We only collect the minimum information necessary to keep your account secure and provide our services:

• Account Data: Your email address and a securely hashed version of your password.
• Security Logs: Your IP address and login timestamps to prevent automated attacks and unauthorized access.
• Cookies: We use only first-party cookies and essential security service cookies:
  • Authentication: To keep you logged in securely
  • User Preferences: To remember your display settings (theme, layout) and language or regional preferences, which are essential for delivering our personalized services
  • Security Protection: We use Cloudflare to protect against DDoS attacks and malicious bots. Related cookies (such as hcdn, __cf_bm) are used solely to distinguish legitimate users from attacks and are not used to track you across other websites.
  We do not use third-party tracking cookies, advertising cookies, or analytics cookies that monitor your behavior across other websites. All cookies are set by us or essential security providers and serve only to improve your experience on this site.

Your data is stored on secure infrastructure located in Malaysia. We operate as a Data Controller in accordance with the Malaysian Personal Data Protection Act 2010 (as amended) and applicable data protection laws in jurisdictions where our users reside.

By using our services, you acknowledge and consent to the transfer of your personal data to Malaysia for processing and storage. Where required by applicable law, we implement appropriate safeguards for international data transfers.

We protect personal information using appropriate technical and organizational measures, including:

• Secure Credential Storage: Passwords are hashed using industry-standard cryptographic algorithms and additional application-level safeguards.
• Secure Transmission: Sensitive account-related interactions (such as login and registration) are secured using HTTPS/TLS encryption.
• Platform Security Controls: Our hosting provider implements infrastructure safeguards including firewall protection, monitoring, patch management, and malware scanning.
• Access Controls: Administrative access to systems is restricted.

Depending on your jurisdiction, you may have certain rights regarding your personal data. We extend the following rights to all users:

• Right to Erasure (Deletion): You may initiate account deletion from your account settings. Your account will be soft-deleted immediately and permanently erased after a 30-day grace period.
• Right to Data Portability: You may request a machine-readable copy of your personal data.
• Right to Access: You may request confirmation of whether we process your personal data and obtain a copy of the information we hold about you.
• Right to Correction: You may request correction of inaccurate or incomplete personal data.

To exercise any of these rights, please contact us using the details provided below. We may need to verify your identity before processing your request.

We retain personal data only for as long as necessary to provide our services, maintain security, and comply with legal obligations.

• Active Accounts: We retain your personal data for as long as your account remains active and necessary to provide our services.
• Deleted Accounts: After the 30-day grace period expires, personal data associated with the account is permanently removed from our active databases, except where retention is required for legitimate security or legal purposes.
• Security Logs: Application-level access logs are retained for up to 72 hours. Login history and related security records may be retained for a limited period for fraud prevention, abuse detection, and system security.

For any data-related inquiries or to exercise your rights, please contact us via our Contact Form. We respond to verified requests within a reasonable timeframe and in accordance with applicable law. We may require identity verification before processing your request.