Privacy Policy

Effective 27 October 2026.

This draft follows Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "UU PDP") and the GDPR. It has not yet been reviewed by a legal expert and may change.

Who we are

fisikuy is a physics learning website run by an individual site manager ("we"). We are the data controller. Questions, complaints and requests about your data: ray.dreamways@gmail.com.

Data we collect

• Account data: username, email, password (stored only as a hash; we cannot read it) and full name.
• Optional data: school and class.
• Sign in with Google: if you choose to sign in with Google, Google gives us your name, email address and profile photo after you consent on Google's screen. We do not request any other access to your Google account.
• Activity data: your answers to problems, points, and submission times.
• Consent record: the time you accepted this policy when signing up.
• Log data: IP address, browser type and access times, recorded automatically in the server logs of Vercel and Supabase. We do not collect location or other device data.

We do not collect sensitive (special category) personal data, use analytics or trackers, show ads, take payments, or use AI services to process your data. There is no chat, and users do not upload content: archive PDFs are uploaded only by the site manager, and your work in the Lab and the illustration maker stays on your device.

Why we use your data and our legal basis

• To run the service: create and secure your account, receive and grade answers to weekly problems, show the leaderboard, and manage archive access.
• To respond to your questions and requests.
• To send administrative emails: email verification and password reset. We send no newsletters.
• To keep the site secure and stable, using log data.

Our legal basis is your consent given when you sign up (Art. 20 UU PDP; Art. 6(1)(a) GDPR), and, for the account and activity data needed to run the service, performance of the service you requested (Art. 6(1)(b) GDPR). Log data is processed on the basis of our legitimate interest in site security (Art. 6(1)(f) GDPR). You can withdraw consent at any time by deleting your account; withdrawal does not affect processing that was lawful before.

What other users can see

Only your username and points appear on the public leaderboard. Your name, email, photo, school and class are never shown.

Who we share data with

We do not sell your data or use it for advertising. The following providers process data on our behalf (data processors):

• Supabase: database, authentication, archive storage, and sending verification emails.
• Vercel: website hosting and access logs.
• Google: only if you use Sign in with Google.

We may also disclose data where required by law or a valid order from an authority.

Transfers outside Indonesia / Europe

These providers may operate servers outside Indonesia (and outside the European Economic Area), so your data may be processed in other countries, for example the United States or Singapore. We choose providers with adequate security standards and, for users in Europe, rely on GDPR transfer mechanisms such as standard contractual clauses or a data privacy framework (Art. 56 UU PDP; Chapter V GDPR).

Cookies

We use only the cookies needed to keep you signed in (login session). Your light/dark theme choice is kept in your browser's local storage. There are no advertising or tracking cookies, so we show no cookie banner.

How long we keep data

Account and activity data is kept while your account is active. When you delete your account, your account data and answers are permanently deleted from our systems. Infrastructure providers' backups may persist briefly before they are also erased. Log data is kept by Vercel and Supabase under their own retention policies, which are generally short.

Users under 18

Many of our users are high-school students. UU PDP gives children's data special protection and requires the consent of a parent or guardian (Art. 25 UU PDP). If you are under 18, sign up only after your parent or guardian knows and agrees; by ticking the consent box when you sign up you confirm this. For users in the EU, the age at which you can consent alone depends on your country (13 to 16, Art. 8 GDPR). Parents and guardians can contact us at any time to see or delete their child's data, and we will delete accounts we learn were created without proper permission.

Your rights

Under UU PDP (Art. 5 to 15) and the GDPR (Art. 15 to 22), you have the right to:

• be informed about how your data is processed;
• access your data, get a copy, and have it transferred (portability) in a common format;
• update or correct inaccurate data (Profile page);
• have your data erased, and delete your account at any time (Profile page);
• withdraw consent (by deleting your account);
• restrict processing or object to it;
• object to decisions based solely on automated processing. Answer grading on fisikuy uses answer keys set by the site manager and has no legal effect on you;
• seek compensation for violations of personal data processing under UU PDP.

To use a right that is not available directly on the site, contact ray.dreamways@gmail.com. We aim to reply within 3 working days and in any case within 30 days. You also have the right to complain to the competent personal data protection authority in Indonesia or, if you are in Europe, to the data protection authority of your country.

Security

Connections use HTTPS, passwords are hashed, and database access is restricted per user (row level security) so you can only read your own answers. No system is perfectly secure, but we work to protect your data. If a personal data protection failure affects you, we will notify you within 3 x 24 hours of learning of it (Art. 46 UU PDP; Art. 33 and 34 GDPR).

Problems and copyright

Problems that are not our own work credit their source. If you own a problem and want it removed or its credit corrected, contact us and we will act promptly. Please do not redistribute archive PDFs with restricted access.

Changes to this policy

If this policy changes we update the effective date above and announce important changes on the site. If a change requires new consent, we will ask for it.