Tickat is an internal project-tracking and team-communication tool operated by PT BC Card Asia Pacific ("BC Card AP", "we"). It is available as a web application and as mobile applications for Android and iOS.
Tickat is not a consumer product. Accounts are created and assigned by a BC Card AP administrator; nobody can sign up for Tickat on their own. Everyone who uses Tickat does so as an employee, contractor, or authorised partner of BC Card AP or of a company we work with, in the course of their work.
This policy explains what the application handles, why, and what we do not do with it.
Created for you by an administrator, not by you:
bcrypt hash of your password. We never store the password
itself and cannot recover it — only reset it.This is work content. It belongs to BC Card AP and is visible to colleagues according to the project and company permissions an administrator has set.
These exist to protect the account. They are not used to measure or monitor how productive anyone is.
When you allow notifications, the mobile app registers a device token with us, together with the platform (Android or iOS) and the device name your phone reports. We use it to deliver notifications to that device and nothing else. Signing out removes it.
Tickat has voice, video, and screen sharing. Audio and video travel between participants in real time. Calls are not recorded. No audio, video, or screen content is stored on our servers.
No advertising. No tracking. No analytics.
The Tickat mobile app contains no advertising SDK, no analytics SDK, and no third-party crash-reporting SDK. We do not sell, rent, or share your information with anyone for advertising, and nothing in Tickat builds a profile of you.
We also do not collect your location, your contacts, your calendar, your call log, your SMS messages, or any file on your device that you have not explicitly attached.
If you turn on fingerprint or face unlock, your biometric data never reaches Tickat. It stays in the security hardware of your phone, and the operating system tells the app only whether the check passed. We cannot read it and never receive it.
The app asks for the camera and microphone only for calls, voice notes, and photos you choose to attach. It asks for file access only when you pick a file to attach. Each is used at the moment you use the feature and at no other time. You can refuse any of these and still use the rest of Tickat.
| Purpose | What it uses |
|---|---|
| Running the service — showing your issues, chats, and projects | Account, work content |
| Signing you in and keeping the account safe | Password hash, sessions, IP address, device identification string, audit log |
| Telling you something needs you | Push device token, notification records |
| Calls between colleagues | Real-time audio and video, not stored |
Our basis for handling this is the employment or contractual relationship between you and BC Card AP, and our legitimate interest in operating and securing an internal work tool.
Your work content is visible to colleagues who have access to the same project or company inside Tickat, as configured by an administrator. Administrators can see account records and security logs.
Beyond that, we share information only with the service providers that run the application:
| Provider | Purpose |
|---|---|
| Amazon Web Services (Asia Pacific — Jakarta) | Application servers, database, and file storage |
| Google Firebase Cloud Messaging | Delivering Android push notifications |
| Apple Push Notification service | Delivering iOS push notifications |
These providers act on our instructions. We do not sell your information, and we do not share it with advertisers or data brokers.
We will disclose information if the law requires it, or to protect the rights and safety of BC Card AP and the people who use Tickat.
Data is stored on Amazon Web Services infrastructure in the Asia Pacific (Jakarta) region. Traffic between the app and our servers is encrypted in transit using HTTPS and secure WebSockets; the mobile app refuses unencrypted connections in its released builds. On your phone, your session credentials are kept in the operating system's secure storage — the Android Keystore or the iOS Keychain.
Work content is kept for as long as BC Card AP needs it as a business record. Security audit logs and session records are kept for a limited period for security purposes. When an account is deleted, records tied to that person are removed or disconnected from them, while work content they created may be retained as part of the project's history.
Tickat accounts are provisioned and removed by BC Card AP administrators; you cannot create or delete one yourself. To have your account and its associated personal data deleted, contact your BC Card AP administrator or write to the address below. We will act on the request unless a legal or business-record obligation requires us to keep something, and we will tell you if that is the case.
You can ask what we hold about you, ask for it to be corrected, or object to how it is handled, using the contact address below.
Tickat is a workplace tool. It is not directed at children and is not offered to anyone under 18. We do not knowingly handle information belonging to a child.
If we change this policy we will update the date at the top of this page. Material changes will also be announced inside the application.
Questions about this policy, or requests about your information:
PT BC Card Asia Pacific
Email: dev@bccard-ap.com