Bareng Privacy Policy

1. Who is responsible for your personal data

Bareng is operated by PT Bareng (“Bareng,” “we,” “us,” or “our”), with a contact address at Pantai lndah Kapuk st, RT.6/RW.2, Kamal Muara, Penjaringan, North Jakarta City, Jakarta 14470, Indonesia. We are the controller of the personal data described in this Policy.

For privacy questions or rights requests, contact [email protected]. For general support, contact [email protected].

2. Scope

This Policy applies to the Bareng iOS app, the Android app when released, our websites, and related services. Bareng helps people discover places and content, follow others, share photos or short videos, organize and join in-person activities, and communicate with other users.

Third-party websites, maps, identity providers, and other services have their own privacy practices. This Policy does not control processing carried out independently by those third parties.

3. Personal data we process

Depending on the features you use, we process:

Account and sign-in data: email address, email-verification status, hashed password, account ID and status, sign-in times, and the time you confirmed that you are 18 or older (we do not ask for or store your date of birth or exact age; this record is never shown in the app or shared with other users). If you use Google, Apple, or Facebook sign-in, this also includes the provider account identifier, provider-supplied email and verification status, display name, avatar, and sign-in token. We do not receive your password for those third-party accounts.
Profile and preference data: display name, avatar, bio, age range, skill level, languages, interests, the name and approximate center/radius of a usual area you choose, app language, time zone, privacy settings, and notification preferences.
Social and public-profile data: following and follower relationships, blocks, public profile, post count, activity statistics, and reputation statistics. Your display name, avatar, bio, public posts, comments, and certain statistics may be visible to users or signed-out visitors, subject to the feature and visibility you select.
Content you provide: photos, videos of up to 15 seconds, captions, comments, reposts, activity titles and descriptions, join notes, place photos, report details, and other content you choose to submit. Public content can be saved or reshared by others.
Message data: text, images, sender, conversation, sent time, read state, and system events in activity group chats and eligible direct messages. Messages are displayed only to conversation members, but we may access them to provide the service, investigate safety issues, and act on reports.
Location and place data: device location after permission, manually selected area, search center, approximate location or place you attach to a post, activity venue, exact meeting point, and check-in-related records. Bareng requests location only while you use the app and does not continuously track background location. You may deny location access and choose an area manually.
Activity, footprint, and reputation data: activities you create, request to join, join, leave, check into, or complete; participant relationships; cancellation history; structured reviews; and reputation measures. Your footprint is inferred from places where you posted and completed activities you attended, not from continuous tracking.
Place and business data: place name, category, address, coordinates, opening information, phone, website, price level, photos, and source identifiers. Data can come from Apple map services, Bareng users or place operators.
Trust and safety data: reported target, reason, description, evidence snapshot, outcome, account restrictions, content removals, block records, and information relevant to investigating fraud, harassment, or abuse.
Device and technical data: IP address, user agent, app and operating-system version, platform, device identifier, push token, hashed session and refresh tokens, request ID, errors, performance information, and security logs. We do not collect advertising identifiers for third-party targeted advertising unless we later disclose the change and obtain any legally required permission.
Communications: emails and requests sent to support, safety, or privacy teams, and records of email verification, password reset, activity, message, and push notifications.

Do not place unnecessary sensitive personal data—such as government identifiers, financial account details, health information, or another person’s private location—in public content, free-text fields, or messages.

Our websites process connection and security information. The administration website uses a session cookie for authenticated access. We do not use advertising cookies on the official website; network providers may use cookies for security.

4. Sources of data

We receive data directly from you, from your use of Bareng, from other users’ interactions with you, and from identity and map services you choose to use. The current iOS area and place search uses Apple MapKit and Apple geocoding.

5. Why we process data

We process data to:

create and protect accounts, authenticate users, restore access, and maintain sessions;
show nearby content and places, process place searches, and return localized results;
publish, display, and recommend content, and operate follows, likes, comments, and reposts;
create, join, administer, and complete in-person activities and show necessary meeting details to approved participants;
provide group chats, direct messages, read states, and real-time delivery;
send requested service emails and authorized push notifications;
generate footprints, activity history, reputation, and safety signals;
accept reports, enforce blocks, investigate violations, protect people, and prevent fraud;
operate, troubleshoot, secure, and improve the service; and
comply with law, answer valid legal requests, and establish, exercise, or defend legal claims.

Where applicable, our grounds for processing include performing our agreement with you, your consent, compliance with legal obligations, protection of vital interests, and legitimate interests that have been balanced against your rights. You may withdraw consent-based permissions; withdrawal does not affect processing that was lawful before withdrawal.

6. Recommendations and automated processing

Bareng ranks or recommends content, places and activities using location, following relationships and feature-specific activity signals. Automated rules can affect reputation and feature eligibility. Contact [email protected] to ask about a decision affecting you or request human review.

7. Who can see your data

Public information: profile fields, public posts, comments, follow counts and public activity details can be visible to others. The current footprint feature can expose activity statistics and recent places to signed-out visitors. Do not assume that activity history or attached places are private.
Activity and message information: the app uses membership and conversation access rules for meeting details and chats. Messages are processed on our servers; they are not described as end-to-end encrypted.
Deactivated and deleted accounts: after you request account deletion, your profile, posts, comments and the activities you organize are no longer shown to others during the 30-day recovery period; members already approved for your activities can still view their details. Restoring the account shows the content again.
Block, mute and restrict: blocking hides each person's profile and content from the other. Muting only affects what you see: the muted person's posts and reposts no longer appear in your feeds and you stop receiving push notifications for their messages. Restricting makes that person's comments on your posts visible only to them and to you, and you stop receiving push notifications for their messages. Neither muting nor restricting notifies the other person.
Media links: uploaded media can be delivered through public media URLs. An audience setting in the app does not make an already shared file URL confidential. When content is deleted or taken down, or when you request account deletion, the corresponding files are moved out of public storage and the delivery cache is cleared, so the original links stop working. Business verification documents are kept in non-public storage and are shown to reviewers only through short-lived authorized links.
Operational access: personnel administering the service can access data for support, operation, safety and legal needs.

Available preference switches must not be interpreted as a guarantee that historical records or public copies are removed. Posting a location may reveal your movements.

8. Service providers and other recipients

We use the following categories of providers as needed for the features you use:

cloud hosting and database services to operate and store application data, and Cloudflare for network protection and media storage/delivery, including R2;
Apple map and geocoding services for current iOS area and place searches, which process relevant search, location and technical information; see Apple Maps & Privacy;
Google, Apple or other identity providers when you select a supported login method;
Firebase Cloud Messaging and Apple Push Notification service for push delivery; and
Alibaba Cloud DirectMail for verification, account-recovery and other service emails.

Messages also pass through real-time infrastructure operated for Bareng. Necessary information may be disclosed to authorized providers and advisers, authorities when lawfully required, or a lawful business successor, to operate the service or protect rights. We do not sell personal data or use it for third-party cross-app targeted advertising. This does not mean providers receive no technical data.

9. International transfers

Our primary servers, application data and backups are located in Indonesia. Third-party login, map, push notification, email and Cloudflare services may process or route information in other countries under their own infrastructure and terms. Hosting our primary data in Indonesia does not mean that all third-party processing stays in Indonesia. Contact [email protected] for questions about these transfers. Where required by law, we must use appropriate transfer safeguards or another lawful transfer mechanism.

10. Retention and deletion

We retain data necessary to provide and protect your account while you use Bareng. When you request account deletion:

We deactivate your account and revoke stored refresh sessions and push registrations. Your profile, posts, comments and the activities you organize stop being shown to others, and the media files you uploaded are immediately moved out of public storage.
A 30-day recovery period starts from the request. Signing in during this period can restore your account and cancel the pending deletion.
After that period, account and content cleanup proceeds. Our retention policy requires associated personal data and backups to be deleted or irreversibly anonymized within a maximum of three calendar months from the deletion request, including the recovery period.
Data that must be retained for a specific legal obligation or an ongoing legal claim may be kept for the necessary period with restricted use. We will explain the applicable exception when responding to a request. Copies independently saved by others are outside our direct control.

When the recovery period ends we delete the media files you uploaded (not merely flag them as hidden) and clear the body and images of messages you sent, except files taken down for rule violations that are still within their retention period, which are deleted when that period ends as described below. Backups are different: database snapshots and storage copies are whole point-in-time copies from which an individual person cannot be removed separately, so they are cleared as those copies rotate out, within the three calendar months stated above. Contact [email protected] for earlier deletion, confirmation of completion, or a request concerning an individual item. If applicable law requires a shorter period, that requirement takes precedence. See Account deletion.

Content you delete and content that is taken down: when you delete a post or photo or change your profile picture, the content stops being shown immediately and the corresponding files are kept in non-public storage for 30 days to handle reports and safety investigations concerning that content, then permanently deleted. Files of content taken down for violating our rules are kept in non-public storage for 180 days for appeal review and lawful cooperation with investigations; they can be restored if an appeal succeeds and are permanently deleted when the period ends. Files that were uploaded but never used in any content are deleted after 30 days. These periods do not change the three-calendar-month backup rotation described above.

11. Your choices and rights

Subject to applicable law, you may request access, correction, a copy, restriction or cessation of processing, withdrawal of consent, objection, deletion and review of automated processing, and complain to a competent authority.

Edit profile and available preferences in app settings. A preference does not necessarily erase existing records.
Manage location, photos and notification permissions in device settings.
Request deletion at Profile → Settings → Delete account, or follow the web instructions.
Send other privacy requests to [email protected].

We may need proportionate account verification to prevent impersonation. Do not send a password, one-time code or identity document with an initial request. Applicable statutory deadlines and exceptions govern requests.

12. Security

We use HTTPS, password and session-token protection, authentication checks and request limits to protect the service. No online service can guarantee absolute security. Where a personal-data incident requires notice, we will notify affected people and authorities as required by applicable law.

13. Children

Bareng is for people aged 18 or older. A person under 18 may not create or use an account. In-person activities, public content, location, and user-to-user communication create particular risks. If you believe a child has provided data to us, contact [email protected]; we will investigate and take appropriate deletion, deactivation, and protective steps.

14. Third-party place content

Current iOS area/place lookup uses Apple map services; user-submitted place information may also be stored in Bareng. Map and third-party content remains subject to its provider’s terms and attribution requirements. Information may be inaccurate or outdated. Verify important venue and route details independently.

15. Changes to this Policy

We may update this Policy as the product, providers, or law changes. We will give advance notice of material changes through the app, email, or another prominent channel and obtain renewed consent where required. The current version and effective date will appear at the top.

16. Contact

Data controller: PT Bareng

Address and country: Pantai lndah Kapuk st, RT.6/RW.2, Kamal Muara, Penjaringan, North Jakarta City, Jakarta 14470, Indonesia

Privacy: [email protected]

Support: [email protected]