Privacy Policy
Kerja Tracker
Effective 30 September 2026
Kerja Tracker ("Kerja") is a delivery board for studio work: projects, work items, chat, proof and documents. It runs on the web at kerja.nurikhwanidris.my and as a mobile app for iPhone and Android. This policy explains what Kerja stores about you, why, who else handles it, how long it is kept, and what you can ask for.
Who runs Kerja
Kerja is operated by Nur Ikhwan Idris Abdul Rahman, an individual developer in Malaysia. For anything about your data, write to [email protected].
Kerja is used by a studio and the clients it works for. If your account was created for you by a studio or a client organisation, that organisation decides what goes into its projects. We handle that content on its behalf.
Who can use Kerja
Kerja has no public sign-up. Every account is created by invitation from someone who already runs a project. Kerja is meant for adults using it for work, and is not directed at children under 13.
What we collect
Account details
- Your name, email address and role (owner, staff or client).
- Your password, stored only as a one-way hash. We cannot read it.
- A profile picture, if you upload one.
- Your notification preferences.
What you create
- Projects, work items, acceptance criteria, comments, docs, intake issues, sprints and time entries.
- Chat messages, reactions and the rooms you belong to.
- Files and photos you attach as proof, in chat or on a doc.
- Sign-offs and approvals you give, with the time you gave them.
Sign-in and security records
- Each sign-in attempt: the time, the outcome, the IP address, the device's user agent, and whether it came from the web, the mobile app or an API token.
- An activity history of changes to items and projects, showing who changed what and when.
- Short-lived request diagnostics used to find and fix errors. These are deleted automatically after 72 hours.
Mobile app
- A push notification token from Apple or Google, so Kerja can send notifications to your phone. It identifies the app installation, not you personally.
- Your sign-in token is kept in the phone's secure storage (the iOS Keychain or Android Keystore).
- Camera and photo library access are used only when you choose to take or pick a photo to attach. Kerja does not read your photos in the background.
What we do not collect
- No advertising identifiers, no advertising, and no third-party analytics or tracking.
- No location data.
- No contacts, calendar or health data.
- We do not sell or rent your data, and we do not share it for advertising.
Patient and sensitive data
Kerja is not a clinical system. Projects for clinics and hospitals must never contain patient names, identity card numbers, record numbers, diagnoses or any other patient data. If such data is found, it is removed.
How we use it
- To run the service: sign you in, show you the projects you belong to, deliver messages and store your files.
- To notify you about mentions, direct messages, assignments and the daily digest, by push notification or email, as your preferences allow.
- To keep accounts safe: spot repeated failed sign-ins and investigate misuse.
- To fix errors and keep Kerja running.
- To produce the delivery reports and proof ledgers that project members ask for.
We use your data only for these purposes.
Who else sees it
People on your projects
Everyone on a project can see its items, comments, files and chat in the rooms they belong to. A project manager can share a proof ledger with a client through a signed link. Anyone holding that link can view the ledger and the proof files in it, without signing in.
Service providers
Kerja relies on these companies to run. Each handles data only to provide its service.
| Provider | What it does | What it handles |
|---|
| Cloudflare, Inc. | Network protection and delivery; file storage (R2) | All web traffic; uploaded files and pictures |
| Google LLC (Firebase Cloud Messaging) | Delivers push notifications | Push tokens and the text of each notification |
| Apple Inc. (Apple Push Notification service) | Delivers notifications to iPhones | Push tokens and the text of each notification |
| Resend | Sends email | Your email address and the email content (invitations, password resets, digests) |
When the law requires it
We may disclose data if Malaysian law, a court order or a lawful authority requires it.
Where it is stored
The database and application run on a server in Malaysia. Uploaded files are stored with Cloudflare R2. Cloudflare, Google, Apple and Resend may process data in other countries, including the United States, under their own safeguards.
How long we keep it
- Account details and your work: for as long as your account is active, then as described under "Deleting your data".
- Request diagnostics: 72 hours.
- Database backups: encrypted, kept for 14 days, then deleted.
- Push tokens: removed when you sign out of the app, or when Apple or Google report the token is no longer valid.
How we protect it
- All traffic uses HTTPS.
- Passwords are hashed. Sign-in tokens are stored in secure device storage.
- Backups are encrypted.
- Access to the server is limited to the operator.
No system is perfectly secure. If a breach affects your data, we will tell you without undue delay.
Your choices and rights
Under Malaysia's Personal Data Protection Act 2010, you may:
- Ask for a copy of the personal data Kerja holds about you.
- Ask us to correct data that is wrong. You can also change your name, email and profile picture yourself under Account.
- Ask us to delete your account and personal data.
- Turn notifications off for each kind of event under Account, or turn off push notifications in your phone's settings.
Write to [email protected] from the email address on your account. We reply within 21 days.
Deleting your data
To delete your account, email [email protected] from the address on your account, or ask your project manager. We will:
- Deactivate your account at once, so no one can sign in with it.
- Delete your name, email, profile picture, push tokens and sign-in records within 30 days.
- Keep work you contributed to shared projects, such as comments and proof, so the project record stays whole. Tell us if you also want your name removed from it, and we will replace it.
Backups roll over within 14 days after that.
Changes to this policy
When this policy changes, we update the effective date at the top. If the change is significant, we tell active users in Kerja or by email before it takes effect.
Contact
Nur Ikhwan Idris Abdul Rahman
Email: [email protected]
Support: kerja.nurikhwanidris.my/support