1. Who We Are
Controller: Belation Labs Inc.
We run the Belation apps and APIs at belation.my.id / api.belation.my.id. Deep link belation:// opens the app.
2. Data We Collect
Account
- @username, display name, bio
- Verified email, Argon2id hash
- Avatar, language & theme
Content
- Posts, comments, reactions
- Notes — one active (24h Free / timeless Plus)
- WebP photos & location tags
Social Graph
- Accepted friends, requests
- Private nicknames (only you see)
Device
- Per-device session tokens
- Push tokens (APNs/FCM)
- IP logs — max 14 days
3. How We Use Your Information
Under GDPR Art. 6(1)(b) contract & 6(1)(f) legitimate interest. No ads, no profiling, no data-broker sales.
- Realtime: Socket.IO delivery to accepted friends only.
- Notifications: Push for direct activity — tunable in Settings.
- Plus enforcement: Friend/note caps.
- Security: Anti-abuse & session integrity.
5. Retention
Free Notes: hard-deleted at 24h; new note overwrites old.
Manual delete: unlinked instantly, purged <60s.
Backups: 30-day rolling, then shredded.
6. Security
At Rest
AES-256 volumes & photo buckets.
In Transit
TLS 1.3 + HSTS.
Sessions
Per-device, revocable in Settings.
Passwords
Argon2id, never stored raw.
7. Export & Erasure
Export a JSON archive anytime; delete permanently via Danger Zone.
Export
Settings → Privacy & Data → Request Data Export
Delete
Settings → Danger Zone → Delete Account — password + phrase DELETE MY BELATION ACCOUNT + email link (15 min).
9. Children's Privacy
13+ only. Under-13 accounts are terminated and deleted.
10. Contact
Contact: hello@belation.my.id — also see Terms.