Privacy policy

Patepang is operated by PT Pakuan Teknologi Pangrango, with its address at Jl. Cihideung Udik RT 004/RW 009, Desa Cihideung Udik, Kecamatan Ciampea, Kabupaten Bogor, Jawa Barat 16620, Indonesia, registered under business identification number (NIB) 2810260094182 (registration as an electronic system operator (PSE) will follow before Patepang is launched). In this policy, “we” means that entity. We are the personal data controller for the data processed by the Patepang server.

This policy applies to the Patepang app and to the patepang.com site and its subdomains, such as legal.patepang.com and help.patepang.com. Patepang has not launched yet: this policy describes how the service processes data once it is running. This policy only comes into force after it has been reviewed by legal counsel. This policy does not apply to other parties’ services that you use alongside Patepang, such as the App Store, Google Play, your phone’s system, or a maps app; each processes data under its own policy (section 8). Nor does this policy cover job applications: we do not accept applications yet, and before we do, we will publish a privacy notice for applicants.

Questions and requests about personal data: [email protected]. Data protection officer: the company’s director, via the same email address.

2.1 Terms used in this policy

Personal data

Data about a person who is identified or identifiable, alone or combined with other information, under Indonesia’s Personal Data Protection Law, Law No. 27 of 2022 (UU PDP). We treat account ids and the data linked to them as personal data, even though they contain no name.

Controller and processor

A personal data controller decides the purposes and means of processing data; for the data on the Patepang server, that is us. A processor processes data on a controller’s behalf, like the providers in section 8.

Account and account id

Your account is a cryptographic key made on your phone. The account id is the fingerprint (SHA-256) of your first device’s public key, and contains no name, phone number, or email.

Device

A phone that holds your account’s keys. Each device has its own number and its own keys, and an account has at most 3 active devices.

Key chain

A public, append-only record of your account’s devices, guardians, and recovery settings. Each of its entries is signed twice, with Ed25519 and ML-DSA-65, by one of your devices or by the recovery enclave.

Key transparency log

A public, append-only record of the key chain entries of all accounts, with a signed summary every hour, so that anyone can check that keys are not swapped secretly.

Tempel

The only way to connect: one phone shows a QR code, the other scans it, then both phones are shaken together for about two seconds. Its variants: a retap without shaking for a pair that has done a tempel before, a tempel without signal, a tempel to enter an event room, connection requests between room participants witnessed by the enclave, and a recovery tempel with guardians.

Birth and sponsor

An account is born at its first tempel. An account created on a phone that cannot give proof of app authenticity from Apple or Google can only be born through a tempel with another account, which becomes its sponsor.

Enclave

An isolated environment on the server whose code can be proven. The tempel enclave matches shakes and witnesses tempel certificates; the recovery enclave signs account recoveries and the end of inactive accounts.

Tempel certificate

The proof of a tempel, signed by both phones and by the witness in the tempel enclave.

Connection

A person who has done a tempel with you.

Guardians

Three people who have done a tempel with you, or two if you have done a tempel with exactly two people, whom you choose to recover your account. Two guardians are enough.

Recovery

Moving your account to a new phone through a tempel with two guardians, with a 48-hour waiting period that can be canceled from your old phone.

Account backup

An encrypted copy of the data on your phone, which the server stores if you turn it on. Its key is split for your guardians.

Envelope

One encrypted message waiting on the server for one recipient device.

Delivery token

A random code that the recipient’s phone makes for one connection, so that connection can send to its inbox. The server only stores its hash.

Updates, moments, circles, and plans

Updates are daily posts to all connections or to one circle; a moment is the record of a meeting; a circle is a group of connections you put together yourself on your phone; a plan is an invitation to meet. All of them are end-to-end encrypted.

Event rooms and birthplaces

An event room is a temporary room, lasting at most 7 days, which the people present at an event enter through a tempel with the organizers. A birthplace is an event room in a city that appears on a public list, where people who have no connections yet can be born through a tempel with its host.

Server

The Patepang system that stores and forwards data, together with its enclaves. There is now one server region, in Singapore.

Moderator

A person, not a program, who reviews reports with their own key and can only open the evidence sealed for them.

Six words

A phrase your phone makes to open an export file or travel mode. The phrase is not stored anywhere, and we never ask for it.

Most of Patepang lives on your phone and never reaches us. App data is stored sealed with the phone’s hardware key, in a place that is not included in the phone’s system backup.

• Private keys of your account and your devices never leave the phone.
• Your PIN is checked on the phone and is never sent. Patepang never asks for your PIN.
• Your app content: the people you meet and their names, conversations, updates, moments, circles, plans, notes, and settings. All of this leaves the phone in encrypted form: to the people you choose, in the account backup if you turn it on (section 4.7), or in an export file you make yourself. The exceptions are what you take out yourself in unencrypted form: the file from Save evidence (the text of one conversation along with the person’s name, for the police or a lawyer), .ics calendar files from plans, and the names of places you open in a maps app (section 8).
• Your home region (province) is stored only on the phone.
• Your nickname and profile photo are only sent encrypted to people you have met. Your birthday is optional, day and month only, and is only sent to the recipients you choose.
• Evidence for reports: content that has been shown on your phone is kept sealed on the phone for 30 days from when it arrived, even if the sender deletes it, so that you can still report it. That content only leaves the phone if you report it.
• Reminders of plans, of moments from a year ago, and of connections that are fading are scheduled on the phone, without names.
• Your agreement to the terms and conditions, the community guidelines, and this policy, together with your statement that you are 18 or older, is recorded on your phone with the version and the time. That record is not sent to the server and is not included in the account backup; the Transparency screen in the app shows it.
• The widget on the Android home screen, if you add it, reads a small snapshot kept sealed on the phone. Its content, for example the latest update from the person you choose, appears on the home screen and can be seen by anyone who looks at your screen.

The app does not ask for address book permission, and does not read your photo gallery: photos are picked through the phone system’s own picker. You type the names of places in moments and plans yourself. The app asks for camera permission to scan codes and take photos or videos, and for microphone permission to record voice messages, videos, and voice notes in chat, updates, and moments; what is recorded only leaves the phone if you send it, encrypted. Your phone’s location is only read when you share a temporary location or calculate the distance to a location shared with you (section 3.1). The motion sensor is only read during the tempel shake, about two seconds (section 4.2), and notification permission is asked for first (section 4.8).

3.1 Phone permissions the app asks for

Each permission is asked for when you first use its feature, and you can revoke it at any time in your phone’s settings.

3.2 What you take off the phone yourself

Beyond the exceptions above, some of your actions make copies outside Patepang’s protection. Unencrypted copies can be read by other apps, by phone or cloud backups, and by anyone who holds them.

• Save on a photo, video, or moment, and Save to phone in Storage, put an unencrypted copy in your gallery.
• The memory book is an unencrypted PDF made on the phone; the names, photos, and stories of other people who were there are only included if you turn that on. The yearly archive export is sealed like an export file.
• An export file is encrypted and only opens with its six words, but its opener page can save its content as an unencrypted JSON file (section 10.7).
• A deletion code is a file that can schedule the deletion of your account, whoever holds it (section 10.4).
• Files you open in another app through the share sheet are processed by that app under its own policy.

The Patepang server stores the following data. The legal bases given follow Article 20 of UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (Law No. 27 of 2022 on Personal Data Protection).

The data in this section comes from five sources:

From you

What you send or choose yourself: public keys and the changes to your key chain, guardians, the groups and rooms you create or enter, the waiting list city, reports, purchases, emails to us, and encrypted content we cannot read.

Made by the app on your phone

What the app makes to run the service: signatures for signing in, delivery tokens, sealed shake recordings, and a random key per installation for the account limit.

Recorded by the server

Times and dates: when the account was created and born, the date last active, the date each device last signed in, tempel times, the time and size bracket of each envelope, and the already rounded size of media. The country a request comes from, which Cloudflare provides, only goes into daily counts with no account attached.

From other people

The person who does a tempel with you also signs your tempel certificate. Group members can add you to a group, and admins can remove you. Event room organizers let you in through a tempel. Your guardians answer your request and sign statements for your recovery. A sponsor bears your account. Other people’s reports about content from you open a case about your account, which moderators decide.

From Apple and Google

The results of the app authenticity check and the per-phone account limit marker when an account is created, the notification token they make for your phone, and subscription status and tip transactions from the App Store or Google Play.

4.1 Account and devices

The account id (the fingerprint of your first device’s public key), your account’s server region, when the account was created, when the account was born (rounded to 15 minutes), how it was born (attested or sponsored, and the sponsor account if sponsored), the date last active, subscription status, media space used, the deletion schedule if you ask for deletion, emergency lock, and moderation status. For each device: its number, its type, its public key, the date it last signed in, and when it was added or revoked. Signing in uses a signature with the device key, without a password; sign-in tokens are only stored as a hash and are valid for 24 hours.

The server also stores each device’s public keys for starting encrypted conversations, some of them single-use; the media space bonus from second meetings; and whether meeting reminders are on. For an inactive account, the server records the day its 11th-month reminder was sent and the day of its deletion; both are deleted as soon as you are active again. A device that has not signed in for 60 days is marked stale if another device of your account is active, until that device signs in again. While an emergency lock is in force, the server stores until when and which device set it. When a deletion is scheduled, the server stores the closing entry signed by your device, or the one you sent as a deletion code, without recording which. If you cancel it, the server keeps that entry’s hash, 16 at most, until your key chain changes, so that the same code cannot schedule the deletion again.

To run your account: signing in, plan and quota, the account’s birth and end, limits against abuse, and sanctions. Basis: performance of a contract with you (the terms and conditions), and legitimate interests in preventing abuse.

4.2 Tempel

For each successful tempel: the ids of both accounts, the type of tempel, its time (rounded to 15 minutes), its room if it took place in an event room, and the tempel certificate. That certificate contains the time signed by both phones, down to the minute, the device numbers, and the signatures of both phones and of the witness. So the server knows which account has met which account, when, and in what way. The server never receives your phone’s location in a form it can read: a temporary location you share in a conversation passes through the server end-to-end encrypted, like a message (section 3.1). But for a tempel at a birthplace, the server knows the city: the public list of birthplaces names the city of each room, and a tempel there records the room.

The shake recording (2 to 2.5 seconds of motion sensor data) is sealed on the phone for the tempel enclave, that is, an isolated environment whose code can be proven. The server only holds its sealed form and cannot read it. The enclave compares two recordings, discards them, and then returns only its decision. Recordings are only used to match two shakes that happened at the same time, never to recognize people.

While a tempel is taking place, its session data is kept for just a few minutes. A tempel without signal keeps its material for at most 7 days, until it is confirmed. The server also counts how many different accounts you have done a tempel with, for the requirements to create an event room and to become a sponsor.

To show that two people met in person: a tempel is the only way to connect and for an account to be born. A tempel proves that two phones were shaken together, or that two people deliberately worked together from a distance to imitate it (see its limits on the Security page). Basis: performance of a contract.

4.3 Message delivery

Each message is stored as an encrypted envelope for the recipient’s device, together with the recipient’s account and device, its size bracket, and the time it was created. Send requests do not use the sender’s account, so the Patepang server does not record who the sender is, with two exceptions. The first messages after a tempel (at most 20 within 24 hours) are sent with a token tied to that tempel, so the server knows those messages come from the person you did the tempel with. And if you cut the connection on the day you met, the server can infer that from the tempel token your phone revokes.

Envelopes are deleted as soon as the recipient’s device fetches them. Envelopes that have not been fetched stay stored until that device is revoked or its account is deleted; the sender cannot pull them back, not even with “Delete for everyone”.

Delivery tokens are made on the recipient’s phone, one for each connection and direction. The server only stores their hash, linked to the recipient, and deletes revoked tokens 30 days after they are revoked. The timing and size of traffic remain visible to the server. Cloudflare also sees the recipient and the token of every delivery, along with the sender’s IP address (section 8).

Updates and moments are sent to each recipient through a one-to-one session, like messages, with random delays, so the server does not know who is in your circles. While you share a temporary location, your phone sends an update every 30 seconds on a fixed beat, moving or still, so that the timing does not show when you move; the server and Cloudflare only see more frequent envelopes to that conversation. [Location updates in the background on Android, which in the current version are still sent each time you move about 10 meters: awaiting a fix before launch] While your app is connected to its inbox, the server knows that device is connected, to decide whether a notification needs to be sent; that marker exists only in memory, expires by itself, and is not written to disk.

To deliver messages. Basis: performance of a contract.

4.4 Groups

The group id and the account ids of its members, roles (admin or member), who added whom, and the date of joining. This membership is stored on the server without encryption. The group’s name, photo, and messages are end-to-end encrypted: the server only holds them in encrypted form, messages until every member’s device has fetched them, and photos as media (section 4.5). Membership data is deleted when you leave the group. The server also stores the hash of the group token, which an admin replaces after a member leaves or is removed. The date a group was created and the date of joining are stored as the day only. A group’s members can include people you have never met, because every member may invite people they have done a tempel with. To run groups. Basis: performance of a contract.

4.5 Photos, videos, voice, and files

Media is stored encrypted, each item with its own key, which is only sent inside encrypted messages. The server records the object id, a random download key, the account that owns it (for the quota), the size already rounded up inside the encryption, its class (message, update, moment, sticker, backup, or room), and its date. Downloads do not use an account, so the Patepang server cannot link the uploader and the downloader. Cloudflare, which forwards those uploads and downloads, can link the two through IP addresses and the download key (section 8).

Photos sent as photos are re-encoded without EXIF data or location. Files sent as documents are sent as they are, including their metadata, and the app warns about this. Photos in updates, moments, group albums, group photos, and profile photos are also redrawn without location or camera information, videos are redrawn without metadata, and the Send original quality option is still without metadata. Event room albums are being built and will follow; when they are available, their media follows the same rules. To store and deliver media. Basis: performance of a contract.

4.6 Event rooms, birthplaces, and the city waiting list

For event rooms and birthplaces: the host, the type of room, the opening and closing hours, the city for a birthplace, the participants and when they entered, encrypted participant cards, connection requests between participants, and an encrypted board without author names. Cards and the board are encrypted with the room key, which is shared with the participants, not with the server. An account the host removes cannot enter that room again. The list of birthplaces is public: the city and the hours, without the host. All of it is deleted a few minutes after the room is closed, at the latest 7 days after it was opened. An account that has not yet been born may write down one city for the birthplace waiting list; that city is deleted when the account is born or after 90 days. Basis: performance of a contract.

4.7 Guardians, recovery, and account backup

The server records who guards whom and their answers. A recovery stores the new phone’s public key, the signed statements of two guardians, and the time, with a 48-hour waiting period. While a recovery is in progress, your old devices and every account that has done a tempel with you are notified. Recovery data is deleted 8 days after the recovery is complete. The backup key pieces that guardians re-encrypt for your new phone are kept until 7 days after the recovery is carried out, or deleted when the recovery is canceled or fails; pieces that no recovery uses are deleted after 7 days. If you turn on the dead lock, recovery through guardians is turned off and any recovery that is waiting is canceled; that choice is recorded in your key chain, which is public (section 6.1).

Account backup is optional and needs at least two guardians. Your phone encrypts the backup with a new key each time, then splits the key into pieces, each sealed for the phone of one guardian. Two pieces are enough to open the backup. The server stores the backup and those key pieces but cannot open either of them. Photos and groups are not yet included in the backup. Basis: performance of a contract.

Two of your guardians who collude can open the backup without a recovery. A guardian’s app only uses its piece during a recovery tempel, but that is a rule of the app, not a cryptographic limit: with a modified app, two guardians can open the backup secretly, without the 48-hour waiting period and without notifying you. The backup contains the people you meet and their names, conversations, updates, moments, notes, and your connections’ delivery tokens. For that reason, choose guardians you truly trust.

4.8 Notifications

If you allow notifications, the server stores your phone’s notification token from Apple or Google. That token is stored encrypted, but the server decrypts it to send notifications, so the server can read it. Every notification is the same size, 176 bytes, sealed for your phone: only its type and time, with no sender and no content. Apple and Google only know that there is a notification to that device at a certain time. On Android, notifications are received through Google’s Firebase Cloud Messaging SDK inside the app. [Whether that SDK sends notification delivery data to Google: not yet confirmed] Meeting reminders from the server are off until you turn them on. When they are on, the server only stores that they are on: a reminder names no one, your phone itself works out which tempel it is about, and the server keeps no record of the reminders it sent. After a message notification arrives, your phone signs in to the server and fetches the waiting messages, so the server sees when your phone is active.

The token is deleted together with its device or account, or when Apple or Google declares it no longer valid. The token is also deleted if you revoke notification permission: the phone’s system does not tell the app when permission is revoked, so the app checks it every time it is opened and then asks the server to forget the token. The server keeps nothing about that request, and from then on sends no notifications, meeting reminders, or 11th-month reminders to that phone until you allow notifications again. If the server cannot be reached yet, the app tries again and says so in the Notifications settings. Until you open Patepang again after revoking permission, the token stays on the server: the server still keeps it and still sends notifications through Apple or Google, which still see their timing; your phone just does not show them. Basis: performance of a contract, and your consent through the notification permission.

4.9 Subscriptions and tips

For subscriptions: the store where you bought it, a random identifier that links the purchase to your account, subscription status, whether the free trial has been used, and when its access ends. The hash of the subscription id from the store is only kept while the subscription is active, including the free trial and the grace period. We do not store the price, the payment method, the identity of your store account, or receipts. Purchases are checked through Apple’s or Google’s services. That random identifier is also stored at Apple or Google with your purchase, so they can link it to your store account.

Tips are only counted as daily totals; the hash of their transaction id is kept for 30 days to prevent double counting, without the account, amount, or product. Basis: performance of a contract.

4.10 Reports and moderation

When you report something, you choose the language of its content, so that the report reaches a moderator who reads that language. Your phone then seals the reported content for the moderators; the server cannot read it. You also choose one of eight categories, with none chosen for you in advance, and may write a note for the moderators, at most 500 characters; both are sealed with it at the same size whatever they contain, so the server learns neither the category, nor whether there is a note, nor its length. The server stores the reported account, the type of content, the language, the signed statement from the author of that content, the sealed evidence, the hour the report was made, and the case’s status, decision, reasons, and appeal. The reporter’s account, device, and address are not stored. Moderators are human; every reading of a case and every decision is recorded in the audit log.

Reports about the same account are joined into one open case. The reporter gets a receipt, 32 random bytes that the server stores as a hash, to read the status and decision of their case, without the evidence and without anyone’s name. The reported account reads the decision and its written reason, without learning who reported it. The limits of 10 reports a day per reporting account and 20 per device are counted in memory, without linking the reporter to the reported account.

To keep the people who use Patepang safe and to enforce the community guidelines. Basis: legitimate interests, and legal obligation where it applies.

4.11 Preventing bots and mass accounts

When an account is created, the phone gives proof from Apple (App Attest and DeviceCheck) or Google (Play Integrity) that the app is genuine. The server checks it and then only stores how the account was born. If the phone cannot give that proof, for example because the device does not support it or the service cannot be reached, the account is created without proof and can only be born through a tempel with a sponsor. Proof that the server’s check refuses means the account is not created, and you can try again. For the limit of 3 accounts per phone per month, the server reads and writes a marker that belongs to Apple or Google for that phone: two DeviceCheck bits at Apple, or the device recall bits at Google. That marker is stored by Apple or Google, remains even if the app is deleted (on Android, also after the phone is reset), and is not deleted along with your account. The server itself stores a random key per installation, the month, and the count; counts from past months are deleted every day. Temporary rate counters use the device, the account, or the IP address (the IP address only on routes without sign-in), in memory, without being written to disk. Basis: legitimate interests.

4.12 IP addresses, countries, and logs

The Patepang server does not store or log IP addresses; Cloudflare sees them in every request (section 8). The country that Cloudflare provides is only used for daily counts of accounts created and subscriptions started; countries used by fewer than 5 accounts that day are counted as “other”. Server logs have no IP addresses and no account ids, and are kept for 7 days. Logs also contain no request bodies that carry encrypted content, no tokens, and no email addresses. The audit log records the actions of operators and moderators, without account ids, and is kept indefinitely. [Rule for how long the audit log is kept: awaiting a decision]

4.13 Counts and transparency reports

The server keeps daily counts with no account attached, for example the number of accounts, tempels, reports, and decisions. Cities or countries used by fewer than 5 accounts are combined as “other”. These counts are used to run the service, and some of them for transparency reports; all of them are kept indefinitely. Basis: legitimate interests.

4.14 App updates

The app you install from the App Store or Google Play does not check for updates by itself, whether with Expo, with our server, or with any other server. New versions only come through that store, which processes them under its own policies (section 8). Only when you open the Check version screen does the app fetch a signed list of releases from our server, to match your version against that list.

Test versions shared directly with testers, outside the stores, still ask the Expo service (EAS Update) for updates every time they are opened. That request carries the phone’s IP address, a random identifier for that app installation, the platform, and the version. Basis: legitimate interests in sending fixes to testers.

4.15 Calls

Voice and video calls are not yet available in the app for phones. When they are, their data is processed as follows. Call signals are sent inside encrypted envelopes like messages, so the server does not know that an envelope is a call, and there is no call record on any server. Only your connections can call you.

Voice and video are encrypted between the two phones (DTLS-SRTP) and always go through Cloudflare Realtime’s relay servers (TURN), so the person you call does not see your IP address. To use that relay, your phone fetches at most 24 call tokens a day from the server, on its own schedule, not when you call unless its tokens have run out. The server signs those tokens blind, without being able to see them, so a token that is used cannot be linked to the account that fetched it. Cloudflare’s calls Worker keeps the hash of each spent token until its day ends, at most 24 hours, without an IP address, account, or time. Cloudflare, as the relay provider, sees the IP addresses and the timing, as it does for other requests (section 8). Group calls of up to four people work the same way.

On the phone system’s call screen, Patepang gives no photo or account id. The caller’s name is only shown if you choose names in notifications, never for a locked chat or in travel mode, and Patepang calls do not go into the phone’s call log. Basis: performance of a contract.

4.16 Notices from Patepang

If something happens on the server that concerns your data, for example a breach (section 14), we publish it in the Notices from Patepang list. That list is signed with keys installed in the app, so whoever controls the server, the network, or its address cannot forge it, and its notices name no one.

The app reads that list after you open it with your PIN, when the app comes back to the screen, and when you open Notices from Patepang in Settings, at most once every 15 minutes. That read is an anonymous request to a file provider that is separate from the Patepang server: no token, account id, device, or cookie, and no cache that could give your phone an identifying mark. The file provider sees the IP address, the time, and the type of app or browser, the same as for anyone; on a phone, each read carries one single-use random code that does not connect to any other read. The Patepang server does not see that read. Your phone keeps the list’s version, the notices for your server region, and which ones you have read; none of it is sent, and none of it goes into the backup or an export. Basis: legal obligation for breach notices, and legitimate interests for other events.

4.17 Specific personal data

UU PDP classes some personal data as specific: health data and information, biometric data, genetic data, criminal records, children’s data, and personal financial data (Article 4(2)). The Patepang server does not ask for such data and cannot read it in the content you send:

• Biometrics. If you open Patepang with Face ID or a fingerprint, the phone’s system checks it. Patepang never receives or stores data about your face or fingerprint.
• Motion. Shake recordings are only used in the enclave to match two shakes, never to recognize people, and are then discarded (section 4.2).
• Voice. Transcripts of voice messages are made by the speech recognizer on your phone, and the voice and its text are not sent anywhere.
• Finances. We do not store cards, accounts, payment methods, prices, or receipts (section 4.9).
• Children. Patepang is only for people aged 18 and over (section 12).
• The content you send can contain such data, for example about your health. That content is end-to-end encrypted, and is only readable by its recipients, or by moderators as far as the reported copy goes (section 4.10).
• Moderation. A case record can contain a reason code such as child sexual content or intimate images shared without consent, and is kept as long as the reported account exists (section 7).

The list in UU PDP does not mention the links between accounts, but the record of who has met whom, when, and in which room can reveal a lot about your life. That is why we state it plainly in section 4.2 and keep it only as long as both accounts exist (section 7).

4.18 Summary: purposes, legal bases, and if you refuse

Article 20(2) of UU PDP recognizes six bases for processing. We use four: performance of a contract, that is, the terms and conditions you agreed to; legal obligation; legitimate interests, which must be balanced against your rights; and consent. This table summarizes sections 4.1 to 4.16.

Messages, groups, updates, moments, plans, photos, voice, and files are encrypted on the phone before they are sent, and are only opened on the recipient’s phone. The server does not hold the keys. That content can be read by others because of your actions or its recipient’s actions: when you or its recipient report it (moderators read the reported copy), or when you or its recipient save it as an evidence file, an export file, or another file outside the app.

The server cannot open account backups. A backup is opened by your new phone after a recovery approved by two guardians, or by two of your guardians if they collude (section 4.7).

“Delete for everyone” and disappearing messages are promises of the app, not technical guarantees: the copy on the recipient’s phone is on their phone. Content that has been shown can also still be reported by its recipient for up to 30 days from when it arrived on their phone, even if the sender has already deleted it. Screenshots also remain possible.

Deleting content also does not delete every copy of it at once: envelopes the recipient has not yet fetched stay on the server until they are fetched, your latest account backup still contains that content until the next backup, and database backups keep deleted data for up to 40 days (section 7).

What cannot be hidden from the server is the data needed to deliver that content: the recipient, the time, the size bracket, and the other data in section 4. The voice and video of calls are encrypted between the two phones, and the relay that forwards them cannot read them (section 4.15). A temporary location is sent encrypted like a message (section 3.1).

Besides us and the providers in section 8, other people see some of your data, depending on how they are connected to you. Encrypted content only opens on the phones of the people who receive it.

6.1 Anyone

• Your account’s key chain is public, so that other people’s phones can check your keys before trusting them. Anyone who knows your account id can read your devices’ public keys, the time of every change, the account ids of your guardians, and, if your account is blocked, that block marker. The chain also shows the type of each device, whether you have turned on the dead lock, and, after your account is deleted, its closing entry.
• The key transparency log is public and only grows. Its contents show how many changes there were and when, not which accounts.
• The list of birthplaces and the transparency reports are also public, with no one’s account in them (sections 4.6 and 4.13).

6.2 People who have done a tempel with you

• They receive your nickname and profile photo, encrypted. Your updates, status, and birthday only reach the people you choose, and you can hide them from someone without that person being told.
• Read receipts and typing indicators are only sent if you choose them. The Delivered receipt is always sent, because it is part of the sending status.
• Your contact card only reaches the recipients you choose, only holds the lines you tick, and can be withdrawn again.
• In a shared moment, the people who were there see each other’s contributions, and a tag saying you were there only becomes visible to others after you accept it.
• People who have done a tempel with you are notified if your account is being recovered.

6.3 Group members and event room participants

Group members see their fellow members; event room participants see other participants according to their role.

• Groups. Members see the list of members, including members they have never met, whom the app marks. They see group messages, group updates, and polls, and the contact cards and temporary locations you send to the group; the app warns you first if there are members you have never met. New members see the group album’s content from when they joined. Admins can remove members and delete group messages and updates.
• Event rooms. Participants see the list of other participants and their cards. Posts on the board appear without the author’s name, except announcements from the organizers. Participants can request a connection with other participants, and the person asked sees who asked. The host can remove participants.

6.4 Guardians

• The people you choose as guardians see your request, then accept or decline it. If a guardian declines, you are told, without the reason.
• If backup is on, each guardian holds one piece of your backup key. One piece opens nothing, but two guardians who collude can open your backup (section 4.7).
• When you recover your account, two of your guardians meet your new phone and do a tempel with it, then sign statements for that recovery.

6.5 Moderators and reporters

• If content from you is reported, moderators read the reported copy, its author’s statement, and the reporter’s category and note, but none of your other content.
• If you report, the account you report is not told who reported it. It reads the decision and its reason, and you read the same decision through your receipt, without the evidence and without anyone’s name.
• If your account is blocked, other people’s apps show that your keys are blocked for a violation. The reason is not public.

6.6 People who hold or look at your phone

• Notifications on the lock screen only state their type, with no message content. The sender’s name is only shown if you choose it, and never for a locked chat or in travel mode.
• Chats can be locked behind the PIN, and travel mode seals people, conversations, updates, moments, and notes with six words. A person holding the unlocked phone can still tell that travel mode is on, and count your connections from the app core’s records, without names.
• The widget on the Android home screen shows the content you choose for it (section 3).

Data on your phone stays there until you delete it, delete the app, or your account ends: as soon as the server states that your account no longer exists, the app deletes its keys and data by itself. Evidence for reports is kept for 30 days from when the content arrived. Positions from a temporary location are released from the recipient’s phone after the sharing time ends. The content of an export file you open in the app is only shown while its screen is open and is not stored. Copies on other people’s phones are on their phones, out of our reach.

8.1 No selling and no advertising

We do not sell data and do not share it for advertising or marketing. We give no data to advertisers or data brokers, and we do not use data to build a profile of you or to choose what you see: Patepang has no algorithm that arranges content for you, and the daily updates end with “Done for today”.

8.2 Providers that process data for us

The providers below process data for us as part of the service. Each provider is bound by an agreement to process data only on our instructions and to provide protection that is the same as or equivalent to this policy. For your store account and your purchases, Apple and Google also act on their own behalf, under their privacy policies. [Data processing agreement with each provider: awaiting the owner and legal counsel]

Amazon Web Services (AWS)

App servers, enclaves, database, and encryption keys. Can access everything the server stores: the data in section 4 and the encrypted content. Location: Singapore; the encryption keys for database backups in Frankfurt, Germany.

Cloudflare

The network in front of the server (DNS, TLS, attack protection, rate limiting), storage of encrypted media, encrypted database backups, call relay when the calling feature is available, and serving the patepang.com site and its subdomains. Cloudflare decrypts the connection encryption (TLS) on its network, so it sees every request to the server except content that is end-to-end encrypted. What it sees: IP addresses, times, and sizes; sign-in tokens, account ids, and device numbers; the recipient and token of every message sent; and the key of every media item uploaded or downloaded. So, through IP addresses, Cloudflare can link a phone to its account, a message’s sender to its recipient, and a media uploader to its downloader. The content of messages and media stays encrypted. For calls, the Cloudflare Realtime relay sees the IP addresses of both phones and the timing, but not the voice or video, and the calls Worker keeps the hash of each spent token for at most 24 hours, without an IP address or account (section 4.15). Location: the nearest data center, worldwide; media with an Asia-Pacific location hint (a hint, not a guarantee); backups in the European Union jurisdiction. How long its logs are kept: [Retention of Cloudflare logs and Security Events: not yet confirmed]

Apple

App Store (downloads, subscriptions, tips), the notification service, and app authenticity checks when an account is created, including the two DeviceCheck bits that count the accounts an iPhone creates in a month (section 4.11). Sees the App Store account and its purchases (Apple’s own data), the random subscription identifier, notification tokens, and notification times. Location: United States and global.

Google

Google Play (downloads and payments), Firebase Cloud Messaging (notifications, through its SDK in the Android app), Play Integrity and device recall (app authenticity checks and the count of accounts per phone when an account is created), and Google Cloud Pub/Sub (Google Play billing notifications to the server, with their purchase token). Sees the same things as Apple. Location: United States and global.

Expo (EAS Update)

Update checks, only for test versions shared with testers outside the stores (section 4.14); the app from the App Store and Google Play does not contact Expo. Sees the IP address, a random identifier per installation, the platform, and the version. Location: [Where Expo processes data: not yet confirmed]

Zoho Mail

Receives and stores the emails you send to our email addresses. Sees your email address, the content of your message, and its attachments. Location: United States (Zoho’s data center for patepang.com email).

Status page

Serves the service status page. [Status page provider: not yet chosen]

Notice file provider

Serves the Notices from Patepang list that the app reads (section 4.16). Sees the IP address, the time, and the type of app or browser of each read, with no account. [Provider and location of the notice file: not yet chosen]

8.3 Services you open yourself

If you open a plan’s place on a map, the place name you typed is sent to Apple Maps on an iPhone, or to the maps app on your Android phone (for example Google Maps), which process it under their own policies. That only happens when you press it. The same applies when you open a location shared with you in a maps app: its position only reaches the maps app when you press the button. Link previews in Patepang only show the address: your phone does not fetch that page until you open it in a browser yourself. Files you share through the phone’s share sheet reach the app you choose, which processes them under its own policy.

8.4 Law enforcement authorities and the government

Requests from law enforcement authorities and the government are explained on the Transparency page. In short:

• We do not keep anyone’s name, phone number, or email, so a request must name an account id.
• What can exist on the server for an account id is the data in section 4 that is still kept under section 7: the account and device records; the key chain; tempels (with which account, when down to the minute, their type, and their room); group memberships, participation in event rooms that are still open, and guardians; envelopes not yet fetched, in encrypted form; subscription status; and moderation cases.
• Apple or Google can match the random subscription identifier to the store account of its buyer, and the notification token to its device. So Patepang’s data combined with Apple’s or Google’s records can show who owns an account.
• What does not exist, and so cannot be handed over: the content of messages, updates, moments, or media in readable form; names, photos, phone numbers, emails, or address books; IP addresses, phone locations in readable form, or call records.
• The first version of Patepang does not hold data at anyone’s request (legal hold): deletions already scheduled still go ahead.
• Every request is counted in the transparency report by country, type, and outcome, without naming an account.

[Written policy for requests from authorities, including the legal bases we accept and when users are told: awaiting a decision and review by legal counsel] [Reporting child sexual content to the authorities, and disclosing data in an emergency that threatens life: awaiting the owner’s decision and review by legal counsel] Official requests are sent to [email protected].

8.5 If Patepang changes hands

If PT Pakuan Teknologi Pangrango merges with another entity, is taken over, sells Patepang, or is dissolved, the data the server stores (section 4) may move along with the service. What cannot move is what we do not hold in the first place: your private keys, content in readable form, and the data that stays on your phone (section 3). Announcements if Patepang stops operating are covered in the Terms and conditions. [What happens to data in a merger, takeover, sale, or dissolution, when and through which channel you are told, and your choices before the data moves: awaiting the owner’s decision and review by legal counsel]

Server data from users in Indonesia is processed outside Indonesia: in Singapore (the main server), in the nearest Cloudflare data center, in Asia-Pacific (encrypted media), in the European Union (encrypted database backups), in the United States or globally (Apple and Google; Expo only for the testers’ test versions; Zoho Mail for the emails you send us), and in the location of the status page provider (section 8). At present there is only one server region, Singapore, and accounts cannot yet be moved to another region.

The content you send is end-to-end encrypted, and the data on the server and its backups are stored encrypted. [Basis for the transfer under Article 56 of UU PDP: awaiting review by legal counsel]

While it is processed outside Indonesia, data is protected in the ways set out in section 13: your private keys never leave the phone, the database and its backups are encrypted with keys in AWS KMS, and backups are stored in the European Union jurisdiction with their keys in Frankfurt. Providers in the United States and globally only receive the data named for them in section 8, never content in readable form. The notice file is also processed at its provider’s location (section 8).

UU PDP gives you rights over your personal data. In Patepang, this is how to use them. Each right below comes with its article in UU PDP, how to use it, and its limits. You use most of them yourself in the app, because the keys on your phone are what prove the account is yours (section 10.11).

10.1 Getting information

Getting information about the processing of your data: this policy, and answers to your questions at [email protected]. This right, in Article 5, covers who we are, the legal basis and purposes of processing, and who is accountable for it; sections 2, 4, and 8 answer it. In the app, the Transparency screen shows the version of this policy you agreed to on that phone, and when.

10.2 Accessing and getting a copy

Accessing and getting a copy: the data on your phone is in the app, and you can export it as an encrypted file that is opened with six words. The export file only contains the data on your phone, not the data on the server. For data on the server, the app shows your subscription, quota, guardians, recovery, moderation decisions, number of tempels, and device chain. There is not yet a way to download all server data at once. [How to request a copy of the data on the server: awaiting a decision and development] This right is in Article 7. We cannot copy the content of messages and media for you from the server: that content is stored encrypted, and envelopes are deleted as soon as they are fetched. Its copies are on your phone and in your export file.

10.3 Correcting and updating

Correcting: you change your nickname and profile yourself in the app. The same goes for the names you give your connections, your notes, and your settings, all of which are on your phone. Most data on the server is created by your own actions and changes when you act again, for example when you replace a guardian, turn meeting reminders on or off, or choose another city on the waiting list. The key chain and the key transparency log cannot be changed backwards, because that is what makes them trustworthy: a change is added as a new entry. If you think a moderation decision about your account is wrong, appeal it in the app; for other data you think is wrong, write to [email protected]. This right is in Article 6.

10.4 Deleting and ending processing

Deleting and ending processing: delete your content in the app, or delete your account. How to do it is on the Delete account page. This right is in Article 8.

• Account deletion has a 7-day grace period that can be canceled. After that, the server deletes everything linked to your account, except the closing record for 12 months, its entries in the key transparency log, and copies in database backups for up to 40 days (section 7).
• Without the app, you can use a deletion code you made beforehand in the app, through the Delete a Patepang account without the app page. Anyone holding that code file can schedule the deletion of your account, so keep it in a place only you open.
• You can also delete in part: turning off backup deletes the backup on the server, leaving a group deletes your membership, deleting update and moment media deletes its objects, and revoking notification permission deletes your notification token when the app is opened again.
• A blocked account cannot be deleted early; it is deleted by itself after 12 months of inactivity. [The right to deletion for blocked accounts: awaiting review by legal counsel]
• Deleting your account does not stop a subscription at the store, and does not delete the data Apple or Google hold, such as your store account and the account limit marker on your phone (section 4.11).

10.5 Withdrawing consent

Withdrawing consent: privacy choices in the app can be changed at any time. Choices such as read receipts and names in notifications start at the most private option until you choose. Revoking notification permission in your phone’s settings stops them from being shown on your phone, and the next time Patepang is opened, the app asks the server to delete your notification token (section 4.8). A temporary location stops when you press Stop sharing or its time runs out, and you can revoke camera, microphone, location, and speech recognizer permissions in your phone’s settings. This right is in Article 9. [Whether consent recorded only on the phone is enough as proof of consent under UU PDP: awaiting review by legal counsel]

10.6 Postponing or restricting processing

Restricting processing, objecting, and suing under UU PDP, via [email protected]. The right to postpone or restrict processing is in Article 11. You can apply many restrictions yourself in the app: turn off backup, meeting reminders, and notifications; turn on the emergency lock if a device is lost or taken, which holds back device linking, guardian changes, and recovery for 72 hours; or turn on the dead lock, which turns off recovery through guardians. For other restrictions, say in your message which processing and why.

10.7 Moving your data

Moving your data: the export file is an encrypted JSON archive that is opened with six words. You can open it on the phone through Open export file, or on a computer with the opener page that you can save together with the file. That page works without the internet, stores nothing, and can save the content as an unencrypted JSON file, which other programs can read. Patepang does not put an export file back into an account. This right is in Article 13. [An export file format fixed for the public, and where the opener page is published outside the app: awaiting a decision]

10.8 Objecting

Objecting to automated decisions (section 11), via [email protected]. This right is in Article 10. You can also object to processing based on legitimate interests (section 4.18) via the same email address, and to moderation decisions through an appeal in the app.

10.9 Suing and receiving compensation

If the processing of your data breaches UU PDP, you have the right to sue and to receive compensation (Article 12). You can contact us first at [email protected] so that the matter can be settled together, without reducing that right. Other ways to settle disputes are in the Terms and conditions.

10.10 Complaining to the personal data protection agency

You can also lodge a complaint with the personal data protection agency designated by the government. [Name of the personal data protection agency and its complaint channel: awaiting review by legal counsel]

10.11 How to make a request and prove your account

You use most of the rights above yourself in the app, in Settings, because ownership of an account is proven with the keys on your phone, not with a name, a number, or an email. Because we do not store your name, email, or phone number, we cannot recognize your account from an email, and the app does not yet show your account id. Patepang never asks for an account id, a PIN, six words, or a deletion code by email or phone, and does not act on an account because of an email or a phone call. By email we answer questions and accept objections and complaints. [How to prove you own the account for requests by email: awaiting a decision] [Process and time limit for answering requests under UU PDP: awaiting a decision and review by legal counsel]

10.12 What we cannot do

Because content is end-to-end encrypted and the server knows no one’s identity, there are things we cannot do, even if you ask us to:

• read, copy, or restore the content of messages, updates, moments, and media from the server;
• change or delete the copies on other people’s phones: “Delete for everyone” asks their app to delete them (section 5);
• recover your account if all your devices are lost and there are not two guardians who can help;
• open an account backup or an export file without the keys that exist only on your phone, in your guardians’ hands, or in your six words;
• delete entries in the key transparency log, which are permanent by design and do not name accounts publicly.

Patepang does not build a profile of you, and content is not scanned automatically, because the server simply cannot read it. Moderation decisions are always made by humans. But some rules run automatically and can have a big impact on you:

• An account that has not been born is deleted 30 days after it was created if there has been no tempel yet. An account that has been inactive for 12 months is deleted, with a reminder by notification in the 11th month if you allow notifications.
• If your media on the server exceeds your quota for 12 months, the oldest media of updates, moments, and stickers is deleted until it fits, with warnings 3 months, 1 month, and 1 week beforehand.
• When an account is created, if your phone cannot give proof of app authenticity from Apple or Google, your account cannot be born on its own and has to wait for a tempel with a sponsor. If the server’s check refuses that proof, the account is not created. One phone can only create 3 accounts in one calendar month.
• An account that has three of the accounts it sponsored blocked within a year can no longer be a sponsor.
• A tempel only succeeds if the enclave judges that the two shakes match, and a tempel is the only way to connect and to be born. A shake that is too weak can be rejected; if shaking together does not work, someone else may help shake both phones.
• A recovery that is not canceled is carried out automatically after the 48-hour waiting period, and all your old devices are signed out of the account. A recovery fails by itself if your key chain changes first.
• A scheduled account deletion is carried out automatically after the 7-day grace period, unless it is canceled. A deletion code stops being valid by itself as soon as your devices, guardians, or recovery settings change.

You can object to automated decisions via [email protected], and to moderation decisions through an appeal in the app. [How objections to automated decisions are reviewed, under Article 10 of UU PDP: awaiting review by legal counsel]

Patepang is only for people aged 18 and over. The server does not receive anyone’s date of birth or age; birthdays in the app are optional, day and month only.

When you create an account, or recover an account on a new phone, the app asks you to tick “I am 18 or older.” That box starts empty, and your age itself is not asked. That statement is recorded only on your phone with its time, is not sent to the server, and is not included in the backup (section 3). The app does not yet use the age range signals from the phone’s system, such as those Apple and Google provide. [Patepang’s age rating on the App Store and Google Play: awaiting the owner]

Because the server knows no one’s identity, we cannot check the age of an account’s owner. Children’s data is specific personal data under UU PDP (section 4.17). [The steps if there is a user under 18, and whether a self-declared age is enough under PP 17/2025 (PP Tunas) before age signals from the phone’s system are used: awaiting review by legal counsel]

Content is end-to-end encrypted on the phone. Private keys are stored with the phone’s hardware key. Connections to the server use TLS 1.3 with HSTS and DNSSEC; the path from Cloudflare to the server uses two-way TLS. The database is encrypted, each part of the server only gets the access rights it needs, and enclave keys are only unlocked inside a proven enclave. The full explanation is on the Security page.

13.1 On your phone

• Messages and other content are encrypted with libsignal (PQXDH with ML-KEM-1024 and the triple ratchet), in the Rust core that holds all the keys; the rest of the app never sees a private key.
• App data and copies of media on the phone are stored sealed, and are not included in the phone’s system backup.
• The ML-DSA-65 signing key, which is needed to change the account and to sign tempel certificates and guardian statements, is locked behind the PIN or biometrics and bound to the phone’s hardware key (Secure Enclave or StrongBox). A thief holding a phone whose PIN they have not entered cannot change your account. The keys for notifications and fetching messages open after the phone is first unlocked since it was switched on, as in other messaging apps.
• Chats can be locked behind the PIN, travel mode seals content with six words, and the emergency lock signs every other device out of your account if one device is lost or taken.

13.2 On the way to the server

• Connections to Cloudflare use TLS 1.3 at least, with HSTS preload, DNSSEC, and a restriction on certificate issuers (CAA). The server only accepts connections from Cloudflare, which proves itself with a client certificate belonging to Patepang’s zone. WAF rules and rate limiting at Cloudflare stop attacks before they reach the server.
• Envelopes carry no sender, delivery tokens are stored as hashes, content is rounded up to size brackets, and media is padded, so the server only knows approximate sizes.

13.3 On the server and in the enclaves

• The server runs in a private AWS network with encrypted disks. No remote entry point is open on the server: every operator session goes through AWS Session Manager and is recorded.
• The database is encrypted with a key in AWS KMS and is only reached over TLS with the server’s name verified. Each part of the server signs in with its own role, and every row that names an account is protected by row-level rules, so a device cannot read another account’s data.
• The moderator and admin tools run in a separate process that cannot be reached through the app’s path, only through Cloudflare Access, and each moderator signs in with their own key.
• Notification tokens are stored encrypted with a data key from AWS KMS. The keys that sign the key transparency log are in AWS KMS, can only be used by the machine that runs scheduled jobs, and any attempt to change their usage rules raises an alarm.
• The enclaves run in AWS Nitro Enclaves and prove their code through attestation. Their keys only open inside an accepted version of the enclave, so not even the server’s operator holds them.

13.4 Backups

The database is backed up every day, and its changes are shipped continuously. Each backup file is compressed and encrypted (AES-256-GCM) with a data key of its own, which an AWS KMS key in Frankfurt wraps, and is then stored in Cloudflare R2 in the European Union jurisdiction, locked for 35 days and deleted after 40 days. Restoring from backup is rehearsed every month and before every release, with targets of losing at most 15 minutes of data and the service restored within 4 hours.

13.5 Keys that others can check

• Every long-lived record is signed twice, with Ed25519 and ML-DSA-65, and phones reject it if either signature is not valid.
• The key transparency log’s summary is signed every hour, and outside parties can audit the log without an account. That summary also anchors the audit log, so audit log entries that are removed or changed are detected.
• The moderator list is signed by two of the three root key holders, Notices from Patepang are signed with keys installed in the app, and every release is recorded in the public Sigstore Rekor log.

13.6 Monitoring, people, and releases

• Server logs are kept for 7 days and never contain an IP address together with an account id. Every scheduled job and every moderator and admin action is recorded in the hash-chained audit log.
• AWS GuardDuty and alarms watch the AWS account, Cloudflare watches the network, and important findings are sent to the security contact. Incidents are handled as section 14 describes.
• Moderators open evidence in a console without third-party resources; their keys are sealed with a password, and opened evidence is not stored.
• Dependencies are pinned to exact versions that are at least 14 days old, known vulnerabilities stop the automated checks and releases, and every release comes with a list of its components (SBOM).

13.7 Audit and vulnerabilities

A security audit by an outside party is a requirement before the public launch and has not yet been done. No system is free of risk; if you find a vulnerability, report it to [email protected].

If we learn of a personal data breach, we notify the personal data protection agency and the people affected, in writing, within 3 × 24 hours at the latest, in accordance with Article 46 of UU PDP. Because the server has no one’s contact details, the notice to you is given on the status page (status.patepang.com) and on patepang.com. The notice also appears in the app when it is opened, as a Notices from Patepang banner and in Settings, under Help and transparency (section 4.16). A phone that is not opened does not receive it yet: no notification wakes the phone for it. [Whether the notice in the app and on the status page meets the written notice under Article 46 of UU PDP: awaiting review by legal counsel] It contains: what happened and when, what data is affected, what we have already done, and what you can do. What is not yet known we say plainly, and then follow up. Every incident is counted in the transparency report.

When an incident happens, we first contain the damage, for example by revoking leaked credentials or replacing a machine that was broken into, then investigate it with the logs there are, restore the service, notify, and write a review of its cause and of what was fixed. People who report an incident to us hear about it from us before the public does. The server is built so that a breach of it yields little: there are no messages, names, photos, or contact lists in readable form inside it.

15.1 The patepang.com site and its subdomains

The patepang.com site and its subdomains, except the status page (section 8), are static files: no cookies, no analytics, no forms, no storage in the browser, and no scripts or fonts from third parties. These sites are served by Cloudflare, which records visitors’ IP addresses and browser types in its request logs (section 8). The search on the help home page filters that page in your browser; the words you type are not sent or stored.

One page works with your data: Delete a Patepang account without the app. That page reads the deletion code file you choose in your browser, then sends only the deletion entry inside it to the Patepang server. That page stores nothing and does not show your account id, and the server uses your IP address only to limit how many codes are sent from one network, without storing it.

15.2 Cookies and similar technologies

Patepang’s sites set no cookies, tracking pixels, or browser storage of any kind, so there is nothing for you to accept or refuse there. The app does not use cookies or ad tracking tools either. What the app stores on your phone in order to work:

• your sealed app data, including your record of agreement (section 3);
• small records that belong to the device, outside the account’s data: the version of the latest moderator list and notice list that phone received, the marks of notices already read, and a sealed record the phone uses to write notification texts without opening the app;
• reminders scheduled in the phone’s system, without people’s names or plan titles;
• markers that Apple or Google keep for your phone: the notification token and the account counter bits (sections 4.8 and 4.11). These markers belong to the system and its store, not to Patepang.

Deleting the app deletes everything the app stores on your phone, except the markers that Apple or Google keep.

15.3 Email

If you write to us by email, we receive your email address and the content of your message. [How long emails are kept: awaiting a decision] Your email is received and stored by Zoho Mail in the United States (section 8). Never send your PIN, your six words, or a deletion code file: we never ask for them, and an email asking for them is not from us.

This policy can change, for example when new features arrive or after review by legal counsel. The date at the top of the page shows the last change. We announce important changes on this page and on the status page before they come into force.

Every published version can still be read at its own address: they are listed in the Versions section at the end of this page and on the Legal documents page. The app records on your phone the version of this policy you agreed to and when, and the Transparency screen in the app shows it.

A new version reaches the app together with a new version of the app. When you open Patepang after updating it, the app shows the documents that changed, marked Updated, and asks for your agreement again. Until you agree, messages to you still arrive, but you cannot send anything yet. If you do not agree, you can export your data and delete your account from that screen. An older version of the app does not ask about a newer version of the policy. [Whether every change asks for agreement again, or a notice is enough for small changes: awaiting a decision]

Questions and requests about personal data: [email protected]. Questions can also be asked by phone, +62 851-6101-1651; requests are best sent by email, so that they are on record. Data protection officer: the company’s director, via the same email address. Postal mail: PT Pakuan Teknologi Pangrango, Jl. Cihideung Udik RT 004/RW 009, Desa Cihideung Udik, Kecamatan Ciampea, Kabupaten Bogor, Jawa Barat 16620, Indonesia. Other addresses are on the Contact page.

17.1 The data protection officer’s duties

The data protection officer advises so that the processing of data in Patepang complies with UU PDP and this policy, monitors that compliance, advises on data protection impact assessments when there is a new feature or provider, and is the point of contact for questions and requests about personal data, including with the personal data protection agency. [Data protection impact assessment for Patepang: awaiting the owner and legal counsel]

Every version that is published stays at its own address. The address without a date, legal.patepang.com/privacy, shows the version in force. While this document is a draft, both addresses show the draft.