Privacy Policy

Effective date: 3 November 2026

This Privacy Policy explains how M Owners Club Indonesia (MOCI) ("MOCI", "we", "us") collects, uses, shares and protects personal data when you use the MOCI mobile app and this website. We process personal data in line with Indonesia's Personal Data Protection Law (Law No. 27 of 2022).

Summary

• We collect what we need to run club membership, events and the community.
• Other members never see your plate number, phone number, emergency contact or address.
• We do not sell your data, show ads, or use analytics or tracking tools.
• The app does not access your location, contacts or microphone.
• You can ask us to access, correct or delete your data at any time.

1. Data we collect

Account

• Email address and password. Passwords are handled by our authentication provider and stored only in hashed form.
• A 6-digit email verification code during registration. We store it only as a hash and delete it within 7 days.

Membership application

• Full name, nickname and date of birth.
• Address (street, district, city, province, postal code and country).
• Emergency contact name and phone number.
• Apparel size and, optionally, your Instagram handle.
• Profile photo, drawn signature and the membership agreement you sign.
• Proof of membership payment (a photo of your bank transfer receipt).

Your cars

• Car brand, model, generation, year, colour, drivetrain and plate number.
• Car photos, and whether you mark a car as public.

Club activity

• Event RSVPs: your answer, the car you bring, guest names and types, apparel sizes and payment proof for paid events.
• Community forum: messages, images, mentions, poll votes and when you were last active.
• Leaderboard points and league.
• Which notifications you have read.

Device and technical data

• A push notification token and your device platform (iOS or Android), if you allow notifications.
• Standard server logs kept by our hosting providers, such as IP address and request time, used for security and troubleshooting.

Your account, membership number, role, status and expiry date are created by us when an admin reviews your application.

2. App permissions

• Camera to take your profile photo and car photos.
• Photo library to choose car photos, payment proofs and forum images.
• Notifications to send membership, event and club announcements.

Each permission is optional and can be turned off in your device settings. Some features will not work without it.

3. How we use your data

• Review and approve membership applications and renewals, including payment verification.
• Issue your member number and digital membership card, and check you in at events.
• Organise events, manage RSVPs, guests, apparel and paid-event payments.
• Contact your emergency contact for safety and incident response at club events.
• Run the member directory, forum and leaderboard.
• Send notifications you have allowed.
• Keep the service secure, prevent abuse and meet our legal obligations.

We process your data to provide the membership you apply for, on the basis of the consent you give when you register, and where needed to meet legal obligations.

4. Who can see your data

Other members

Active members can see your name, nickname, photo, role, tier, leaderboard points, forum messages, and the brand, model, generation and year of the car you mark as public. They cannot see your plate number, phone number, emergency contact, address, date of birth, email or payment details.

MOCI admins

Authorised MOCI admins can see your full application and profile, including car and plate details, payment proofs and event RSVPs. They need this to verify membership and run events. Admin actions are logged.

Partners and sponsors

We do not share your personal data with sponsors or partners.

5. Service providers

We use these providers to run the app. They process data only on our behalf:

• Supabase: database and user authentication.
• Vercel: hosting for our API and website.
• Amazon Web Services (S3, Singapore region): encrypted storage for photos and documents.
• Resend: sending verification emails.
• Expo: push notification delivery and app updates.
• Google Firebase Cloud Messaging and Apple Push Notification service: delivering notifications to your device.

Some of these providers store or process data outside Indonesia. We only use providers that protect personal data to a standard comparable to Indonesian law. We do not sell your personal data. We may disclose data where required by law or by a valid request from authorities.

6. Storage and security

• Your sign-in session is stored in your device's secure storage (Keychain on iOS, Keystore on Android).
• Data travels over encrypted connections (HTTPS).
• Photos and documents are stored privately and encrypted at rest. They are shown only through links that expire.
• Access is restricted by role, so members cannot read other members' private data.

No system is perfectly secure. If a data breach affects you, we will notify you and the authorities as required by law.

7. How long we keep data

• Account and membership data: for as long as you have an account.
• Email verification codes: up to 7 days.
• When you cancel an RSVP, we delete its guest details and payment proof.
• When your account is deleted, we delete your profile, cars, photos, RSVPs, payment records, forum messages and points within 30 days. Copies in backups may remain for a limited time until they are overwritten. Admin audit records are kept without your name or other details that identify you.

8. Deleting your account

To delete your MOCI account and personal data:

• Email [privacy contact email] from your registered email address with the subject "Delete my account".
• We confirm the request and delete your account and data within 30 days.

Deleting your account ends your membership and removes your digital card.

9. Your rights

Under Indonesian law you have the right to:

• Get information about, and a copy of, your personal data.
• Correct inaccurate data. Most profile details can be edited in the app.
• Have your data deleted, or its processing stopped or restricted.
• Withdraw your consent. This may mean we can no longer provide membership.
• Object to processing and file a complaint.

To use these rights, email [privacy contact email]. We may ask you to confirm your identity first.

10. Children

MOCI is a club for car owners and is not intended for children. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date, and tell you in the app if the changes are significant.

12. Contact us

M Owners Club Indonesia (MOCI)
Email: [privacy contact email]