Privacy Policy
English translation for convenience. The Indonesian version prevails. Bahasa Indonesia →
This policy applies to everyone who uses Skripcy, visits skripcy.com or buys a pass. It is a notice, not an agreement: there is nothing for you to accept. The same text, with the same version and date, is linked from the installer and Skripcy and shown at skripcy.com/privacy. It follows Law No. 27 of 2022 on Personal Data Protection (UU PDP).
1. Data controller and contact
Data controller: Skripcy (skripcy.com) · email hello@skripcy.com.
2. We do not collect your documents
Skripcy processes documents on your PC. The text of your thesis, report, book, paper or files is not sent to our server, for licensing or for anything else. The one exception is a bug report you send yourself and choose to include the document in (see "Bug reports" below).
3. Data we collect and why
| Data | Used for | Legal basis | Kept for |
|---|---|---|---|
| Email address (your account) and language choice | Signing in to Skripcy, receipts, reminders, support | Performance of the agreement | Until 2 years after your last active period ends |
| Account active period and status; account history (time added, PCs released, deactivation); device tokens and used gift codes (stored as hashes) | Running the licence | Performance of the agreement | Until 2 years after your last active period ends |
| Sign-in codes (stored as hashes) | Signing in to Skripcy or on the Account page | Performance of the agreement | 1 day |
| Account-page sign-in session (a token stored as a hash) | Showing your active period, PCs and orders on the website | Performance of the agreement | Until you sign out, 24 hours at most |
| Device ID (a hash, not the real serial number), PC name, Skripcy version, activation and last-seen dates | The 2-device limit; one trial per device and per email | Performance of the agreement; legitimate interest (preventing misuse) | 1 year after the device was last seen |
| IP address (stored as a hash) when Skripcy or the website contacts the licence server | Limiting sign-in and code attempts | Legitimate interest (security) | 1 day |
| Transaction data: order number, pass, amount, time, status, the version of the Terms that applied | Recording payments, proof of purchase | Performance of the agreement; legal obligation (bookkeeping and tax) | 10 years |
| Support messages and logs you send yourself | Solving problems | Your consent when sending | 1 year |
| Bug reports you send from Skripcy (see below) | Finding and fixing that problem | Your consent when sending | 60 days |
| Invite a friend: your account's invite code, the account that invited you, and the order that earned the reward; your friend never sees your email and you never see theirs | Giving the 30 extra days (Terms Article 12) | Performance of the agreement | Same as the account data |
| Emails that were invited, only as a hash | One email is invited only once (Terms Article 12) | Legitimate interest (preventing misuse) | For as long as Invite a friend runs |
| Email addresses we invite to the beta, with the invitation's gift code (as a hash) | Sending the invitation; letting that email sign in before launch | Legitimate interest (testing Skripcy before launch) | 1 year after the invitation, if the email never becomes an account (after that: account data) |
Bug reports. Skripcy's Report a bug window sends one file to our server only when you press send. It holds your words, the reply email you enter, Skripcy's log, the Windows, Word and Skripcy versions on your PC, your account if you are signed in, and the document and other files only if you tick or add them. A report is used only to find and fix the problem you reported, kept on our server (never in a public folder), and deleted 60 days after it arrives. You can ask for it to be deleted earlier at hello@skripcy.com, quoting its number (R-...).
Skripcy does not send logs, usage statistics or error reports automatically; a log is sent only when you send it to support yourself or in a bug report. Your card, bank account or e-wallet details are processed directly by DOKU or Lemon Squeezy; we never receive them.
4. Online services used by the reference features
When you search for a reference, Skripcy sends the search words (for example a DOI, title, author name or ISBN) straight from your PC to doi.org/Crossref, OpenAlex, arXiv, PubMed (NCBI), Open Library, ORCID, and GitHub (for citation style files). These services follow their own privacy policies. We do not receive this search data.
5. Who processes data for us
- DOKU: payments in Indonesia.
- Lemon Squeezy: payments from outside Indonesia. For those sales Lemon Squeezy is the merchant of record and handles the buyer's data under its own privacy policy; we receive the email, the pass and the payment status.
- Google: only if you choose "Continue with Google". Google tells us your email address and that it is verified; we receive no name, photo, contacts or other data, and we give Google none of yours.
- Hostinger (Indonesia): the licence server.
- Cloudflare: serves the skripcy.com website and runs its domain's DNS, and counts visits to the site (Cloudflare Web Analytics, Article 11).
- Hostinger: sending email.
We do not sell your data or use it for advertising.
6. Transfers abroad
If a server or service provider is outside Indonesia, we ensure equal or higher protection, or adequate and binding protection, as the regulations require.
7. Security
Connections use HTTPS. Sign-in codes, device tokens, website session tokens, gift codes, device IDs and IP addresses are stored as hashes. Only we can access the data on the server; the parties in Article 5 process it only for the service named there.
8. Your rights
Under UU 27/2022 you have the right to: information about how your data is processed (Art. 5); complete, update and correct your data (Art. 6); access and get a copy of your data (Art. 7); end processing, or erase or destroy your data (Art. 8); withdraw consent (Art. 9); object to decisions based only on automated processing (Art. 10); delay or restrict processing (Art. 11); sue and receive compensation (Art. 12); and receive your data in a machine-readable format and move it (Art. 13). Send requests from your account's email through the contact in Article 1. If you ask for your account to be deleted, any remaining active period ends with it and your devices are signed out at Skripcy's next licence refresh. Data we must keep by law (such as transaction records for tax) is kept until that obligation ends.
9. Children
If you are under 18, the consent of a parent or guardian is required (see also Licence Article B1).
10. Data breaches
If a personal data protection failure happens, we inform you and the competent authority in writing within 3×24 hours at the latest.
11. This website
skripcy.com uses no tracking or advertising cookies. To count visits, the site uses Cloudflare Web Analytics, which sets no cookies, stores nothing in your browser and does not track individual visitors: it records only how many visits each page gets, where visits come from (for example a search engine), the country, and the kind of device and browser. The site keeps only four things in your browser: a language cookie (1 year); your currency choice (Rp or US$), which is never sent to us; a friend's invite code if you open an invite link, sent to us only when you sign in or pay and removed once used; and, if you sign in on the Account page, one sign-in cookie from api.skripcy.com that is removed when you sign out or after 24 hours. Cloudflare and the hosting server keep standard access logs (IP address, time, page) for security.
12. Changes to this policy
We may change this policy. Important changes are announced in Skripcy and on skripcy.com at least 14 days before they take effect, under a new version number. The installer, Skripcy and the website always show the same version.