Privacy policy

Effective September 28, 2026. This policy explains how anflip handles personal data under Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "PDP Law").

Data we collect

Account owners

• Name, email, and password (stored as a hash that no one can read). If you sign in with Google, we receive your name, email, and profile photo from Google.
• The files you upload and your flipbook settings.
• Plan and payment history: plan, amount, status, and the payment method reported by Midtrans. Card details never reach us.
• Your language choice, so our emails use the same language.

Flipbook readers

• Anonymous reading statistics: pages opened, reading time, link clicks, device type, and country (from Cloudflare). We do not store readers' IP addresses for statistics and use no tracking cookies; each browser tab gets a random session ID.
• Data readers enter themselves in a lead form (for example, name and email). This data belongs to the flipbook owner; anflip only stores it on the owner's behalf.
• Abuse reports: the report and a hash of the reporter's IP address, to stop repeated false reports.

How we use data

• To run the service: sign-in, converting PDFs, showing flipbooks, and computing statistics for flipbook owners.
• To send important emails: verification codes, team invitations, plan-ending reminders, and security notices.
• To process payments and meet bookkeeping obligations.
• To keep the service secure and prevent abuse.

We do not sell personal data and do not use it for advertising.

Third parties

We only share what is needed with the providers that help run anflip:

• Cloudflare: network, security, and storage of flipbook files.
• Midtrans: payment processing.
• Google: sign-in with Google, and Google Sheets if you connect it.
• Mailchimp: only if you connect it to send leads.
• Google Analytics: only on flipbooks whose owner added their own Google Analytics ID.
• An email delivery provider for emails sent by anflip.

The application servers are in Indonesia. Flipbook files are stored in Cloudflare R2 and served through Cloudflare's global network.

Cookies and browser storage

We only use cookies the site needs to work:

• anflip_session: keeps you signed in (httpOnly, 30 days).
• NEXT_LOCALE: your chosen language.
• anflip_guest: the flipbook you tried before signing up (24 hours).
• anflip_fb_*: access to password-protected flipbooks you unlocked.

The viewer also remembers in your browser whether you filled in or skipped a lead form, so it does not keep appearing.

How long data is kept

• Account data: while the account is active. When an account is deleted, its account, team, and flipbook data is deleted immediately, and the files follow within minutes.
• Flipbooks you delete: files are kept for 30 more days, then deleted for good.
• Unclaimed uploads made without an account: deleted after 24 hours.
• Reader statistics: 400 days.
• Payment records: kept as long as tax regulations require, no longer linked to a deleted account.

Your rights

Under the PDP Law you may access, correct, and delete your personal data, and withdraw consent. Most of this you can do yourself in Dashboard → Account (change name, email, password, or delete the account). For anything else, contact us. Readers who want their lead form data deleted can contact the flipbook owner, or us if the owner does not respond.

Security

Connections are always encrypted (HTTPS), passwords are stored as hashes, sign-in tokens can never be read by JavaScript in the browser, and integration tokens are stored encrypted. If a data breach affects you, we will notify you as the PDP Law requires.

Changes

We announce important changes by email or in the dashboard before they take effect.

Contact

Questions or requests about personal data: halo@anflip.id. See also our terms of service.