Privacy Policy.
ENTERPRISE SECURITY STANDARD • GOOGLE API LIMITED USE DISCLOSURE • SSL 256-BIT ENCRYPTED
01. Introduction
Welcome to siramount (operated at https://siramount.site, hereinafter referred to as “siramount”, “we”, “us”, or “our”). siramount is an independent mountaineering navigation, GPS tracking directory, and hiking community platform for Indonesian peaks.
We are strictly committed to respecting and protecting the privacy of our users. This Privacy Policy outlines our transparent policies regarding the collection, use, storage, disclosure, and protection of information when you access or use our website, services, APIs, and community tools.
Application Identity Information:
- Application Name: siramount
- Official Website: https://siramount.site
- Developer & Support Contact: [email protected] / [email protected]
- Last Updated: October 1, 2026
02. Information We Collect
We only collect the minimum amount of personal data necessary to provide reliable, secure, and accurate mountaineering information:
A. Google User Data (OAuth Single Sign-On)
When you authenticate into siramount using your Google Account (“Sign in with Google”), we access the following basic profile information provided directly by Google OAuth 2.0:
- Google User ID: A unique numeric string used to identify your session.
- Full Name: Used to display your public climber profile on reviews and stories you submit.
- Email Address: Used as your primary account identifier and for account-related notices.
- Profile Picture URL: Used to display your avatar across your expedition posts.
Note: We do not receive, store, or process your Google account password. All authentication tokens are managed securely through cryptographically encrypted sessions via NextAuth.js.
B. User-Generated Content & Community Data
- Mountain reviews, star ratings, difficulty feedback, and hiking photos you voluntarily upload.
- Expedition stories and field journals you choose to share.
- Climbing Partner notices (“Cari Teman Mendaki”), including phone/WhatsApp contact information you explicitly and voluntarily choose to provide for team coordination.
- Personal mountain wishlists and bookmark items.
C. Technical & Security Data
- Public IP address (received via Cloudflare proxy headers solely for anti-abuse, brute force protection, and rate limiting).
- Browser user-agent, operating system, and timestamp logs for server diagnostics and debugging.
03. How We Use Your Information
We use the collected information strictly for the following purposes:
- Authentication & Account Management: To verify your identity, maintain secure login sessions, and protect your account from unauthorized access.
- Service Delivery: To display your reviews, route photos, and expedition journals to fellow climbers on the platform.
- Safety & Team Coordination: To connect mountaineers through the voluntary “Cari Teman Mendaki” coordination board.
- Platform Security & Abuse Prevention: To prevent cyberattacks, automated bot spam, SQL injection, and API abuse via server rate limiting (200 requests/minute).
- Direct Communications: To respond directly to your customer support inquiries or critical security notices.
04.Google API Services User Data Policy & Limited Use Disclosure
siramount's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In full compliance with Google's Limited Use requirements, siramount affirms the following commitments:
- No Sale of Google User Data: siramount does not sell, lease, rent, or trade Google user data to any third party, data broker, advertising exchange, or marketing agency under any circumstance.
- No Advertising Use: siramount does not use or transfer Google user data for serving advertisements, including personalized, retargeted, or interest-based advertising.
- No Lending or Credit Evaluation: Google user data is never used for determining creditworthiness, lending eligibility, or background screening.
- Human Access Restrictions: siramount does not permit human beings to read user data obtained from Google APIs unless:
- You have given your explicit, affirmative agreement for specific troubleshooting or user support;
- It is necessary for security purposes (such as investigating security vulnerabilities, bugs, or system abuse);
- It is required to comply with applicable laws, government regulations, or valid legal processes; or
- The data is aggregated and anonymized for internal technical operations.
- Data Minimization: We only request and access the minimal Google OAuth scopes (email, profile, openid) necessary to authenticate your identity.
05. Data Storage, Retention, and Security
We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
- Encryption in Transit: 100% of network traffic between your browser and our servers is encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS 256-Bit SSL).
- Password Hashing: Passwords for credentials-based users are salted and hashed using high-cost
bcryptalgorithm. Raw passwords are never stored. - Database Security: Our PostgreSQL database is hosted behind firewalled networks with strict role-based access control and regular automated backups.
- Session Protection: Authentication tokens are stored in secure, HTTP-only, SameSite cookies to protect against Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF).
06.User Rights, Data Deletion, & Revoking Google Access
You retain complete ownership and control over your personal data at all times. In accordance with global privacy principles (including GDPR and Indonesian PDP Law No. 27/2022), you have the right to:
- Access and Update: You may view and edit your profile name and avatar at any time via your User Profile page.
- Delete Account and Data: You may request the permanent deletion of your account and all associated data (including reviews, stories, and login records). To request data deletion, email our data privacy team at [email protected] with the subject “Data Deletion Request”. Your request will be fulfilled within 7 business days.
- Revoke Google Access: You can instantly revoke siramount's access to your Google account at any time through your Google Security Settings at: https://myaccount.google.com/permissions.
07.Third-Party Service Providers & Data Processors
To deliver our interactive mountaineering features, real-time weather forecasts, high-resolution GIS topographic maps, and secure infrastructure, siramount integrates with trusted third-party service providers. We strictly ensure that these providers adhere to stringent security standards:
- Google LLC (Google OAuth 2.0): Used solely for secure user authentication and single sign-on. Data received is strictly subject to the Google API Limited Use Policy.
- Cloudinary Ltd.: Cloud CDN for user-submitted hiking documentation, trail checkpoint photos, and avatar image optimization.
- Unsplash Inc.: Licensed editorial mountain photography for catalogue cover illustrations.
- Mapbox, Inc.: Interactive 3D terrain elevation engine (DEM) and high-resolution satellite tiles for virtual mountain previews.
- OpenStreetMap (OSM) Contributors: Open-access global geospatial street and trail baseline map data.
- OpenTopoMap: Topographic contour line tiles and mountain elevation shaded reliefs.
- Esri (ArcGIS World Imagery): High-resolution aerial satellite imagery tiles for trail tracking inspection.
- Open-Meteo: Real-time high-altitude weather forecasts, summit temperature, wind speed, and precipitation warnings.
- BMKG (Badan Meteorologi, Klimatologi, dan Geofisika): Official real-time Indonesian earthquake and seismic monitoring feeds.
- PVMBG (MAGMA Indonesia): Official Indonesian volcanic activity status and mountain alert levels.
- Cloudflare, Inc.: Global Anycast DNS, SSL/TLS 1.3 termination, DDoS protection, edge caching, and Web Application Firewall (WAF).
- PostgreSQL Database Infrastructure: Encrypted relational storage for mountain routes, trail checkpoints, and verified user accounts.
- Meta Platforms, Inc. (WhatsApp):Voluntary click-to-chat links provided for team coordination on the “Cari Teman Mendaki” board and user support.
Data Privacy Guarantee: Third-party map, weather, and geohazard services receive only anonymized geographic coordinates (latitude and longitude) required to render tiles or retrieve forecasts. Your personal account identity, email, and Google OAuth credentials are NEVER shared with these providers.
08. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our designated privacy officer:
+62 831-4430-3789
https://siramount.site