Privacy Policy

Last updated: 18 October 2026

Tfaja is a service that helps you share your bank account details and QRIS payment code with the people you choose, through one personal link. This Privacy Policy explains, in plain language, what data we collect, why we use it, how we protect it, and how you can delete it.

1. Who we are

Tfaja is an Indonesian service operated by the Tfaja developer team (referred to below as "we" or "us"), available at tfaja.com. For any question about this policy or your personal data, contact us at admin@tfaja.com.

2. Information we collect

We collect only the information we need to run the service:

• Account information. When you register with email or sign in with Google, we receive your name, email address, and profile photo.
• Google user data. If you choose "Sign in with Google", we access only your basic Google profile information: your name, your email address, and your profile photo. We do not access any other Google services (such as Gmail, Drive, or Calendar), and we do not request any other Google permissions.
• Profile content you create. Your display name, bio, bank or e-wallet account details (bank, account number, account holder name), QRIS image, and the logo or background images you upload.
• Payment information. When you purchase a paid plan, we record the plan, the amount, and the transfer proof file you upload, so we can verify the payment.
• Usage and device information. Pages visited, the link that referred you, browser and device type, and the country or city of your connection. We never store your raw IP address; for statistics we store only one-way hashes of visitor identifiers.
• Cookies. Essential cookies keep you signed in. Limited cookies count visits to public profile pages.

3. How we use your information

• To provide the service: publish and display your payment-details page and QRIS to people who open your link, and let them copy your account numbers.
• To create and secure your account, including signing you in with a password or with Google.
• To show you statistics about your profile page (paid plans).
• To send you service emails: email verification, password reset, payment status, and subscription reminders.
• To verify payments and to prevent fraud, spam, and abuse.
• Limited Use: We use Google user data only to provide and improve the Tfaja service (account creation and sign-in). We do not sell your data and we do not use it for advertising. We never use Google user data to train or develop artificial intelligence or machine-learning models.

4. How we share information

We do not sell your personal information. We share it only with the service providers that make Tfaja work, and only as needed:

• Cloudflare — hosting, database, and file storage.
• Google — only when you choose to sign in with Google, to verify your identity.
• Resend — to deliver our emails.

We may also disclose information when required by law. Google user data is never transferred or disclosed to third parties for any purpose other than providing the Tfaja service itself.

Please note: anything you add to a published profile (display name, account numbers, QRIS image) is visible to anyone who has your profile link. That is the purpose of the service. You control what you add, and you can unpublish your page at any time.

5. How we protect your data

• All traffic is encrypted with HTTPS.
• Passwords are stored as salted cryptographic hashes; we never store your password in plain text.
• Uploaded files are kept in private cloud storage and served only through Tfaja.
• Access to user data is limited to what is necessary to operate the service.
• Profile statistics use hashed visitor identifiers instead of raw IP addresses.

6. How long we keep data, and how you can delete it

We keep your information while your account is active, and for as long as needed for the purposes described above (for example, payment records for accounting). Usage statistics are automatically deleted after our configured retention period.

You can delete your data at any time:

• Delete your account: open Dashboard > Account > Delete account. This permanently removes your account, your profiles, and your uploaded files.
• Edit or remove content: you can change or delete profiles, account details, and images at any time in the dashboard.
• Request deletion by email: write to admin@tfaja.com. We will delete your data within 30 days, unless the law requires us to keep certain records (for example, payment records).

7. Your choices

• See and edit your personal data in the dashboard at any time.
• Profile pages are not indexed by search engines by default; you can turn indexing on or off for each profile.
• Unpublish or password-protect a profile whenever you want.
• Ask us what data we hold about you, or ask for a correction, by emailing admin@tfaja.com.

8. Children

Tfaja is not intended for children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Changes to this policy

We may update this policy as Tfaja evolves. For important changes we will notify you by email or on the website. The "Last updated" date at the top always shows the current version.

10. Contact

Questions, requests, or complaints: admin@tfaja.com.