Unofficial — not a school app

Unofficial

Privacy policy

Jejak Langkahku is made by rieProjects. It is an unofficial Android app for parents who already have a GagasCeria / Masche Academic portal account. This page says what data the app touches. I do not run a server that stores user data.

Not a school app

No tie to GagasCeria or Masche Academic. Their names are here so you know which service it connects to.

Who it is for

Parents or adult guardians. Not for children under 13 as users. Student records come from the school’s system. I do not collect them separately.

What stays on the phone

  • The portal email and password you type to sign in at https://gagasceria.masche-academic.com. Encrypted on the phone so you are not asked every time.
  • Student profile, class, behavior notes, comments, photos, attendance, and notifications. Downloaded from the school portal. May stay on the phone if the signal drops.
  • A family name and role (Mama/Papa, for example) if you fill it in. On the phone only. Not sent to me.
  • The camera is only for scanning a QR code when you move a session to another phone. Photos are not uploaded.

Gmail and Google Limited Use

You can skip the Email tab. If you connect it, the app asks for https://www.googleapis.com/auth/gmail.modify and email: read the message list, open bodies and attachments, mark as read. The Gmail address must match the portal login. Tokens stay on the phone. You can move the session with a PIN; the camera is only for scanning that import QR.

Limited Use: Gmail data is only for the in-app email feature. Not sold, not used for ads, not given to anyone else except Google for sign-in, and not used to train general AI. This follows the Google API Services User Data Policy, including Limited Use.

Read Google’s API user data policy

Other services

The app talks to these directly. Their rules apply on their side:

  • GagasCeria / Masche Academic portal: login and school records.
  • Google Sign-In and Gmail, only if you connect email. See Google’s Privacy Policy. Google
  • No Firebase Analytics, AdMob, or ad trackers.

What the data is for

To show the portal in the app, keep it available offline, let you share a note card, and — if connected — read school Gmail on the phone. There is no user dashboard on my server.

Where it lives

On your phone. Sign out, clear app data, or uninstall and the local copy is gone. I do not keep a copy on a server.

How we protect sensitive data

Sensitive data includes your portal password, Gmail OAuth tokens, Gmail messages and attachments, and the student records the app shows. Security procedures are in place to protect the confidentiality of your data. I use encryption to protect your information, as follows.

  • In transit: the app connects to the school portal and to Google only over HTTPS (TLS). Credentials, tokens, and Gmail content are not sent over unencrypted HTTP.
  • At rest on the phone: portal password and Gmail access and refresh tokens are encrypted with AES-GCM. Encryption keys are wrapped with RSA-OAEP in the Android Keystore. They are not saved in plain text. I do not store them on any server.
  • Access: there is no user database on my side. I cannot read your Gmail or portal password. Google user data stays on your phone except when the app calls Google’s Gmail API for the in-app email feature.
  • If you move a session to another phone, the QR payload (credentials and Gmail tokens) is encrypted with AES-256-GCM and a PIN you choose. The QR expires after 15 minutes.
  • Cached Gmail and school records stay in the app’s Android sandbox. Sign out, clear app data, or uninstall deletes the local copy. Disconnect Gmail in the app or revoke Jejak Langkahku in your Google Account to stop API access.

If you share

The note card goes through Android’s share menu to the app you pick. That is your choice, not an automatic upload to me.

Contact

For privacy questions, email dev@rieprojects.com

Last updated: September 2026