Privacy Policy_

Last updated: 13 June 2026 · Governed by UU No. 27 Tahun 2022 (UU PDP)

codebro_ ("we", "us") operates codebro.id, a curated public directory of technical builders in Indonesia. We process personal data in accordance with Indonesia's Personal Data Protection Law, Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi ("UU PDP"), and its implementing regulations. This policy explains what we process, why, and the rights you hold.

1. Data controller

The data controller (pengendali data pribadi) is codebro_, operated by Ridho Putradi S'Gara, Jakarta, Indonesia. Contact for all privacy matters: [email protected].

2. Personal data we process

a. Directory profiles. For each listed builder: name, professional photograph, job title, employer, city, a short professional biography, skills, indicative years of experience, and a link to their LinkedIn profile. We deliberately do not publish private contact details (email addresses, phone numbers) or any sensitive personal data as defined in Article 4 of the UU PDP.

b. Submissions. If you nominate a builder via our submit form, the details you enter — the nominee's name, city, role, LinkedIn URL, skills and any supporting notes — are saved to our private review queue (Cloud Firestore). The form does not require you to sign in and does not collect your email address or other contact details about you as the submitter.

c. Accounts and profile claims. Listed builders may claim their profile by signing in with a Google account. When you do, we receive and store your account name, email address and profile picture URL, together with a Firebase account identifier, solely to verify and administer your claim. Claimed ("verified") profiles can be edited by their owner, and owners may publish Showcase items — text, links and images they upload themselves.

d. Analytics (consent-based). We use Google Analytics 4 to understand, in aggregate, how the Grid is used (pages viewed, approximate location, device and referrer). Analytics runs only if you accept via the consent banner shown on your first visit; until you accept, no analytics cookies are set and no Google Analytics script loads. You can decline — the site works identically — and you may change your choice at any time by clearing the sb-consent entry in your browser storage. We have configured Google Consent Mode so that analytics storage stays denied unless and until you opt in, and we do not use Analytics for advertising.

e. Other technical data. Signing in (Section 2c) uses Google Firebase Authentication, which stores session state in your browser strictly to keep you signed in. Our hosting and security providers (Google Firebase; Cloudflare, which proxies the site) and the content delivery networks we load resources from (Google Fonts, jsDelivr) may log technical data such as IP addresses as part of serving and protecting the site — see Section 6.

3. Where directory data comes from

Directory profiles are compiled from publicly accessible professional sources, principally the public LinkedIn profiles of the individuals listed, and from nominations submitted to us. Biographies are drawn from what individuals state publicly about their own work; we do not add facts beyond those sources.

4. Lawful basis and purpose

Under Article 20 of the UU PDP we rely on:

• Legitimate interest for the directory itself: surfacing Indonesia's tech talent in one public directory — limited strictly to public-facing professional career information, which listed individuals already present publicly in a professional context;
• Consent for submissions (given by submitting the nomination form); for accounts, profile claims, owner edits and Showcase content (given by signing in and publishing the content yourself); and for analytics (given by accepting the consent banner). You may withdraw consent at any time — for analytics, by declining or clearing your consent choice in the browser; for claims and content, by asking us to remove your claim, account data or Showcase items.

We balance our legitimate interest against the rights of listed individuals by publishing only professional information, linking each profile to the person's own LinkedIn presence, and honouring removal requests without conditions (Section 8).

5. How we use the data

Exclusively to operate the directory: rendering profile pages, enabling specialty/city filtering, and generating standard web metadata (search-engine and social-sharing markup). We do not sell personal data, use it for advertising, or send marketing communications to listed individuals.

6. Sharing, processors, and international transfers

The site is hosted on Google Firebase (Hosting, Authentication, Cloud Firestore for profile and claim data, and Cloud Storage for Showcase images) and proxied through Cloudflare (DNS, CDN and TLS). With your consent (Section 2d), aggregate usage data is processed by Google Analytics. Fonts are served by Google Fonts and JavaScript libraries by jsDelivr. These providers act as processors/infrastructure providers and may store or process data on servers located outside Indonesia. Where personal data is transferred outside the jurisdiction of the Republic of Indonesia, we do so in line with the UU PDP's cross-border transfer provisions (Articles 55–56), relying on the recipient jurisdictions' and providers' data-protection safeguards and contractual commitments.

To defend against spam and abuse, the site is protected by Google reCAPTCHA Enterprise, which collects hardware and software information and sends it to Google for analysis. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

7. Retention

Directory profiles remain published while the individual is listed in the Grid, and are deleted upon removal (Section 8). Nominations are retained in our review queue as long as needed to evaluate and maintain the listing, then deleted. We retain no visitor data of our own.

8. Your rights under the UU PDP

If you are listed in the directory (or otherwise have personal data processed by us), you have the rights granted by the UU PDP, including to:

• obtain access to the personal data we hold about you;
• rectify inaccurate or outdated information;
• have your data deleted — we will remove your profile from the Grid, our data files and our repository upon request, without requiring a reason;
• object to or restrict processing;
• withdraw consent where processing is based on consent.

To exercise any right, email [email protected] from an address or account that lets us reasonably verify you are the person concerned (e.g. a message via the LinkedIn profile linked on your page). We will acknowledge requests within 3×24 hours and complete profile removals within 7 calendar days. You also have the right to lodge a complaint with Indonesia's data protection supervisory authority once operational, and to other remedies provided by the UU PDP.

9. Security and breach notification

The site is served exclusively over HTTPS; profile data contains only information already public elsewhere; access to our systems is restricted to the operator. In the event of a personal data breach, we will notify affected data subjects and the competent authority in writing within 3×24 hours of becoming aware, as required by Article 46 of the UU PDP.

10. Children

The directory lists working professionals and is not directed at children. We do not knowingly process children's personal data.

11. Changes

We may update this policy as the service or the law evolves. The "last updated" date above reflects the current version; material changes will be noted on this page.

12. Contact

Questions, requests, or complaints: [email protected].