Privacy Policy

muncak.id is operated by Laboratorium Industri, Universitas Jenderal Soedirman (UNSOED), Purwokerto, Indonesia. The laboratory acts as the data controller for all personal data processed through this site.

This policy follows Indonesian Law No. 27 of 2022 on Personal Data Protection. For visitors from the European Economic Area and the United Kingdom, we also apply the principles of the General Data Protection Regulation (GDPR).

muncak.id is a non-commercial research project. We never sell, rent, or trade your personal data.

Account data. When you register or sign in we store your name, username, email address, bio, and profile photo. If you sign in with Google, that data comes from your Google profile.

Login origin. After you sign in, our server resolves your IP address into a country and city name and stores only that country and city — the IP address itself is never saved. The lookup repeats at most once a week, and tells us which regions our users come from.

Trail visit statistics. To count how many hikers viewed a trail in the last seven days, we store a salted SHA-256 hash of your IP address and browser. The hash cannot be reversed into your identity, and the original IP address is not stored.

Sessions. While a session is active, Laravel stores the session identifier along with an IP address and user agent for security purposes. These records expire with your session.

Content you submit. Trail reviews, article submissions, and Live Cam chat messages are stored alongside your account name and displayed publicly where relevant.

What we do not collect. We never request precise location from your device, and we run no Google Analytics, advertising pixels, or comparable cross-site trackers.

Cookies are small files stored by your browser. muncak.id uses only the cookies genuinely required for the site to work: keeping you signed in, remembering your theme, and securing forms.

We set no advertising cookies, no analytics cookies, and no cross-site tracking cookies. Because every cookie we use is strictly necessary, we show a notice rather than ask for consent — essential cookies are exempt from the consent requirement. If we ever add analytics or advertising, we will ask for your consent before those cookies are set.

You can delete or block cookies through your browser settings. Note that blocking session cookies will make signing in impossible.

Some pages load resources from other providers' servers. We list them in full below, including what each provider receives.

Worth underlining: Google Fonts loads on every page, so your IP address is sent to Google servers in the United States on every page view. We are preparing to self-host the typefaces to remove that transfer.

muncak.id acts as an identity provider (OAuth) for the companion apps bekal.muncak.id, rekomendasi.muncak.id, and tiket.muncak.id. If you choose to sign in to one of those apps with your muncak.id account, it receives your name, username, email address, and profile photo — only after you approve it on the authorization screen.

Beyond that, we share your personal data only where required by law or by a lawful request from a competent authority.

Account data is kept for as long as your account exists. When an account is deleted, its reviews and article submissions are deleted with it.

Trail visit hashes are kept for at most 365 days, then automatically deleted. Popularity itself is computed from only the last 7–14 days.

Session records end with your session, or when you sign out.

Rejected article submissions remain in your profile history until you delete them.

You have the right to request a copy of your personal data, correct inaccurate data, request erasure, restrict or object to certain processing, receive your data in a portable format, and withdraw any consent you have given.

Several of these you can exercise directly: name, username, bio, and profile photo are editable on your profile page, and you can delete your own reviews and article submissions.

For anything else, email the address at the end of this document. If you believe we have mishandled your data, you have the right to lodge a complaint with the competent data protection supervisory authority.

muncak.id is not directed at children under 13, and we do not knowingly collect their personal data. If you are a parent or guardian and believe your child has created an account, contact us and we will delete it.

All site traffic runs over HTTPS. Passwords are stored hashed, never in plain text. Access to the administration panel is restricted by user role.

No system is entirely secure. If a personal data breach occurs that poses a risk to you, we will notify you as required by applicable law.

We may update this policy as the service evolves. The last revision date always appears at the top of this page. For substantial changes, we will post a more prominent notice on the site.