Legal

Privacy Policy

We take your privacy seriously. This policy explains what data we collect, how we use it, and how we protect it.

Last updated: January 2024

1. Introduction

Coxa (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our productivity and task management platform (the “Service”), accessible at coxa.web.id.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

We collect information that you provide directly to us and information that is automatically collected when you use the Service.

2.1 Account Information

When you register for an account, we collect:

  • Full name — to personalize your experience and identify you within your team
  • Email address — used exclusively for account verification, service notifications, and security alerts
  • Password — stored as a salted, one-way hash (bcrypt); we never store or have access to your plain-text password
  • Organization/Company name (optional) — to tailor team features for your business

2.2 Usage Data

We collect information about how you interact with the Service:

  • Tasks created, assigned, completed, or archived
  • Projects, boards, and workflow configurations
  • Comments, file uploads, and team interactions
  • Feature usage patterns to help us improve the product

2.3 Communication Preferences

We record your notification settings, email preferences, and whether you have opted in or out of specific communication types.

2.4 Technical Data

Automatically collected data includes:

  • IP address — used for rate limiting, abuse prevention, and security monitoring
  • Browser type and version — to ensure compatibility and diagnose issues
  • Device information (operating system, screen resolution) — for user experience optimization
  • Login timestamps and session data — for security auditing and suspicious activity detection
  • Referring pages and exit pages — to understand how users discover and navigate our Service

3. How We Use Your Email Address

Your email address is a critical part of your account identity and security. We use it for the following purposes only:

  • Account verification — a confirmation email is sent upon registration to verify ownership of the email address. These emails are delivered via Amazon Simple Email Service (SES).
  • Password reset requests — we send a secure, time-limited password reset link when requested
  • Security alerts — we notify you of suspicious login attempts, password changes, email address changes, and other account security events
  • Task and project notifications — such as task assignments, approaching deadlines, and @mentions. These are only sent if you have explicitly enabled them in your notification settings.
  • Service announcements — infrequent, important updates about the Service (e.g., changes to terms, planned maintenance, new critical features)

What We DO NOT Do

  • We do not send unsolicited marketing or promotional emails
  • We do not sell, rent, trade, or otherwise share your email address with third parties
  • We do not use purchased, rented, or third-party email lists
  • We do not send commercial newsletters unless you explicitly opt in separately

4. Data Storage & Retention

Your data is stored on secure, access-controlled servers with industry-standard physical and network security measures.

  • Active accounts: Data is retained for as long as your account remains active
  • Inactive accounts: We may reach out after 12 months of inactivity. Accounts inactive for 24 months may be permanently deleted after notice.
  • Account deletion: Upon your request, your account and all associated personal data are permanently deleted within 30 days. Certain information may be retained in encrypted backups for up to an additional 60 days before being fully purged.
  • Legal obligations: We may retain certain data if required by applicable law or to comply with legal processes

5. Data Security

We implement and maintain appropriate technical and organizational security measures to protect your data:

  • Encryption at rest: Data is encrypted using AES-256 encryption
  • Encryption in transit: All connections use HTTPS with TLS 1.2 or higher. We enforce HSTS (HTTP Strict Transport Security).
  • Password hashing: All passwords are hashed using bcrypt with a unique per-password salt
  • Access controls: Strict role-based access controls limit data access to authorized personnel only
  • Regular audits: We conduct regular security audits and vulnerability assessments
  • Monitoring: 24/7 monitoring for suspicious activity with automated alerting

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we continuously work to maintain the highest standards.

6. Your Rights

You have the following rights regarding your personal data:

  • Access: You can request a copy of the personal data we hold about you at any time
  • Correction: You can update or correct inaccurate information through your Account Settings or by contacting us
  • Export: You can export your tasks, projects, and account data in a portable format
  • Deletion: You can request deletion of your account and all associated data (see Section 7)
  • Communication preferences: You can manage which emails and notifications you receive in your Account Settings at any time
  • Opt-out: You can withdraw consent for non-essential data processing where applicable

To exercise any of these rights, please contact us at support@coxa.web.id. We will respond within 30 days.

7. Account Deletion

You can delete your account at any time through your Account Settings page. Upon deletion:

  • Your account is immediately deactivated and you will no longer be able to log in
  • Your personal data is permanently deleted from our active systems within 30 days
  • Data may remain in encrypted backups for up to 60 additional days before complete removal
  • Any data you have shared with team members (e.g., task comments, project contributions) may remain visible to your team in an anonymized form (attributed to “Deleted User”)
  • If you are the sole owner of a team/organization, you must transfer ownership or delete the organization before deleting your account

8. Cookie Policy

We use cookies and similar technologies to provide and improve the Service. For detailed information about the cookies we use, how we use them, and how you can manage your preferences, please read our full Cookie Policy.

In summary: we use only first-party cookies — essential cookies for authentication and security, preference cookies for settings, and analytics cookies for anonymous usage data. We do not use third-party advertising or tracking cookies.

9. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We are committed to working with you to resolve any privacy concerns fairly and transparently.