Community guidelines

Patepang only connects people who have met in person. Treat people on Patepang the way you do when you are face to face. These guidelines apply to everything you send or show: messages, updates, moments, contact cards, profile photos, plans, invitations, circle questions, and event room boards.

1.1 Why these guidelines exist

Patepang has no people search, no adding friends, no invitation links, and no contact import. Connections are only made by a tempel: one phone shows a code, the other phone scans it, then the two phones are shaken together. So you yourself choose whom you connect with, and you can disconnect at any time.

Meeting in person does not guarantee that someone can be trusted. Someone you have met can still bother, defraud, or threaten you, and because you know each other, the consequences can reach the real world. These guidelines set the same limits for everyone, and are the basis on which moderators decide on reports.

1.2 What we can do, and what we cannot

Messages, updates, moments, photos, and files are end-to-end encrypted, so we do not monitor content. These guidelines are enforced through reports: a recipient reports problematic content, then moderators read the copy that the recipient's phone sealed (sections 16 to 18). The server still knows some things, for example which account did a tempel with which account and when (see the Privacy policy).

Sanctions apply to accounts, not to content that is already on other people's phones: we cannot delete content from anyone's phone. A blocked account cannot be used while its block stands, and a new account starts without connections: each of its connections has to be made again through a tempel.

1.3 Who they apply to

These guidelines apply to everyone who uses Patepang, including the hosts and co-hosts of event rooms, and group admins. These guidelines also apply to nicknames, statuses, group names, room names, and calls, even though some of these cannot be reported yet (section 16), and to how you use Patepang when you meet people. What Indonesian law prohibits is also prohibited on Patepang, even if it is not mentioned here.

These guidelines are part of the Terms and conditions.

Every connection on Patepang begins with a meeting. The full guide is on the Safety page.

• You decide whom you do a tempel with. Show your code only to someone who is in front of you and whom you want to connect with.
• A tempel does not use your phone's location. The person you do a tempel with gets your nickname, and your profile photo if you have set one. Your contact card and your birthday only reach them if you share them.
• If you are going to meet someone you do not know well yet, choose a busy place and tell someone you trust where you are going. You can also share a temporary location with one conversation you choose, for 15 minutes, 1 hour, or 8 hours.
• If shaking together does not work, someone else may help by shaking both phones at once.
• A connection made through a request in an event room starts limited, only the name and the event card, until you do a tempel directly. A host can let in people who are not present, so a connection made through a room does not prove that the person was there.

What is not allowed:

• forcing, pressuring, or threatening someone into doing a tempel, showing their code, or connecting again after they disconnected;
• using someone else's phone without their permission to do a tempel in their name;
• using someone's status, invitation to meet, or shared location to stalk them or to show up uninvited;
• using a meeting made through Patepang to defraud, extort, or hurt people.

What is not allowed on Patepang, in the eight categories that moderators use:

Harassment

Bullying, insulting, or persistently bothering someone who does not want it, including attacking people for who they are.

Fraud

Defrauding or extorting, posing as someone else or as Patepang, or luring people into giving away their PIN and six words.

Threats

Threatening to hurt someone or people close to them, including threatening to spread their private data or images.

Child sexual content

Anything that depicts or involves children sexually.

Violence

Encouraging, planning, or celebrating violence against people.

Intimate images without permission

Sending or spreading someone's intimate photos or videos without their permission.

Spam

Unsolicited mass messages or repeated promotions.

Other

Other things that break the law or endanger people, for example selling prohibited goods.

You also must not fake a tempel, create accounts in bulk or with automated programs, buy or sell accounts, or get around account limits.

Sections 4 to 15 explain each category with examples of what is not allowed and what is. The examples are not a complete list: moderators judge the content and its effect, not particular words. The rules are the same in one-to-one conversations, groups, updates, moments, and event rooms.

When you report, you choose one of these eight categories. Each section below names the closest category. If in doubt, choose Other and explain in the note. Moderators may use another category if it fits the content better.

4.1 Threats

A threat is still a threat when it is wrapped in a joke, made conditional, or aimed at someone's family. What is not allowed, for example:

• threatening to hurt, kill, or come after someone, for example “I know where you live. I'm coming tomorrow, and you'll be sorry.”;
• threatening to spread someone's personal data, photos, videos, or secrets if they do not do what you want, for example pay, get back together with you, or withdraw their report;
• veiled threats that show you are watching someone, for example naming the time and the road they usually take;
• threatening to report someone to the police, their workplace, or their family with false accusations so that they do what you want.

What is allowed, for example: expressions of annoyance between friends that are clearly not serious, such as “Watch it, if you're late again I'm leaving without you”, and telling someone that you will report what they actually did to the police.

When you report, choose Threats. If the threat is to spread intimate images, choose Intimate images without permission.

4.2 Violence

What is not allowed, for example:

• calling on people to attack someone or a group, including organising a street brawl (tawuran) or a mob beating;
• planning violence, for example handing out tasks, setting a time, or preparing weapons;
• praising the perpetrators of an attack, or celebrating the harm done to its victims;
• sending gruesome images or videos of violence to frighten, humiliate, or shock people;
• filming violence that you commit, then sharing it.

What is allowed, for example: sharing news about violence, condemning or discussing it, telling about violence you have experienced, and talking about self-defence. Before you share images of violence to inform people, say first what they show, and do not send them to people who did not ask for them.

When you report, choose Violence.

4.3 Dangerous organisations

You must not support groups that use or plan violence against people, such as terrorist groups, violent extremist groups, and organised crime groups. For example: praising or defending their actions, spreading their propaganda or videos of their attacks, recruiting members, raising funds, or helping them coordinate.

What is allowed: reporting on, researching, discussing, and condemning such groups, and telling about your experience of leaving one.

When you report, choose Violence, or Other if no violence is called for or celebrated.

5.1 Harassment and bullying

Moderators judge whether the content is aimed at a particular person, and whether it keeps happening after that person has made clear they do not want it. What is not allowed, for example:

• insulting, belittling, or humiliating someone, including mocking their body, face, or circumstances;
• continuing to send messages, invitations to meet, or calls after the person has asked you to stop or has not responded;
• creating a group or using an event room board to mock someone, or getting others to gang up on them;
• spreading gossip or accusations that you know are untrue to bring someone down;
• unwanted sexual comments, advances, or requests;
• creating a new account, or getting other people to pass on your messages, after someone has disconnected from you.

What is allowed, for example: disagreeing, and criticising someone's opinions or actions politely, joking with friends who enjoy it as much as you do, ending a friendship, and telling about bad treatment you have experienced to find support.

When you report, choose Harassment.

5.2 Hate, including SARA

Attacking people for who they are is harassment, for example for their ethnicity, religion, race, or social group (in Indonesia known together as SARA), or for their sex, disability, illness, or age. What is not allowed, for example:

• using slurs for someone's ethnicity, religion, race, or group;
• comparing a group of people to animals, disease, or filth;
• calling a group inferior, dangerous, or unfit to live;
• calling for people to be driven out, boycotted, or shunned for their ethnicity, religion, race, or group;
• calling for violence against a group (section 4).

What is allowed, for example: talking about religion, culture, or history with respect, disagreeing about beliefs or policies without attacking people for who they are, quoting hate speech to condemn or report it, and telling about discrimination you have experienced.

When you report, choose Harassment, or Violence if there is a call for violence.

6.1 Sexual content

What is not allowed, for example:

• sending sexual photos, videos, stickers, or messages to people who did not ask for them, also as view-once media;
• continuing to send sexual content after the person has refused or has not responded;
• posting sexual content where people who did not ask for it see it, such as updates to all connections, groups, or event room boards;
• offering, asking for, or brokering paid sexual services;
• anything that involves children (section 7).

[Sexual content between consenting adults in private conversations, and its limits under Indonesian law: awaiting the owner's decision and review by legal counsel]

Before you send an intimate image, also as view-once media, remember that an image that has reached someone else's phone is in their hands. Screenshots are prevented while view-once media is open, but the screen can still be photographed with another phone.

When you report unwanted sexual content, choose Harassment.

6.2 Intimate images without permission

Permission to receive an intimate image is not permission to spread it. What is not allowed, for example:

• forwarding an ex-partner's intimate photos or videos to a group or to other people;
• sharing images taken secretly, for example in a bathroom, a changing room, or a bedroom;
• sharing intimate images edited or made with AI to look like a particular person;
• demanding money, more images, or sex under the threat of spreading intimate images (sexual extortion).

If this happens to you, do not pay and do not send more images. Report each of the messages with the category Intimate images without permission, save evidence (section 22), then contact the police. If you are in immediate danger, call 112.

7.1 Child sexual content: zero tolerance

A child is anyone under 18. What is prohibited without exception includes:

• photos, videos, pictures, cartoons, or writing that depict children sexually, also those made or edited with AI;
• talking about a child's body sexually, or asking for photos or videos of children for sexual purposes;
• approaching a child for sexual purposes, for example by coaxing them, giving them gifts, or asking them to meet;
• extorting a child with images of them;
• forwarding such content, also to warn other people or as evidence.

If you receive such content, do not forward it, save it, or photograph it. Report it in the app with the category Child sexual content, then disconnect if you need to. If a child is in immediate danger, call 112.

Reports with this category are handled in a special way. If one verified report in a case uses this category, the moderator console shows the content of none of the reports in that case and does not download their media. The moderator checks that the evidence is verified, proposes a block with the reason code child sexual content, and tells the moderator coordinator on the same day. The evidence of a case that ends in a block is kept for as long as the block stands. Reporting to the authorities is done by the owner of Patepang, not by the moderator.

[Handling of child sexual content, the sanctions for it, and reporting to the authorities: awaiting review by legal counsel]

7.2 The age limit of 18

Patepang is only for people aged 18 and over. When you create an account, you tick I am 18 or older. Your age itself is not asked and not stored, and the server never receives anyone's age. What is not allowed:

• creating or using an account if you are under 18;
• helping a child create an account, for example by being their first tempel or their sponsor.

If you suspect that one of your connections is under 18, report one of their pieces of content with the category Other, and explain in the note.

[Steps against an account suspected of belonging to someone under 18, and age checks beyond the person's own statement: awaiting the owner's decision and review by legal counsel]

You must not use Patepang to traffic people, or to exploit people through force, deception, or debt bondage. What is not allowed, for example:

• recruiting people for forced labour, including well-paid job offers abroad that turn out to trap people into working for scams;
• holding on to someone's documents, wages, or phone so that they cannot leave;
• offering or brokering people for sexual exploitation;
• selling or buying babies, children, or human organs.

What is allowed: discussing and reporting on human trafficking, warning people about fake job offers, and telling about your experience as a survivor.

When you report, choose Other, or Child sexual content if children are involved sexually. If someone is in immediate danger, call 112.

You may talk about your feelings, also when things are hard, ask for help, and tell about your recovery. What is not allowed is encouraging people to hurt themselves, for example:

• telling, daring, or taunting someone to hurt themselves or to take their own life;
• giving methods or instructions for self-harm or suicide;
• praising or celebrating people who hurt themselves;
• encouraging people to follow dangerous eating patterns, for example not eating for days.

If someone writes that they want to hurt themselves or end their life, take it seriously. Ask how they are, listen, and encourage them to seek help from someone they trust. If they are in immediate danger, call emergency services at 112, and if you can, ask someone close to them to stay with them. A report to the moderators does not bring quick help.

[Mental health support services that Patepang refers people to: awaiting the owner's decision]

When you report content that encourages people to hurt themselves, choose Other.

You must not sell, buy, offer, or arrange the sale of goods and services that the law prohibits, also when the payment happens outside Patepang. For example:

• narcotics, psychotropic drugs, and prescription-only medicines without a prescription;
• firearms, ammunition, explosives, and weapons for attacking people;
• online gambling, including spreading its links or promotion codes;
• counterfeit money, stolen goods, and forged documents such as identity cards (KTP), driving licences (SIM), diplomas, or doctor's notes;
• protected wildlife, or parts of it;
• other people's personal data, accounts, or services for breaking into accounts and systems.

What is allowed, for example: talking about these topics without offering anything, such as news, experiences, or how to get free of an addiction, and selling lawful goods to people who actually want to buy them (without spam, section 13).

When you report, choose Other.

11.1 Fraud and extortion

What is not allowed, for example:

• asking for money with a false story, such as a relative who had an accident, the “mama minta pulsa” (mum needs phone credit) scam, or a prize that has to be paid for before it is released;
• offering investments, rotating savings groups (arisan), or loans with promises of sure profits, then running off with the money;
• selling goods that are never sent, or charging fees for job vacancies;
• sending links or files, for example .apk files disguised as invitations, delivery receipts, or bills, to steal accounts, data, or money;
• asking for other people's OTP codes, bank PINs, or passwords;
• extorting someone by threatening to spread their data, photos, or secrets.

What is allowed, for example: selling lawful goods honestly to people who want to buy them, politely asking for a debt to be repaid, and raising help for a genuine need.

11.2 Impersonation

What is not allowed, for example: claiming to be your friend who has “a new phone”, a public figure, an official, or a company, or Patepang and its moderators, and using someone else's name or photo to deceive. Using a nickname that is not your real name is allowed, as long as it is not used to deceive.

Patepang never asks for your PIN, six words, or key file, by message, by email, or in any other way. Official notices from Patepang in the app are in Settings, Notices from Patepang.

11.3 Taking over someone else's account

A Patepang account is recovered through guardians: two of its three guardians do a tempel with the account owner's new phone. What is not allowed, for example:

• posing as an account owner who has lost their phone, to talk their guardians into a recovery tempel;
• luring someone into scanning your code to link your device to their account;
• using someone else's phone without their permission to read, send, or change anything in their account.

If you are someone's guardian, show the recovery code only when the person is in front of you with their new phone (Guardians).

When you report, choose Fraud.

You must not spread other people's personal data or private content without their permission. What is not allowed, for example:

• sharing someone's home address, phone number, workplace, school, a photo of their identity card (KTP), their national identity number (NIK), or their financial data to harass or humiliate them (doxxing);
• sharing screenshots of someone's private conversation to humiliate them;
• telling other people where someone is or when they are alone, so that they can be confronted;
• sharing photos or videos of someone taken secretly in a private place;
• revealing someone's secrets, such as their health, without their permission.

Spreading other people's personal data without the right to do so can also break Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (Law No. 27 of 2022 on Personal Data Protection).

What is allowed, for example: sharing your own data, sharing other people's data with their permission, and handing evidence to the police or a lawyer.

When you report, choose Threats if there is a threat, Harassment if it is used to humiliate, or Other.

13.1 Spam

What is not allowed, for example:

• sending the same promotion to many connections or groups that did not ask for it;
• repeatedly inviting people into multi-level marketing, savings groups, or investments after they have shown no interest;
• filling an event room board with advertisements unrelated to the event;
• using automated programs to send messages, updates, or requests;
• adding people to a group in order to sell to them.

What is allowed, for example: telling your connections once about your business, answering people who ask, and the organisers' announcements in their own event room.

When you report, choose Spam.

13.2 Chain messages and false information

You can forward a message to at most 5 connections at once, and the recipients see the label Forwarded. If content you forwarded is reported, you are recorded as the author of that copy. Check before you forward startling news, especially about health, disasters, or people's safety. Forwarding chain messages to many people who did not ask for them is spam.

[Harmful false information, for example about health, disasters, or elections, as a violation of its own: awaiting the owner's decision and review by legal counsel]

13.3 Fake tempels

A tempel is a sign that two people met. What is not allowed, for example:

• sending your code by message, photo, or video call so that someone who is not near you can scan it;
• practising the shake's rhythm from a distance, for example over the phone, so that two phones apart seem to be shaken together;
• using modified apps, emulators, or other tools to imitate the shake, the code, or the app's authenticity check;
• doing a tempel again from a distance so that a connection does not fade or to get extra storage.

What is allowed: asking someone else to help by shaking both phones at once, when the two of you meet.

13.4 One person, one account

One person uses one account, with at most 3 active devices, and one phone can create at most 3 accounts in a calendar month. What is not allowed, for example: creating several accounts for yourself, creating accounts to sell or rent out, using someone else's account or sharing one account with someone else, and resetting a phone or using other ways to get around these limits.

13.5 Sponsors

If a person's phone cannot be checked for authenticity through Apple or Google, their account can only be born through a tempel with an account that has already done a tempel with at least 10 different people. That account becomes their sponsor. One account can sponsor at most 5 new accounts in a calendar month; the host of a birthplace at most 50.

What is not allowed: sponsoring accounts that you know are fake, made to be sold, or made for someone whose account is blocked. The consequences for sponsors are in section 19.

13.6 Evading sanctions

You must not create or use another account to evade a block, a suspension, or a restriction. A blocked account can still appeal from the app (section 20).

13.7 Interfering with the service

You must not disrupt, overload, or break into the Patepang service, except for good-faith security research as described on the Security page. Vulnerabilities are reported to [email protected].

14.1 Event rooms

An event room is open for at most 7 days, and is opened by a host who has done a tempel with 20 different people. The host chooses at most 10 co-hosts from people who have done a tempel with them, and participants enter by doing a tempel with an organiser's phone at the venue. The host can remove participants, who then cannot enter that room again, and can close the room at any time. After the room closes, the server deletes its participants, cards, requests, and board.

For hosts and co-hosts, what is not allowed, for example:

• letting in people who are not present at the venue;
• opening a room to collect connections or to bring accounts to birth for people who did not come;
• using announcements for spam, or to mock someone or expose their data.

For participants, the board, event cards, and requests to connect must not be used for spam, harassment, or fraud.

Board posts and event cards can be reported like any other content. To report the room itself, choose Report this room, then choose the organisers' announcement or card that you want to report. A room's name cannot be reported on its own, because it carries no signature of its author.

14.2 Birthplaces

A birthplace is an open room for a first tempel, with a public schedule for each city that does not name its host. If the phone of someone who comes cannot be checked for authenticity, the organiser who does a tempel with them becomes their sponsor (section 13.5).

What is not allowed, for example: opening a birthplace to bring to birth fake accounts, accounts to be sold, or accounts for people who did not come, and charging money to bring an account to birth.

If you go to a birthplace, come at the listed time. Entering the room does not make a personal connection with the host.

[Guidelines for birthplace hosts, for example the place and time of meetings: awaiting the owner's decision]

14.3 Groups

A group holds at most 50 people. In the app, only admins add members, and only people they have done a tempel with. Members you have never met appear as Member followed by four characters of their account id, marked Never met. Admins can remove members and delete messages for everyone, which then appear as Deleted by an admin. Any member can leave a group at any time.

What is not allowed, for example:

• adding people to a group to bother, mock, or sell to them;
• creating a group to organise harassment, fraud, or violence;
• exposing other members' personal data to people outside the group.

A message that was shown and then deleted by an admin can still be reported by its recipients for up to 30 days from when it arrived.

Only send content that you made yourself or that you are allowed to share. What is not allowed, for example:

• sharing pirated films, music, books, software, or courses, or links to download them;
• selling counterfeit goods that carry someone else's brand;
• passing off someone else's work, such as photos or writing, as your own.

What is allowed, for example: sharing your own work, quoting as much as needed and naming the source, and sharing links to official sources.

Because content is end-to-end encrypted, we only know the content that its recipients report. More on the Intellectual property page. When you report, choose Other.

16.1 The steps

1. In the app, select the problematic content, then Report.
2. In What is the problem?, choose one of the eight categories (section 3). No category is chosen for you.
3. If you want, write a Note for the moderators: what happened, in your own words, at most 500 characters.
4. Choose the language of the content, so that your report reaches moderators who read that language. If none fits, choose Other language or no words, which any moderator reads.
5. Press Send report.

One report carries one piece of content. If several messages are problematic, report each one; reports about the same account go into the same case. There are no other attachments: what you send is only the content you selected, the category, and your note.

16.2 What can be reported

You can report messages, photos, updates, contact cards, profile photos, plans, invitations to meet, circle questions, moment content, room posts, and event cards from other people that have already appeared on your phone. You cannot report your own content.

• Content that has already appeared on your phone can still be reported for up to 30 days from when it arrived on your phone, even if its sender has deleted it or the message has disappeared.
• Such a message appears as Message deleted without its content, with Report beside it. View-once media can be reported from its viewer, or after it is closed, from the Opened bubble. A group admin who deletes a message is offered Report first.
• Content that never appeared, for example a message deleted before you opened its conversation, cannot be reported.
• Photos are deleted from the server once all their recipients have fetched them. Moderators can then only read the caption, if there is one.
• 24-hour statuses, nicknames, group names, room names, and calls cannot be reported on their own yet. If someone uses them to break these guidelines, report other content from them and explain in the note, or disconnect.
• While travel mode is on, reports are hidden.

Only a recipient can report a piece of content, because only the recipient's phone holds that content together with its author's signature. That is why a story told by email cannot replace a report in the app. [How people who do not use Patepang can report, for example someone whose images are being spread: awaiting the owner's decision]

16.3 What is sent, and what is not

• Your phone seals a copy of that content for the moderators, together with a signed statement from the author of that content. The server cannot read it.
• Your category and note are sealed with it, for the moderators only. The note is padded to a fixed size, so the server also does not learn whether there is a note or how long it is.
• The server sees the account you report, the type of content, the language you chose, and its author's statement, and records the report with its hour only.
• The server does not store who the reporter is, and the person you report is not told who made the report.
• When it receives a report, the server knows the account and the device that sent it, only to count the daily limits; neither is stored with the report.
• Nothing else from your phone goes with it: no other messages, no connection list, and not your location.

16.4 One case for one account

• Reports about one account are combined into one case. One account can send at most 10 reports a day, and one device 20.
• A new report goes into that account's case that is still open. Once that case has been decided, or its proposed block is waiting for a second moderator, the next report opens a new case.
• There is no limit on how many reports can be made about one account, so false reports from many accounts cannot push genuine reports aside.

16.5 Following your report

With the report's receipt, you can follow the status of the case and its decision. The receipt is only kept on your phone, and its status is in Settings, Your reports:

Waiting for a moderator

No moderator has decided yet. The person you reported is not told.

Under second review

The case is being reviewed by a second moderator before it is decided.

Action taken

The moderators took action against the sender's account, with the decision and its reason.

No action taken

The moderators took no action on this report.

Under appeal

The account owner has appealed, and another moderator is reviewing it.

Case closed

The moderators have decided, and the case is closed. If there was an appeal, its outcome cannot be seen from here.

Case no longer exists

The server no longer keeps this case, for example because the reported account has ended.

The app reads these statuses only when you open Your reports, with the receipts alone, without signing in as your account.

16.6 Reporting honestly

Only report content that you believe breaks these guidelines. Moderators decide on the content as signed by its author, not on the number of reports or on the category the reporter chose, so a report on its own does not get anyone sanctioned.

Patepang's moderators are human. At launch, there are at least three moderators who read Indonesian. The moderator list is signed by two of the three root key holders, and each moderator can open only the evidence sealed for them, in the moderator console.

The root key holders are the owner of Patepang and two trusted people. The app only accepts a list signed by two of the three root keys built into the app, and never a list older than one it has already accepted, so the server on its own cannot add a moderator to read reports too. Each moderator signs in to the console with their own key, which never reaches the server.

17.1 What moderators see

• a copy of the reported content, exactly as it appeared on the reporter's phone;
• its author's statement: account id, device, content type, the fingerprint of its content, and the time it was created;
• the language the reporter chose, the category they chose, and their note if there is one;
• other reports about the same account that joined the case, each with its content, category, and note;
• the reported account's key chain, which shows which devices belong to that account and whether its author's device has been revoked;
• earlier decisions in that case.

Images and videos appear grey and blurred until the moderator chooses to see them clearly, and videos and audio do not play by themselves. Moderators are asked to open media only when the words, the caption, and the reporter's note are not enough to decide, and media can only be opened while it is still on the server. For reports in the category child sexual content, the content is not shown at all (section 7).

17.2 What moderators do not see

• messages, updates, or other content that has not been reported;
• who made the report;
• anyone's IP address;
• connection lists, names on your phone, or your location.

Every time a moderator signs in, reads a case, or makes a decision, the activity is recorded in the audit log. Content is never scanned automatically: the server cannot read it in the first place.

The audit log is hash-chained, and every hour its size and latest hash are signed into the head of the key transparency log, which is public.

17.3 Looking after moderators

Reported content can be hard to bear. The moderator console reminds moderators to take a break every 30 minutes, limits a session to 2 hours and then asks for a 15-minute pause, and has a greyscale mode for the whole screen. Moderators can change these numbers, but only within limits that keep them protected.

[Counselling for moderators: awaiting the owner's decision]

18.1 Checking the evidence

Before showing any content, the console checks every report: its evidence is still stored on the server and opens with that moderator's key, its author's statement belongs to the reported account, the content is the same as what the author stated, and the statement matches the account's key chain as proven in the transparency log. If one step fails, the evidence is refused and its content is not shown. Refused evidence must not be the basis of a sanction.

The console can confirm that the content was really written by the reported account, but it cannot confirm the reporter's story. The reporter's category and note are the reporter's story, not evidence, and moderators compare them with the content. Content from a device that was revoked later remains valid, but moderators are asked not to impose a heavy sanction on such content alone without other reports that support it: whoever holds that device after its revocation can still sign content with an earlier date.

18.2 Weighing

Moderators choose the decision and its reason code themselves; the console chooses nothing for them. They weigh, for example, whether the content is aimed at a particular person, whether it is repeated, whether a threat is clear and could be carried out, whether there is danger now, whether money, data, or codes are being asked for, whether the person in an image did not consent, and whether other reports that joined the case are also verified. No decision is taken automatically.

[Levels of sanction for first, repeated, and serious violations: awaiting the owner's decision]

18.3 A block needs two moderators

Decisions other than a block take effect at once. A block is always proposed first, then a second moderator applies it or chooses another decision instead. The moderator who proposed it cannot apply their own proposal.

18.4 Emergency block

In an emergency, the owner of Patepang can block an account first. An emergency block takes effect at once without waiting for a second moderator, but only on a case about that account that is still open or waiting for a second moderator. It must carry a reason code and a written reason, is recorded in the audit log, and can be appealed like any other decision.

18.5 Written reasons

Every decision comes with a written reason of 1 to 1000 characters. The reason for any decision other than a dismissal is read by the account owner and the reporter; the reason for a dismissal is read by the reporter only. Moderators are asked not to write names or hints about the reporter, and not to quote private content more than needed.

A block is publicly visible in the account's key chain, so other people's apps show that the key has been blocked for a violation. Event rooms that the account opened are closed.

Every decision other than a dismissal is sent by notification, with a reason code and a written reason that the account owner can read in the app. The reporter can read the same decision through their receipt, without the evidence and without anyone's name. [Target time for reviewing reports: awaiting a decision]

The reported person is not told that there is a report. They only learn of it when moderators take a decision other than a dismissal, and they never learn who made the report. The decisions about your account, with their reasons and how long they last, are in Settings, Your reports, under Decisions about your account.

19.1 Consequences of sanctions

• A suspension also restricts: while it lasts, the account cannot create groups or event rooms.
• While a block stands, the server refuses the account's tempels, room entries, and requests in rooms, refuses messages for it, and no one can start a new conversation with it. The account cannot be recovered through guardians, and its owner cannot delete it early; an account that is not used for 12 months is still deleted by itself.
• Once they learn of the block, other people's apps stop showing new messages from that account, and say This person's account is blocked when they try to send to it.
• If a block is overturned through an appeal, the account can be used again, and other people's apps accept its messages again. Event rooms that were already closed are not reopened.

19.2 When there are several decisions

Each case is decided on its own. If several decisions are in force at the same time, their consequences apply together, and an appeal that is granted lifts only that decision's sanction. A block stands as long as even one block decision is still in force.

19.3 Consequences for sponsors

An account three of whose sponsored accounts are blocked within a year can no longer be a sponsor. An account that is blocked cannot be a sponsor either. This limit exists so that sponsors cannot be used to bring many fake accounts to birth.

19.4 How long cases are kept

A dismissed case is closed at once. Other cases are closed 30 days after the decision if there is no appeal, or once the appeal has been decided. When a case closes, the author's statement and its sealed evidence are deleted, except while its block still stands. The case record, that is the reported account, the decision, the written reason, and the appeal status, is kept for as long as the reported account exists. Deleting an account also deletes the cases about it.

You can appeal once for each case, within 30 days after the decision, from the moderation status in the app. A dismissed report cannot be appealed. An appeal is reviewed by a moderator who was not involved in the first decision. If the decision is overturned, its sanction is lifted.

20.1 How to appeal

1. Open Settings, Your reports. Under Decisions about your account is each decision with its reason.
2. On the decision you want to contest, press File an appeal, then confirm.

You can also appeal while your account is blocked. An appeal carries no written explanation: the reviewing moderator reads the case's evidence again. [The chance to write an explanation when appealing: awaiting the owner's decision]

20.2 While the appeal is reviewed

The sanction stays in force until the appeal is decided, and the case's evidence stays stored. Your reports says Your appeal is being reviewed by another moderator. The reporter sees the status Under appeal. [Target time for reviewing appeals: awaiting a decision]

20.3 The outcome

The reviewing moderator took no part in the case at all, also not as the proposer or the second moderator of a block. They uphold the decision or overturn it; without verified evidence, a decision cannot be upheld. You are told by notification, and Your reports says Your appeal was granted: this decision is overturned. or Your appeal was rejected: this decision stands. After that the case is closed and cannot be appealed again.

The reporter does not see the outcome of the appeal: their receipt keeps showing the original decision.

If you still disagree, see how disputes are settled in the Terms and conditions.

What we publish about moderation, so that others can check it (see Transparency):

• The moderator list: moderator ids, public keys, and the languages they read, without names or emails, signed by two of the three root key holders.
• A transparency report every half year, from daily counts that name no one's account: reports received by language, moderation decisions by type, appeals by outcome, requests from the authorities and the government, security incidents, and policy changes forced by outside parties. The first report comes out after the launch.
• Every version of these guidelines, at an address of its own on legal.patepang.com.

What we can and cannot hand over when the authorities ask for an account's data is explained in Requests from law enforcement authorities and the government. The evidence in reports can only be read by moderators, not by the server.

[Handling of government orders to cut off access to content or accounts, under Peraturan Menteri Komunikasi dan Informatika Nomor 5 Tahun 2020 (Regulation of the Minister of Communication and Informatics No. 5 of 2020): awaiting review by legal counsel]

• Disconnect: that person can no longer send you anything, and to connect again the two of you have to do a tempel in person. You choose whether to keep the conversation (read-only, behind the PIN) or to delete it. They are not told. In a group you share, their new messages do not appear on your phone, but your messages in the group still reach them. Messages from a conversation you keep can still be reported for up to 30 days from when they arrived; a deleted conversation can no longer be reported. There is no separate block button: disconnecting also blocks.
• Report first and Save evidence: before disconnecting, you can report and save the conversation as a file together with the statements of its authors, for the police or a lawyer. The file holds the text of the conversation with its times, without photos and without the content of messages already deleted. The file is not encrypted, so keep it safe.
• Hide your updates, status, and birthday from someone without disconnecting, without notification. In Privacy for … on their profile, you can also hide your contact card and profile photo from them, and mute them: their updates and messages still come in without notifications.
• Emergency lock, if one of your devices is lost or taken by force: from a device you still hold, all other devices are removed, then device linking, guardian changes, and recovery are refused for 72 hours. Messages for you still come in. A recovery that is waiting is cancelled, and the messages and updates you send are held on that phone until the emergency lock ends. Only the phone that set it can end it early.
• Travel mode: before you go through an inspection or lend your phone, seal Patepang's content on that phone with six words that only you write down. If the six words are lost, the sealed content cannot be opened again by anyone (Travel mode).
• Lock a conversation from Conversation info, so that it only opens with the PIN and shows no previews.
• Disappearing messages and view-once media leave fewer traces on the recipient's phone, but both are promises of the app, not guarantees: the recipient can still photograph the screen with another phone.
• Guardians: choose people you truly trust and can meet in person. If you do not want your account to be recoverable through guardians at all, turn on Dead lock (Guardians).

More on the Safety page.

If someone is in immediate danger, call emergency services at 112. Patepang does not monitor content and cannot send help.

• If you are threatened, extorted, or your images are being spread: save evidence, report each piece of content, disconnect if you need to, then contact the police.
• If a child is in danger: call 112. If the danger shows in sexual content, report that content with the category Child sexual content without forwarding or saving it (section 7).
• If you meet someone and then feel unsafe: go to a busy place, contact someone you trust, or call 112.
• If your phone is taken or lost: set the emergency lock from another device you still hold (section 22).

When a moderator reads content that shows someone is in danger now, they contact the moderator coordinator at once, and the owner of Patepang can block the account immediately. [Who contacts emergency services about such a report, and through which channel: awaiting the owner's decision]

When you create an account, you agree to the terms and conditions and to these guidelines. The app records the version you agreed to on your phone only; that record is not sent to the server. If these guidelines change, the version of the app that carries the change asks for your agreement again when it opens, marked Updated. If you do not agree, you can export your data and delete your account.

[Notice before changes to these guidelines take effect, and how long before: awaiting the owner's decision and review by legal counsel]

Questions about these guidelines: [email protected], or call +62 851-6101-1651.

Every version that is published stays at its own address. The address without a date, legal.patepang.com/community-guidelines, shows the version in force. While this document is a draft, both addresses show the draft.