as needed for security and legal obligations.
• Files detected as malicious are kept for 30 days for review, then deleted.
• Database backups are kept for 14 days.

Third parties

We only share data with providers that help run the service:

• Cloudflare Turnstile: the anti-spam check on the report, contact and sign-up forms. Turnstile processes technical data from your browser under Cloudflare’s policies.
• VirusTotal (when enabled): we only send the SHA-256 checksum of uploaded files, never the file itself and never user data.
• Email provider: to deliver transactional emails to your address.
• Infrastructure providers: the servers and storage the service runs on.

We may disclose data when required by law or by a valid order from a competent authority.

Your rights

Under applicable data protection law, including Indonesia’s Law No. 27 of 2022 on Personal Data Protection, you can ask to access, correct or delete your personal data, withdraw consent, and object to certain processing. Send your request through the Contact form. We may need to verify your identity first.

Because IP addresses are only stored as hashes, we generally can’t link anonymous visitor data to a specific person.

Security

Passwords are stored with a strong hashing algorithm, two-step verification secrets are encrypted, connections use HTTPS, and staff access is protected by mandatory two-step verification and an audit log. No system is perfectly secure, but we take reasonable care to protect your data.

Changes to this policy

We may update this policy. The date of the last update is shown at the top of the page. We’ll announce important changes on the site.

Contact us

For questions or requests about personal data, use the form on the Contact page.