Privacy Policy

Last updated: 19 April 2026

This policy explains what information Alwinet Attendance (“the app,” “we”) collects, how it’s used, and your choices. It covers the mobile app with package id id.alwinet.attendance, distributed to employees of PT Alwinet for the purpose of recording work attendance.

1. Summary (plain English)

• Alwinet Attendance is an internal employee tool. You sign in with your NIK (employee ID) and password provided by your employer.
• When you check in or check out, the app records your GPS coordinates and takes a selfie photo to verify your presence at the assigned work location.
• Attendance records and selfie photos are stored on our backend (Supabase) and are visible to your employer’s HR team.
• The app performs anti-cheat checks: it refuses to run on emulators and blocks fake-GPS (mock location) apps.
• Face detection runs entirely on your device (Google ML Kit). Only the final selfie image is uploaded — no biometric template is stored.

2. Information we collect

2.1 Account information

• NIK (Nomor Induk Karyawan — employee ID number), which the app converts internally to an email address (<nik>@employee.alwi.net.id) for authentication.
• Password (hashed and stored by Supabase Auth; we never see the plaintext).
• Employee profile data (name, role, assigned schedule and location) provisioned by your employer.

2.2 Location data

• Precise GPS coordinates (latitude, longitude, accuracy) captured at the moment of check-in or check-out.
• Continuous GPS updates while the check-in screen is open, used to confirm you are within the radius of your assigned work location. These updates are not stored — only the final coordinates at the moment of submission are recorded.
• Reverse-geocoded address text (street name, neighbourhood) fetched from the OpenStreetMap Nominatim service and displayed on-screen. The lookup request contains only the coordinates, not your identity.

2.3 Selfie photos

• A front-camera photo captured during each check-in and check-out.
• The image is compressed on-device before upload (JPEG quality 70, resized to fit within 640 px).
• Uploaded to the Supabase Storage bucket attendance-photos and linked to the attendance record.

2.4 Face detection (on-device only)

Before capture, Google ML Kit Face Detection analyses the live camera stream to confirm a face is present, positioned correctly, and sufficiently lit. This analysis runs entirely on your device; no camera frames or facial feature data are sent anywhere. Once you tap capture, only the resulting JPEG photo is uploaded.

2.5 Device information (anti-cheat)

• We use device_info_plus to check whether the app is running on a physical device. Emulators are refused.
• We check the OS-reported “mock location” flag on every GPS update. If fake-GPS is detected, submission is blocked.
• No device fingerprint, IMEI, or hardware serial is collected or transmitted.

2.6 Attendance records

Each successful check-in or check-out creates a record containing: employee ID, schedule ID, timestamp, GPS coordinates, photo URL, status (on time / late / early), and optional notes. These records are stored in the attendance_records table of our Supabase project.

3. How we use the data

• Verify employee presence at the assigned work location.
• Compute attendance status (on time, late, early) against each employee’s shift schedule.
• Provide your employer’s HR team with attendance reports.
• Enforce anti-cheat rules to protect the integrity of the attendance record.

4. Data we do NOT collect

• Contacts, SMS, call logs, calendar, or other apps’ data.
• Photos or files outside of the selfie you explicitly capture in the app.
• Background location when the app is closed.
• Advertising identifier. The app contains no ads and no third-party analytics SDKs.

5. Who sees your data

• Your employer’s HR and management — full access to your attendance records, photos, and locations.
• App administrators (xpdev, acting as data processor for PT Alwinet) — administrative access for maintenance and support.
• Supabase (our backend provider) — hosts the database, auth, and storage infrastructure. See the Supabase Privacy Policy.
• Google ML Kit — runs on-device; no data leaves your phone.
• OpenStreetMap Nominatim — receives GPS coordinates only, to return a street address.

6. Your choices

• Decline permissions — if you refuse camera or location permission, the check-in feature cannot function. You can grant or revoke these at any time in Android Settings.
• Uninstall — removes the app and any locally cached data. Attendance records already submitted remain on the backend.
• Data access / deletion — employees with an active employment relationship should contact their HR team for records access. Former employees or anyone else with a deletion request can email us at the address below.

7. Data retention

Attendance records and photos are retained for as long as required by Indonesian labour regulations and your employer’s record-keeping policy. After an employee leaves the company, records may be kept for up to 24 months before deletion, unless a longer period is required by law.

8. Security

Data in transit is encrypted via HTTPS/TLS. Data at rest is protected by Supabase’s row-level security policies, which restrict each employee to viewing only their own records. The attendance-photos storage bucket is served via signed public URLs scoped to each employee’s folder.

9. International transfers

Supabase runs on cloud infrastructure that may include servers outside Indonesia (typically Singapore). By using the app you consent to this transfer for the purpose of providing the service.

10. Children

This app is intended solely for adult employees of PT Alwinet. We do not knowingly collect data from anyone under 17.

11. Changes to this policy

We may update this page when we add features or change providers. The “Last updated” date at the top of the page reflects the most recent revision. Material changes will be announced through the app.

12. Contact

Questions, requests to delete data, or anything else:
[email protected]