There is no advertising, no analytics, and no tracking on this site. We load no third-party script of any kind. The only personal data we hold is what an account needs in order to exist, plus what is needed to keep it secure.
This policy explains what personal data tradingwithdewa collects when you use tradingwithdewa.com and its member apps, why we process it, and what you can ask us to do with it. It is written to meet the requirements of Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP).
In this policy, "we" and "us" mean tradingwithdewa, the operator of this site and of its member apps, including those at fx., idx., fxdiv., idiv., ihsg., and smart.tradingwithdewa.com. We act as the data controller (pengendali data pribadi) for the data described below.
1. What we collect
Account
Your name, your email address, and a password. The password is never stored in a readable form — only a cryptographic hash of it is kept, which nobody, including us, can turn back into your password.
Membership
Which plan you are on (Free, Gold, Platinum, or Diamond) and whether your account is an administrator. Both are set by us, never by you, and never from a request your browser sends.
Sessions
When you sign in we store a session record: a random token, its expiry, the IP address the sign-in came from, and your browser's user-agent string. This is what keeps you signed in across the member apps and what lets a session be ended.
Abuse prevention
A short-lived counter, keyed to the requesting IP address, for sign-in, sign-up, password-reset, and verification-email attempts. It exists only to rate-limit those endpoints.
Verification tokens
Single-use, short-lived tokens used to verify your email address and to reset a forgotten password.
Administrative audit
When an administrator changes an account's plan, we record which administrator made the change, which account it applied to, the old and new values, and when. This log is append-only.
We do not collect payment details. No card number, bank account, or e-wallet identifier is ever entered on this site, because no payment is processed here — upgrades are arranged directly with us (see the Terms of Service).
2. What we deliberately do not collect
- No analytics or advertising. There is no Google Analytics, no advertising pixel, no heatmap, no session recording, and no fingerprinting on any page.
- No brokerage access. The apps never ask for and never receive your broker credentials, API keys, account numbers, positions, or balances. They cannot place orders and are not connected to any broker.
- No trading activity. We do not know what you trade, whether you traded, or what happened when you did.
- Your in-app settings stay on your device. Watchlists, chosen patterns, timeframes, and similar preferences are kept in your browser's local storage. They are not transmitted to us and we cannot read them.
3. Cookies
We set exactly one cookie: the session cookie issued when you sign in. It is HttpOnly (scripts cannot read it), Secure (sent over HTTPS only), SameSite=Lax, and scoped to .tradingwithdewa.com so that a single sign-in works across the member apps without signing in again.
It is strictly necessary: a member area cannot function without it. Because there are no analytics or advertising cookies, there is no consent banner on this site and nothing for you to dismiss.
4. Why we process it
- To create and operate your account and sign you in — necessary to provide the service you asked for.
- To send transactional email — email verification and password resets. These are the only emails we send.
- To enforce plan access — your plan is read from the database on every request to a member app, so that access reflects your current plan rather than a stale value.
- To keep accounts secure — rate limiting, session records, and the administrative audit log exist to detect and limit abuse. This is our legitimate interest in operating a secure service, and yours in not having your account taken over.
We do not use your data for marketing, we do not send marketing email, and we do not profile you or make automated decisions that produce legal or similarly significant effects.
5. Who else processes your data
Cloudflare
Hosting, content delivery, and the database that holds every table described above. All traffic to this site and its apps passes through Cloudflare's network, which necessarily processes your IP address.
Resend & Amazon SES
Delivery of verification and password-reset email. They receive your email address and the contents of those messages.
Google Fonts
This site loads its typefaces from fonts.googleapis.com and fonts.gstatic.com, as do some of the member apps. Your browser contacts Google directly to fetch them, which discloses your IP address and user-agent to Google. No cookie is set by that request and no data is returned to us.
GitHub
Source code and the scheduled jobs that produce the daily scans. It processes no personal data of yours — the scan data contains market prices only.
We do not sell, rent, or trade your personal data, and we never will. We disclose it to no one else, except where we are legally compelled to by a valid order from a competent authority.
6. Where your data is processed
Our database is operated by Cloudflare and is replicated across their network; email is delivered through infrastructure located in the Asia-Pacific region. Some processing therefore takes place outside Indonesia. Where that happens, it is because it is necessary to deliver the service you have asked for.
7. How long we keep it
- Account data — for as long as your account exists, and until you ask us to delete it.
- Sessions — until they expire or you sign out, whichever comes first.
- Verification and password-reset tokens — minutes to hours; they expire on their own and are single-use.
- Rate-limit counters — continuously overwritten; they hold no history.
- Administrative audit log — kept indefinitely. A record of who changed what has to outlive the accounts it describes, or it is not a record. It stores internal account identifiers, not your name or email address.
8. Your rights
Under UU PDP you may ask us to:
- tell you what data we hold about you and how we process it;
- correct anything inaccurate or incomplete;
- delete your account and the personal data attached to it;
- give you a copy of your data in a readable format;
- withdraw consent, object to processing, or restrict it;
- complain to the competent supervisory authority if you think we have got this wrong.
To exercise any of these, contact us at t.me/tradingwithdewa from the account you want to ask about, or from the email address registered to it. We will respond within 14 days.
Deleting your account removes your account record, your credentials, and every session belonging to it. The administrative audit log retains the fact that a plan was changed and the internal identifier it applied to, for the reason given in section 7.
9. How we protect it
- HTTPS everywhere, enforced by HSTS across the whole domain.
- Passwords stored only as hashes, with a 12-character minimum.
- Session cookies that scripts cannot read and that are only sent over HTTPS.
- Access to every member app checked on the server on every single request, never in the browser.
- Rate limiting on sign-in, sign-up, and password-reset endpoints.
- A strict Content Security Policy, and no third-party scripts to subvert.
No system is perfectly secure. If we ever discover a breach affecting your personal data, we will notify you and the relevant authority as UU PDP requires.
10. Children
This service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has registered, tell us and we will remove the account.
11. Changes to this policy
If we change this policy we will update the date at the top of the page. Where a change materially affects how we handle your data, we will tell you by email before it takes effect.
12. Contact
Questions about this policy, or any request under section 8: t.me/tradingwithdewa.