Terms and conditions

These terms are an agreement between you and PT Pakuan Teknologi Pangrango (“we”) about the use of the Patepang app and of the patepang.com site and its subdomains. You agree to these terms, together with the Community guidelines and the Subscriptions and payment terms that form part of them, when you state in the app that you agree. That consent step appears before you create or recover an account, and the app records the version you agreed to on your phone only (section 3). How we process data is explained in the Privacy policy.

We are a limited liability company with its address at Jl. Cihideung Udik RT 004/RW 009, Desa Cihideung Udik, Kecamatan Ciampea, Kabupaten Bogor, Jawa Barat 16620, Indonesia, registered under business identification number (NIB) 2810260094182. Our registration as a private-scope electronic system operator (PSE) will follow before Patepang is launched. [PSE registration number: awaiting registration by the owner]

These terms apply to every part of Patepang: the app on your phone, the service our servers run for that app, and our sites, including the page for deleting an account without the app. This agreement is between you and us only. Apple and Google, which provide the stores where you download the app, are not parties to this agreement (section 15).

Patepang has not been launched yet. These terms are a draft and only come into force after they have been reviewed by legal counsel.

In these terms and the documents that form part of them, the following words mean:

Patepang or the service

The Patepang app, the service our servers run for that app, and the patepang.com site and its subdomains.

We

PT Pakuan Teknologi Pangrango, which runs Patepang.

You

The person who uses Patepang.

Account

A pair of cryptographic keys made on your phone, without a name, email address, or phone number. The account id is the fingerprint of the public key of your first device.

Device

A phone or other device that holds your account's keys.

Tempel

The way to connect on Patepang: one phone shows a QR code, the other phone scans it, then both phones are shaken together for about two seconds. Whether the shakes match is checked in the tap enclave, and the certificate is signed by both phones and by the witness in that enclave. Tempel again (for people who have already met), the tempel that admits you to an event room, and the recovery tempel are its variants.

Enclave

An isolated environment whose code can be proven. Patepang uses the tap enclave to match shakes and the recovery enclave to carry out account recovery.

Connection

A person connected to you through a tempel. A person connected through a request in an event room, without a direct tempel, is a limited connection until the two of you do a direct tempel or you open their profile.

Content

Everything you make or send on Patepang, such as messages, updates, moments, photos, videos, voice, files, plans, invitations, contact cards, profile photos, circle questions, and posts in event rooms.

Updates and moments

An update is your daily post for all your connections or for one circle. A moment is the record of a meeting.

Event room and birthplace

An event room is a temporary room for an event, entered through a tempel with an organizer's phone. A birthplace is an event room where new accounts can be born; the list of their cities and hours is public.

Guardian

A person you choose from the people who have done a tempel with you, to help recover your account through a tempel on a new phone.

Recovery

Moving your account to a new phone with the statements of two guardians, after a 48-hour waiting period.

Backup

An encrypted copy of the data on your phone, stored on the server if you turn it on. Its key is split among your guardians.

Emergency lock

An action, from a device you still hold, that removes all other devices and freezes changes to the account for 72 hours.

Dead lock

A setting that turns off recovery through guardians.

Travel mode

A mode that seals the people, conversations, updates, and moments on your phone with six words, so that the phone shows only stand-in content.

Export

An encrypted file containing the data on your phone, opened with six words that are shown when the file is made.

Deletion code

A file you make in the app to schedule the deletion of your account from a browser, without the app.

Key chain and key transparency log

The key chain is the public record of your account's device keys and every change to them. The key transparency log is a public, append-only record of those changes, so that anyone can check that keys are not replaced silently.

Moderator

A person who reads reported content and decides on reports, in the moderator console.

Subscription and tip

Payments through an app store. A subscription adds media space and file size; a tip is a one-time payment of support.

App store

Apple's App Store and Google's Google Play, where the Patepang app is made available to the public.

Status page

The page where we announce major disruptions and important changes to the service.

In the app, the consent step appears before you type anything: after you choose Create account, and after you choose Recover account on a new phone. The screen shows these terms, the Community guidelines, and the Privacy policy, each with its version date and a link to its page, then two boxes that start empty:

• “I agree to the terms of service and the community guidelines, and have read the privacy policy.”
• “I am 18 years old or older.”

Agree and continue can only be pressed after you yourself have ticked both boxes. Nothing is ticked for you. In the app, these terms are called the terms of service.

Your consent is stored on your phone only, in the app's sealed data: the version of each document you agreed to, when you agreed to it, and that you stated you are 18 or older. Your age itself is not asked. That record is not sent to the server and is not included in backups, so we do not hold proof of your consent. In Settings, Transparency, you can see the version of each document and when your phone agreed to it. [Whether a record of consent kept only on the phone is enough as proof of consent: awaiting review by legal counsel]

A new phone that recovers your account asks for your consent again and stores its own record. If a document changes, the app asks about its new version (section 25). Until you have agreed to the new version, messages for you still arrive on your phone, but you cannot send anything yet; that consent screen also offers Export data and Delete account if you do not agree.

If you do not agree to these terms, do not create an account.

Your agreement with us consists of these terms and the following documents:

• Community guidelines: what must not be sent or done, how to report, what moderators see, sanctions, and appeals.
• Subscriptions and payment: plans, prices, the free trial, payment through the store, how to stop, refunds, quota, and tips.
• Privacy policy: what data we process, what for, where, for how long, who else processes it, and your rights. In the consent step, you state that you have read it.

Each of those documents governs its own topic. [Which document applies when two documents conflict: awaiting review by legal counsel]

Other related documents and pages:

• Licenses and open source: the license of Patepang's code and third-party software. The code license is a separate license over the code, and these terms do not restrict it (section 8).
• Intellectual property policy: rules about Patepang's name and logo and other intellectual property.
• The terms of the App Store or Google Play, which govern your store account and purchases through that store.
• The help pages at help.patepang.com and the security pages at trust.patepang.com, which explain how to use features and how Patepang works. Those pages do not change these terms.

You may use Patepang if all of the following are true:

• You are 18 years old or older.
• One person uses one account, with at most 3 active devices.
• You are not currently banned from using Patepang because of an earlier violation, unless that ban has been lifted through an appeal.
• The law that applies to you does not forbid you to use Patepang or to make this agreement.

5.1 Age

Patepang is only for people aged 18 or older. The app asks you to state this yourself in the consent step. Your age is not asked, not stored, and not sent anywhere, so we do not know anyone's age. The app does not yet use an age range signal from the phone's operating system. Stating an age that is not true is a violation of these terms.

[What we do if we learn that a user is under 18, and how other people can tell us: awaiting review by legal counsel] [Whether a self-declared age is enough under PP 17/2025, before an age signal from the operating system is built: awaiting review by legal counsel] [The legal capacity of users aged 18 to 20 to make this agreement: awaiting review by legal counsel]

5.2 One person, one account

Your account is for you only. Do not share it with other people, do not use another person's account, and do not create an account in another person's name. Do not create a new account to avoid a suspension or a block. Anyone who holds your device and knows your PIN can act in your account's name, so look after both (section 7).

5.3 Place

Patepang is launched first in Indonesia, in Indonesian, for iPhone and Android, through the App Store and Google Play. [Other countries where the app is available, and rules for users outside Indonesia: awaiting a decision] If you use Patepang outside Indonesia, you are also responsible for complying with the law where you are, including the statement Apple requires in section 15.

6.1 The account and its birth

Your account is created on your phone as a pair of cryptographic keys, without an email address or phone number. The account is born at the first tempel. If there has been no tempel within 30 days, that account is deleted. One phone can create at most 3 accounts in one calendar month.

When an account is created, the phone gives proof from Apple or Google that the app is genuine. If your phone cannot give that proof, your account cannot be born on its own and must be born through a tempel with a sponsor, that is, an account that has already done a tempel with at least 10 different people. Proof that fails the check is refused, and the account is not created. The server records how your account was born, and its sponsor account if it was born through a sponsor (Privacy policy section 4).

6.2 Keys and PIN

You are the one who looks after your account. Keep your PIN to yourself: Patepang never asks for your PIN.

The private keys of your account and devices never leave the phone and are stored with the phone's hardware key. Your PIN has at least 6 digits, is checked on the phone, is not stored anywhere, and is never sent, so nobody can send it to you again. Entering a wrong PIN five times causes a pause, which grows longer with each further mistake; nothing is deleted. The key needed for a tempel and for changing the account, such as replacing guardians or devices, only opens with your PIN or your biometrics.

6.3 Guardians and recovery

Add guardians, namely three people who have done a tempel with you, two of whom are enough to recover your account through a tempel on a new phone. Recovery has a 48-hour waiting period, during which it can be cancelled from your old phone.

You choose your guardians yourself; nobody is chosen for you. If you have done a tempel with exactly two people so far, two guardians are enough. A guardian must accept your request, and a refusal comes without a reason. While a recovery waits, your old devices and everyone who has done a tempel with you are notified. The recovery enclave checks that waiting period by its own clock, so we cannot shorten it either, and the server may be a few hours late. A recovery can only be cancelled from your old devices, not from the new phone. Once the recovery is carried out, all your old devices leave the account and delete the Patepang data on them when they connect again.

If your backup is on, each guardian holds one share of your backup key, and two shares open it on your new phone. Photos and groups are not yet included in backups. Without a backup, your account can still be recovered, but your new phone starts without any history. The steps are in Guardians and Backup and recovery.

Your guardians hold great trust. Two guardians who collude, with a modified app, can open your backup without a recovery and without your knowing, and a guardian can be talked into doing a recovery tempel from afar by someone pretending to be you. Choose guardians you truly trust and can meet in person. If you are a guardian, show the recovery code only when the person is in front of you with their new phone.

We cannot recover your account in any other way. We do not know who you are and do not hold your keys. If you lose all your devices and have no guardians who can help, the account and its contents cannot be recovered.

The same holds if you forget your PIN: without two guardians who have accepted, the old account cannot be opened again. While dead lock is on, even your guardians cannot recover your account.

6.4 Devices and the key chain

Every change to your devices and guardians is recorded in your account's key chain, which is public, so that other people's phones can check your keys before trusting them. Anyone who knows your account id can read your devices' public keys, the time of each change, and your guardians' account ids, without their names. Every change is signed by one of your devices or by the recovery enclave; the server cannot make a valid change on its own. A revoked device deletes the Patepang data on it when it connects again.

6.5 Emergency lock and dead lock

In an emergency, from a device you still hold, you can remove all other devices and lock device linking, guardian changes, and recovery for 72 hours. The emergency lock needs the internet and cancels a recovery that is waiting. Messages for you still arrive; what you write is held on that phone and sent after the lock ends. Only the phone that locked the account can end the lock early.

Dead lock turns off recovery through guardians and cancels a recovery that is waiting. From then on, if all your devices are lost, your account is lost too. Turning it off again takes a waiting period of at least 7 days.

6.6 Travel mode and export

Travel mode seals the people, conversations, updates, and moments on your phone with six words, so that the phone shows only stand-in content; someone who checks your phone can still tell that the mode is on. Export makes an encrypted file containing the data on your phone, opened with six new words that are shown when the file is made. Those words are not stored anywhere and are not shown again. If those words are lost, the sealed content or the export file can no longer be opened, by anyone, including us. Anyone who holds an export file together with its six words can read its contents. An export holds only the data on your phone, not the data on the server, and Patepang does not put it back into your account. The steps are in Travel mode and Export data.

6.7 Inactive accounts and deletion

An account that has been inactive for 12 months is deleted, with a reminder by notification in the 11th month if you allow notifications. Opening Patepang keeps your account active. You can also delete your account at any time, except for a blocked account (see Delete account).

If your phone is lost, your account can be deleted early with a deletion code you made earlier in the app, through the page Delete a Patepang account without the app. Anyone who holds that code file can schedule the deletion of your account, and without another device that holds your account, that deletion cannot be stopped. Keep the file in a place only you open. A code stops working when your devices, guardians, or recovery settings change.

Because we do not hold your keys and do not know who you are, part of looking after your account is in your own hands.

7.1 Your part

• Look after your PIN, your travel mode six words, the six words of each export, and your deletion code. Do not give any of them to anyone.
• Look after your phone and its screen lock, and install app updates from the store.
• Choose guardians you trust, and replace a guardian you no longer trust.
• Use the emergency lock if one of your devices is lost or taken by force, and cancel a recovery you did not ask for.
• Keep the copies you need, for example through an export, before deleting your account or changing phones.
• Choose carefully where you keep export files, the note of your six words, and your deletion code. Do not keep an export file together with its six words; services such as email or cloud storage can read a deletion code you keep there.

7.2 What we can do

• Run the servers, enclaves, and relay your account needs, and tell you if something happens on the server that concerns your data (section 23).
• Suspend or block accounts through moderation (section 12).
• Delete an account that is still unborn after 30 days, and an inactive account after 12 months.

7.3 What we cannot do

• Find out who owns an account from an email address, a name, or a phone number, because we do not store them. That is why we do not act on an account because of an email or a phone call.
• Read your content, open your backup, or open an export file without its six words.
• Send you your PIN or six words again, or recover an account without two of your guardians.
• Cancel a recovery on your behalf, or shorten its waiting period.
• Restore an account after the 7-day deletion grace period has ended, or restore data that is not in your backup.
• Pull back copies that have already reached other people's phones.

8.1 Permission from us

While these terms apply to you, we give you a personal, free, non-exclusive, and non-transferable permission to install the Patepang app from the App Store or Google Play and to use the Patepang service under these terms. This permission ends when your agreement with us ends (section 18). [The final form of this permission and its relationship with the code license: awaiting review by legal counsel]

8.2 Open source

The code of the Patepang app and core has been set to use the GNU Affero General Public License version 3 (AGPL-3.0-only), because both use libsignal, which has the same license. Patepang's server code uses the same license. That code will be opened at the public launch, after a security audit by an outside party; until then, the code is not yet open to the public (Licenses and open source).

Once the code is opened, your rights over that code are governed by AGPL-3.0, and no part of these terms restricts them. You may use, study, modify, and share that code, including taking the app apart and examining how it works. If you share a modified version, or run it as a service for other people over a network, you must make its source code available under the same license. AGPL-3.0 contains its own disclaimer of warranty for the code; that disclaimer does not reduce our responsibility for the Patepang service under these terms and consumer protection law. [The license of the app as distributed before its code is opened, including test versions: awaiting review by legal counsel]

8.3 The code and the service

AGPL-3.0 governs the code. These terms govern the use of the service we run: our servers, enclaves, relay, and storage. So:

• You may connect to the Patepang service with an app you have modified yourself, but these terms, including section 9, still apply to your use of that service. [Whether these terms bind people who use the service with a modified app without the consent step: awaiting review by legal counsel]
• A modified app cannot give proof from Apple or Google that the app is genuine, so an account created with it can only be born through a sponsor (section 6.1).
• If you run your own server from Patepang's code, that service is yours, not ours, and these terms do not apply there. You alone are responsible for that service and for the obligations of AGPL-3.0.
• Patepang's name and logo are not included in the code license (section 16).

Use Patepang to keep up relationships with people you have met. You must not:

• do things that the Community guidelines prohibit, such as harassment, fraud, threats, child sexual content, violence, intimate images without permission, or spam;
• violate the law, or the rights of others, through Patepang;
• fake a tempel, create accounts in bulk or with automated programs, or get around account limits and app authenticity checks;
• buy, sell, or rent out accounts;
• disrupt, overload, or break into the service, except for good-faith security research in accordance with the Security page.

The full rules about content are in the Community guidelines. This section sets out the rules particular to Patepang.

9.1 Meeting in person

A tempel is the only way to connect and the way an account is born, and it means one thing: the two of you met in person. So:

• do a tempel only with a person who is in front of you, with both phones in the same place;
• do not send, photograph, or forward a tempel QR code to someone who is not where you are, and do not imitate the rhythm of a shake together with someone from afar;
• if shaking as a pair does not work, another person may help by shaking both phones at once; that is still a valid tempel;
• if you open an event room or a birthplace, admit only people who are really there.

9.2 Tempel and accounts

• Do not fake a tempel with recorded shakes, made-up motion data, an emulator, or another program, including to get the second-meeting bonus.
• Do not get around the limit of 3 accounts per phone per month, for example by resetting a phone or using many phones.
• Do not buy, sell, rent out, or lend accounts, tempels, or the service of being a guardian or a sponsor.
• Do not run an account with an automated program (a bot). Patepang has no bots, and every account is used by its own person.
• Do not pose as someone else, as a moderator, or as Patepang.

9.3 Public data and the key transparency log

Some of Patepang's data is public on purpose, so that anyone can check the server: every account's key chain, the key transparency log, the transparency file, the moderator list, the release list, and the list of birthplaces. You may read and check them, including by running your own checker of the key transparency log, within the request limits the server sets. You must not:

• collect account ids, key chains, or other public data in bulk to map who is connected to whom, who guards whom, or who owns an account;
• use that data to track, identify, or contact people who do not want to be contacted;
• get around the request limits, for example with many IP addresses or devices.

9.4 Interfering with the service

• Do not flood the service with requests, messages, reports, or uploads, and do not get around the limits set to prevent abuse.
• Do not try to get into other people's accounts, devices, or data, or into parts of the servers, enclaves, and moderator console that are not meant for you.
• Do not spread malicious software, or links to steal accounts or data.
• Good-faith security research is allowed: test only what is in the scope of the Security page, with your own accounts and devices, do not read, keep, change, or delete other people's data, do not degrade the service for others, and report what you find to [email protected] with reasonable time before it is disclosed.

9.5 Reports and moderation

• Do not make false reports, pick a category you know is wrong, or report in order to harass someone. The child sexual content category has a special procedure, so do not use it for other content.
• Do not try to find out who reported you, or retaliate against a reporter.
• Do not avoid a sanction with another account.

9.6 The law

Comply with the law that applies to you when you use Patepang, including the law on other people's personal data, copyright, and trademarks. Do not use Patepang to offer or sell prohibited goods and services. You are responsible for how you keep, export, or spread other people's content.

10.1 Your content remains yours

Messages, updates, moments, photos, and other content that you create remain yours. You give us permission only to the extent needed to store that content and deliver it, in encrypted form, to the people you choose. Because content is end-to-end encrypted on the phone, we cannot read it.

That permission is non-exclusive, unpaid, and only for running Patepang: keeping message envelopes until the recipient collects them, keeping your media and backup for as long as the rules allow, and giving moderators the copy someone reported, so that they can decide on that report. That permission ends when the content is deleted from the server. We do not use your content for advertising or any other purpose, and we cannot read it in the first place.

10.2 Your responsibility for content

You are responsible for the content you send. Content that other people report can be read by moderators, limited to the copy that was reported.

Send only content you have the right to send, and respect the people who appear in your photos or videos. A photo sent as a photo is sent without location data, but a file sent as a document is sent as it is, including its metadata. A person who forwards content becomes the author of the copy they forward, and can be reported for it.

10.3 What recipients can do

Once your content reaches someone else's phone, the copy is in their hands. By the way the app works, a recipient can:

• keep it on their phone, even after you disconnect from them;
• forward it to at most five connections at once, except view-once content;
• save it outside the app through the share sheet, take a screenshot, or export it into a file of their own; screenshots cannot be prevented on every phone;
• save a conversation as an evidence file together with the statements of its authors, for the police or a lawyer;
• report it to the moderators for up to 30 days from when it arrived on their phone, even if you have deleted it or the message has disappeared.

“Delete for everyone”, which can be used up to 24 hours after a message is sent, disappearing messages, and view-once are promises of the app, not technical guarantees: all of them depend on the app on the recipient's phone. In a moment of two people, either of you can delete that moment from both your phones.

10.4 Deleting content

Deleting content deletes it from your account and from the server, within the limits explained in section 5 of the Privacy policy: envelopes that the recipient has not yet collected stay on the server until they are collected, and backups keep it temporarily. Copies that have already reached other people's phones are on their phones.

10.5 Other people's content

Content other people send you remains theirs. You may read it and keep it for yourself. To use it beyond that, for example to spread it, ask for their permission or make sure the law allows it. Handing evidence to the police or a lawyer to protect yourself is not prohibited by these terms. Spreading someone's intimate images without their permission, or threatening to spread their personal data, is prohibited by the Community guidelines.

11.1 Groups

A group has at most 50 people, and you can only invite your connections. A group's name, photo, and messages are end-to-end encrypted, but its membership is stored without encryption on the server, and every member sees the other members. A group admin can remove members, delete group updates, and delete a member's message for everyone, marked “Deleted by admin”; people who already saw that message can still report it. If the last admin leaves, the member who joined earliest becomes admin. Use an admin's powers to look after your group, not to harass its members.

11.2 Event rooms and birthplaces

An event room can be opened by an account that has done a tempel with at least 20 different people, with at most 3 rooms open at once, and a room closes at most 7 days after it opens. People enter through a tempel with an organizer's phone. Only the host can remove participants and close the room. The host of a birthplace can sponsor the birth of new participants' accounts, up to its monthly limit. The server keeps the room board in encrypted form, without authors' names, and the room's data is deleted a few minutes after the room closes; its tempel records remain.

Patepang's moderators are human. They read only reported content, and their decision can be a dismissal of the report, a warning, a 30-day restriction, a 7- or 30-day suspension, or a block. A block needs the approval of a second moderator. Every decision comes with a written reason that you can read in the app.

12.1 Reports

In the app, you can report messages, photos, updates, moments, plans, invitations, contact cards, profile photos, circle questions, and posts or cards in event rooms. You choose the category of the problem and the language of the content, and you may write a note for the moderators of up to 500 characters. Your phone seals a copy of that content, together with a signed statement from its author, for the moderators; the server cannot read it. The server does not store who the reporter is, and the person reported is not told who made the report. Reports about one account are combined into one case. The details are in the Community guidelines.

12.2 How moderators decide

At launch, at least three moderators read Indonesian. The moderator list is signed by two of the three root key holders and is public, without names or email addresses. Each moderator can open only the evidence sealed for them, in the moderator console, which checks that the content really was written by the reported account. Evidence that fails that check is not used as the basis for a sanction. The reporter's category and note are the reporter's account of events, not evidence: moderators compare them with the content and choose the reason code of their decision themselves. Content is never scanned automatically, and every time a moderator signs in, reads a case, or makes a decision, the activity is recorded in the audit log. [Guidance on the level of sanction by the severity and repetition of a violation: awaiting the owner's decision]

12.3 Blocks

The consequences of each decision are set out in the Community guidelines. A block has consequences you should know in advance:

• a blocked account can only be used to view the moderation status, file an appeal, and sign out;
• the block is visible in the account's key chain, which is public, and other people's apps stop exchanging messages with it;
• event rooms the account opened are closed;
• a blocked account cannot be recovered through guardians and cannot be deleted early; it is deleted after 12 months of inactivity;
• an account three of whose sponsored accounts are blocked within a year can no longer be a sponsor.

In an emergency, for example when there is urgent danger, the owner of Patepang can block an account at once without waiting for a second moderator. Such an emergency block is also only made on a case that began with a report, comes with a reason code and a written reason, and can be appealed like any other decision.

12.4 Appeals

You can appeal once for each case, within 30 days after the decision. An appeal is reviewed by a moderator who was not involved in the first decision. The details are in the Community guidelines.

An appeal is filed from the moderation status in the app. If the decision is overturned, its sanction is lifted; if it is upheld, the case is closed. A reporter cannot appeal: they follow the status of the case through their receipt, without the evidence and without anyone's name, and are not told the outcome of an appeal. An appeal in the app does not take away your right to take the routes in section 22.

12.5 What is kept and what is deleted

A case that has been decided and not appealed within 30 days is closed. The author's statement and the sealed evidence are deleted when the case is closed, except while a block remains in force. The case record, namely the reported account, the decision, the written reason, the appeal status, and the block marker, is kept for as long as the reported account exists. Our transparency report counts decisions and appeals without naming anyone's account (Transparency).

12.6 Danger, crime, and requests from authorities

Patepang does not monitor content and cannot send help. If someone is in immediate danger, call emergency services at 112. Requests from law enforcement authorities and the government, and what we can and cannot provide, are explained on the Transparency page. [Handling of child sexual content, the sanctions for it, and reporting to the authorities: awaiting review by legal counsel] [The obligation to take content down on government orders under PM 5/2020, and how to carry it out for end-to-end encrypted content: awaiting review by legal counsel]

All of Patepang's features are free. A subscription (Rp49.000 per month or Rp499.000 per year in Indonesia) only increases media space on the server and file size. New subscribers get a 14-day free trial. A tip is a one-time payment and does not add features.

Purchases, automatic renewals, stopping, and refunds are processed by the App Store or Google Play, under that store's terms. The price that applies is the price the store shows when you buy. Deleting your account does not stop your subscription in the store. The details are in Subscriptions and payment.

In short:

• a free account gets 5 GB of media space, plus the second-meeting bonus of up to 10 GB, and files of up to 100 MB; a subscriber gets 100 GB and files of up to 4 GB;
• the free trial is given once for each store account; if it is not stopped before it ends, the subscription continues and is billed by the store;
• the subscription renews automatically every period until you stop it in the store's subscription settings, and then stays in effect until the end of the period already paid for;
• if the store fails to charge, your subscription enters the grace period the store gives, and during it your space and file size stay the same as a subscriber's;
• if the media you store exceeds your quota, for example after the subscription ends, new uploads are held; after 12 months, with warnings beforehand, the oldest media for updates, moments, and stickers is deleted until it fits, and account backups are never deleted because of the quota.

We do not receive and do not store your card, bank account, or payment method. A subscription is linked to your Patepang account through a random identifier, and cannot be shared through Family Sharing. A tip of Rp15.000, Rp50.000, or Rp150.000 is only counted in a daily total and is not recorded on your account.

Your rights as a consumer under Undang-Undang No. 8 Tahun 1999 tentang Perlindungan Konsumen (Law No. 8 of 1999 on Consumer Protection) still apply to every purchase. If there is a problem with a purchase that is not resolved through the store, write to [email protected]. [A running subscription while the account is suspended or blocked: awaiting a decision]

Patepang uses other parties' services, and you use some of those services directly too.

14.1 Providers who work for us

Patepang's servers run on Amazon Web Services in Singapore. Cloudflare sits in front of the servers, stores encrypted media and encrypted database backups, and serves our sites. Apple and Google deliver notifications and check that the app is genuine. The full list, and what each provider sees, is in Privacy policy section 8. Those providers work on our instructions, and using them does not transfer our responsibility to you.

14.2 Services you use yourself

• App stores. Your App Store or Google Play account, downloads, payments, and refunds are governed by that store's terms.
• Your phone and its operating system. The hardware key, biometrics, notifications, and photo picker are part of your phone. The Patepang app's data is stored in a place that is not included in the phone's system backup.
• The network. Most of Patepang's features need the internet. Your mobile operator's data charges and terms apply.
• Map apps and browsers. When you open a plan's place on a map, the place name is sent to the map app on your phone. Links in messages or updates open in your browser; the app shows only the address and does not fetch the site's content. Those sites and apps have their own terms.
• Where you keep files. You keep export files, evidence files, the opener page, and deletion codes in a place of your choice through the share sheet, such as cloud storage or email. That place's terms and security apply to your files there.
• Email. Emails you send us are received and stored by Zoho Mail.

When you use Patepang, you must also comply with the third-party terms that apply to you, for example your mobile data service agreement. We do not control other parties' services that you choose yourself (section 19).

[This section follows Apple's minimum terms for a developer's own end-user license agreement, and their equivalent for Google Play; its final wording: awaiting review by legal counsel]

15.1 If you download Patepang from the App Store

• These terms are an agreement between you and us only, not with Apple. We, not Apple, are responsible for the Patepang app and its content.
• Your permission to use the app applies on Apple-branded devices that you own or control, as permitted by the Usage Rules in the Apple Media Services Terms and Conditions, without reducing the rights AGPL-3.0 gives over its code (section 8). [How the App Store Usage Rules relate to AGPL-3.0 for an app that includes libsignal: awaiting review by legal counsel]
• We alone are responsible for maintaining and supporting the app. Apple has no obligation whatsoever to provide maintenance and support for this app.
• If the app does not conform to an applicable warranty, you can notify Apple, and Apple will refund the purchase price of the app to you, if any. To the extent permitted by law, Apple has no other warranty obligation with respect to this app. Any other claims, losses, or costs because the app does not conform to a warranty are our responsibility, not Apple's.
• We, not Apple, handle every claim from you or from a third party about the app or about your possession and use of the app, including product liability claims, claims that the app fails to meet a legal or regulatory requirement, and claims under consumer protection, privacy, or similar law.
• If a third party claims that the app, or your possession and use of it, infringes its intellectual property rights, we, not Apple, are responsible for the investigation, defense, settlement, and discharge of that claim.
• You state that you are not located in a country that is subject to a United States Government embargo or that the United States Government has designated as a terrorist-supporting country, and that you are not listed on any United States Government list of prohibited or restricted parties.
• Questions, complaints, or claims about the app are sent to us at the addresses in section 26. The telephone number for questions, complaints, and claims: +62 851-6101-1651.
• Apple and its subsidiaries are third-party beneficiaries of these terms. Once you agree to these terms, Apple has the right, and is deemed to have accepted the right, to enforce these terms against you as a third-party beneficiary.

15.2 If you download Patepang from Google Play

These terms are an agreement between you and us, not with Google. We are responsible for the Patepang app, its content, and its support. The Google Play Terms of Service govern your Google account, downloads, payments, and refunds through Google Play. [Other Google Play terms that need to appear in these terms, if any: awaiting review by legal counsel]

Patepang's name and logo are the marks that identify our service. These terms and the code license do not give you the right to use them, for example for another app or service, except as set out in the Intellectual property policy or as the law allows. Do not distribute a modified app with Patepang's name or logo in a way that makes people think it is our official app.

Patepang's code uses AGPL-3.0-only (section 8). Our app and sites also use other parties' open-source software, each under its own license, listed in Licenses and open source. App Store is a trademark of Apple Inc., and Google Play is a trademark of Google LLC. Rights not expressly granted by these terms, by the code license, or by law remain with us or their owners.

16.1 Feedback

If you send suggestions or feedback about Patepang, we may use them to improve Patepang without any obligation to pay you or name you. This does not apply to your account's content, which remains yours. If you report a vulnerability and want to be named, we credit you in the release notes and acknowledgements (Security).

16.2 Infringement of intellectual property rights

Content on Patepang is end-to-end encrypted, so we can only assess content that is reported to the moderators through the app (section 12). If you believe your intellectual property rights are being infringed through Patepang, write to [email protected]. [Procedure for notices of intellectual property infringement: awaiting the Intellectual property policy and review by legal counsel]

17.1 Availability

We try to keep Patepang running, but we cannot guarantee that the service will always be available without disruption, for example during maintenance, network disruptions, or disruptions at our service providers. We announce major disruptions on the status page.

The status page is at status.patepang.com and is run separately from Patepang's servers, so that it can still be opened when the servers are disrupted.

17.2 Changes to features

Features may be added, changed, or discontinued. We announce important changes on the status page and on patepang.com before they apply. If Patepang stops operating, we will announce it beforehand in the same way, so that you have time to export your data. [In-app notice and its time frame: awaiting a decision and review by legal counsel]

Export files are opened with an opener page that works without the internet, so files you have already saved can still be opened without our service. [Refunds of subscriptions already paid for if Patepang stops operating: awaiting a decision and review by legal counsel] [Treatment of a running subscription if its benefits change, in line with Article 18 of UU No. 8 Tahun 1999: awaiting review by legal counsel]

New versions of the app only come through the App Store or Google Play; the app from the store does not check for updates by itself. Some fixes, including security fixes, and the request for your consent to a new version of this document only reach you after you update the app. [Whether app versions that are too old may stop being served, and how this is announced: awaiting a decision]

17.3 Features not yet available, and test versions

If a feature is not yet in your version of the app, the app's screen says so. Test versions that we share directly with testers, outside the stores, may contain unfinished features and may stop working, and those versions ask the Expo service for updates (Privacy policy section 4.14). [Specific terms for testers of test versions: awaiting a decision]

18.1 By you

You can quit at any time by deleting your account, unless your account is blocked. Deletion has a 7-day grace period, during which it can be cancelled; then the account and its data are deleted as explained on the Delete account page, which also explains blocked accounts.

A deletion can also be scheduled with a deletion code (section 6.7). During the grace period, devices cannot be added or revoked, the emergency lock cannot be set, and recovery through guardians cannot be started.

18.2 By us

We can suspend or block an account that violates these terms or the community guidelines, with a written reason and a chance to appeal. An account that has not yet been born is deleted after 30 days, and an inactive account is deleted after 12 months.

Our heaviest sanction is a block. A born account only ends with a closing entry in its key chain, which other people's phones can check: an entry signed by your device when you delete your account, or an entry signed by the recovery enclave after the account has been inactive for 12 months. If Patepang stops operating, section 17 applies. [Action on an account because of a court order or another legal obligation: awaiting review by legal counsel]

18.3 What happens to your data

After the 7-day grace period, the server deletes everything connected with your account, including devices, messages not yet collected, tempels, guardians, the backup, group and room memberships, media, subscription status, and moderation cases about your account. What remains is a closing record for 12 months, so that other people's phones know your account has ended; the entries in the key transparency log, which are permanent; and copies in database backups for up to 40 days. Messages and media on other people's phones stay on their phones. The full list is on the Delete account page.

18.4 What remains in force

After this agreement ends, the parts that by their nature must survive remain in force for things that happened before your account ended, in particular sections 10.3 to 10.5 on content already sent, section 19 on liability, section 20 on force majeure, sections 21 and 22 on law and disputes, and section 24.

We are liable for losses arising from our fault or negligence, in accordance with applicable law. No part of these terms reduces your rights as a consumer under Undang-Undang No. 8 Tahun 1999 tentang Perlindungan Konsumen (Law No. 8 of 1999 on Consumer Protection), or transfers liability that by law may not be transferred.

In line with Article 18 of that law, these terms contain no standard clause that transfers our liability to you. If any sentence in these terms or in the documents that form part of them can be read that way, that sentence does not apply to the extent that it conflicts with that law.

19.1 What we cannot promise

We run Patepang with care, but no system is free of risk. So that you can judge for yourself, these are the limits we already know of:

• a tempel proves that two phones were shaken together, or that two people deliberately worked together from afar to imitate it; a tempel does not prove who the person is;
• an event room's host can admit people who are not there;
• a phone that has been broken into can read anything shown on its screen;
• the server knows the relationships between accounts, and Cloudflare, Apple, and Google see some metadata, as explained in the Privacy policy;
• a security audit by an outside party is a requirement before the public launch and has not yet been done.

The limits that concern guardians are in section 6.3, and the limits on content that has already reached other people's phones are in section 10.3. This explanation is information, not an exclusion of liability: if a loss arises from our fault or negligence, the first sentence of this section still applies. The details are on the Security page.

19.2 What we are not liable for

We are not liable for:

• content sent by other people, although we follow up on every report;
• losses because you gave your PIN, the six export words, or your device to someone else, or lost all your devices without guardians;
• content that can no longer be opened because your travel mode or export six words were lost;
• disruptions to other parties' services that are beyond our control, such as app stores, mobile networks, or your own phone.

[Other disclaimers of warranty and exclusion of indirect losses, to the extent the law allows: awaiting review by legal counsel]

19.3 Your responsibility

You are responsible for how you use Patepang and for the content you send. If you violate these terms or the law, and another party makes a claim against us because of it, you bear the losses that arise from your own violation, to the extent the law allows. This provision does not make you bear losses caused by our fault or negligence. [Form and limits of compensation from a user to us: awaiting review by legal counsel]

[Limit on the amount of liability, if any: awaiting review by legal counsel]

We are not considered to be in breach of these terms if we cannot carry out an obligation because of force majeure beyond our reasonable control, for example natural disasters, fires, epidemics, war, riots, widespread power or internet outages, major outages at providers that we could not prevent, or government action. While such circumstances last, we announce them on the status page, try to limit their effects, and restore the service as quickly as possible.

Force majeure does not remove our obligation to give notice of a personal data breach (Privacy policy section 14), and does not reduce your rights as a consumer. [Compensation for subscribers if the service stops for a long time: awaiting a decision] [Final wording of force majeure: awaiting review by legal counsel]

These terms are governed by the law of the Republic of Indonesia. These terms are written in Indonesian; their English translation is on this site, and for users in Indonesia, the Indonesian version is the one that applies. [The language version and the law that apply to users outside Indonesia: awaiting review by legal counsel]

The processing of your personal data is governed by Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (Law No. 27 of 2022 on Personal Data Protection), as explained in the Privacy policy. Your rights as a consumer are governed by Undang-Undang No. 8 Tahun 1999 tentang Perlindungan Konsumen.

If there is a problem, contact us first at [email protected], so that we can settle it together through discussion.

Write what the problem is, when it happened, and what you are asking for. Do not include your PIN, six words, deletion code, or other people's conversations. Because we do not know who owns an account, for a problem about a particular account we may ask you to use a route in the app, for example an appeal against a moderation decision. [Time within which we answer complaints: awaiting a decision]

If the discussion does not succeed, you have the right to settle the dispute through the Badan Penyelesaian Sengketa Konsumen (BPSK, the Consumer Dispute Settlement Body) or through the courts, in accordance with UU No. 8 Tahun 1999. For disputes in court, the parties choose the Cibinong District Court (Pengadilan Negeri Cibinong), without reducing your rights under the applicable procedural law.

For purchases, also raise the problem with the App Store or Google Play, which process your payment. Discussion with us and a complaint to the store do not take away your right to go to the BPSK or to court.

23.1 From us to you

We do not store your name, email address, or phone number, so we cannot contact you by email, text message, or phone, except to reply to an email you send. We notify you through:

• the app: the consent step for a new version of this document, moderation decisions, recovery warnings, warnings of a scheduled deletion, and Notices from Patepang in Settings, for events on the server that concern your data;
• notifications, if you allow them, for example moderation decisions, the reminder for an inactive account, and quota warnings;
• the status page and patepang.com, for major disruptions, important changes, and personal data breaches.

Notices from Patepang are checked by your app with keys built into it, read when the app is opened, and written in Indonesian. Nothing wakes a closed phone, so such a notice appears when you open Patepang. [Whether in-app notices and the status page are enough as written notice under the law: awaiting review by legal counsel]

Patepang never asks for your PIN, six words, deletion code, or account id by email, message, or phone. A message that asks for them is not from us.

23.2 From you to us

Send notices, complaints, and requests to [email protected] or to the postal address in section 26, and vulnerability reports to [email protected]. Reports about content and appeals against moderation decisions are made in the app, because only your app can seal evidence for the moderators and prove that the account is yours (section 7.3).

• If part of these terms is declared invalid, the other parts remain in force.
• If we do not enforce a right, that does not mean we waive it.
• These terms, together with the Community guidelines, the Subscriptions and payment terms, and the Privacy policy, are the entire agreement between you and us about Patepang.
• You may not transfer your account, or your rights and obligations under these terms, to anyone else. [Transfer of this agreement by us, for example in a merger or acquisition of the company, and notice of it: awaiting review by legal counsel]
• These terms do not create a partnership, agency, or employment relationship between you and us.
• Apart from Apple and its subsidiaries (section 15.1), no other party gains rights from these terms.
• Section headings are only there to make reading easier and do not change the meaning of these terms.

These terms may change. We announce important changes on this page and on the status page before they come into force. When you open a version of the app that carries a new version of these terms, the app shows the documents that changed, marked Updated, and asks for your consent again; the record is stored on your phone like your first consent (section 3). [How long before a change applies it is announced: awaiting a decision and review by legal counsel] [Which version applies to people who have not updated the app, and whether small changes may be announced without asking for consent again: awaiting a decision and review by legal counsel] If you do not agree with those changes, you can stop using Patepang and delete your account. The date at the top of the page shows the last change.

That date is the document's version, that is, the date that version comes into force, and it is the same as the version the app records when you agree to it. Every version that is published can still be read at its own address, through the list of versions at the end of this page and the index of legal documents. Changes can come, for example, when new features arrive, when the law changes, or after review by legal counsel.

General questions: [email protected], or call +62 851-6101-1651. Legal matters: [email protected]. Post: PT Pakuan Teknologi Pangrango, Jl. Cihideung Udik RT 004/RW 009, Desa Cihideung Udik, Kecamatan Ciampea, Kabupaten Bogor, Jawa Barat 16620, Indonesia.

Vulnerability reports: [email protected]. Questions, complaints, and claims about the app, including those named in section 15, go to the same address as general questions. Other addresses are on the Contact page.

Every version that is published stays at its own address. The address without a date, legal.patepang.com/terms, shows the version in force. While this document is a draft, both addresses show the draft.