KURA KURA BALI — Privacy Policy

This Privacy Policy explains how we collect, use, store, and protect information when you use the Kura Kura mobile application and related services.

By using the App, you agree to this Privacy Policy.

1. Information We Collect

We collect the minimum information needed for the App to function.

1.1 Account Information

• Email address (for Member login)
• Google account ID (for Google Sign-In)
• Anonymous identifier (for Guest mode)
• Basic profile data (optional)

Guest users remain pseudonymous.

1.2 Usage, Interaction & Engagement Data

• Directory pages (restaurants, shops, galleries, services, events)
• Expeditions map and artifact POIs
• Artifact collection actions
• Badge and character progression
• Voucher views and redemption attempts
• Navigation actions (searches, filters, favorites)
• Social sharing triggers
• In-app reservations
• Onboarding steps and tutorials
• AR/QR events

1.3 Location Data

With your consent, we may collect:

• Approximate location
• Precise location when required for:
  • Artifact pickup
  • Showing nearest POIs
  • Navigation and route calculation
  • Shuttle / transportation suggestions
  • Map filtering
  • Behavioral analytics (aggregated)

We do not collect continuous location history.

1.4 Device & Technical Data

• Device model, OS version
• App version
• Crash reports
• Performance metrics
• ARCore compatibility checks
• Camera permission status

1.5 Camera & Media Access

• QR code scanning
• AR interactions
• Optional artifact view animations

We do not access your photos or media files.

1.6 Voucher & Redemption Data

• Earned vouchers
• Expiry and quantity
• Redemption attempts
• Successful validation events
• Associated vendor and location
• Staff validator actions

1.7 Administrative & Vendor Data

• Role-based login data
• Content creation activity
• Validation logs
• Dashboard usage

1.8 Cookies & Similar Technologies

If you access the web dashboard or online links, we may use cookies, analytics tags, and session tracking. All data is anonymized or aggregated.

2. How We Use the Information

• Operate core app functions
• Enable artifacts, rewards, navigation, and vouchers
• Personalize and improve user experience
• Support operational planning and analytics
• Prevent fraud and duplicate redemptions
• Meet regulatory and compliance obligations

We never sell personal data.

3. Legal Basis

• Consent (location, camera, notifications)
• Contract (member account features)
• Legitimate interest (security, analytics, improvements)

4. Data Sharing

We share data only with:

4.1 Service Providers

• Firebase Authentication
• Firestore Database
• Cloud Functions & Storage
• Crashlytics & Analytics
• Maps and geolocation providers

4.2 Vendors & Tenants

Only aggregated, non-personal data such as voucher redemption confirmations.

4.3 Legal Requirements

Data is shared only if required by law. No third-party advertisers.

5. Data Retention

• Guest accounts: 6 months of inactivity
• Member accounts: until deletion requested
• Voucher logs: retained for reconciliation
• Analytics: anonymized long-term

6. Children’s Privacy

The App is not directed at children under 13.

7. Security

• Encrypted data transmission (HTTPS)
• Secure Firebase rules
• Role-based access
• Fraud detection

8. Your Rights

• Access, correct, or delete your data
• Withdraw permissions
• Request a copy of your data

Contact: [insert email]

9. International Transfers

Data may be stored in Google Cloud regions outside Indonesia, subject to standard contractual safeguards.

10. Policy Updates

Updates will be posted in the App and official channels.

11. Contact Us

PT Bali Turtle Island Development
[Insert Address]
Email: [insert support email]