Musaya Privacy Policy

Who provides Musaya

Musaya is provided by Saifullah ("we", "us"). Contact [email protected] or visit saifullah.ai.

What Musaya does

Musaya calculates the seasonal walking caused by a farmer's scattered strips. Invited neighbours may also use a temporary, private group to find a mutually acceptable arrangement about who cultivates which strip for one season. Musaya does not determine ownership, establish an official boundary, provide legal advice, or enforce an arrangement.

Information kept only on your phone

The following information is stored locally and is not sent to us. It is not sent to other group members either, except the strip details described below this list:

• your approximate homestead point;
• parcel labels, entered area, coarse point or boundary geometry, soil, water and access details;
• your either-or comparison answers and the preference weights learned from them;
• your Musaya PIN hash and app settings;
• the random identifiers of any members you block; and
• completed seasonal records and this phone's signatures.

The one exception is a choice you make: when you show a strip's code for another group member to scan, the code on your screen carries your group code, your random member identifier, and that strip's label, area, one map point, and its soil, water and road access details. The member who scans it with Musaya receives exactly those details.

Android removes this local information when you clear Musaya's storage or uninstall it, subject to your device's own backup settings. Musaya disables Android app backup.

Location permission

Musaya requests coarse and precise location only if you choose Walk boundary while adding a strip. It uses the location on your phone to drop coarse boundary points. Location and geometry are not uploaded. You can deny the request and continue with Area + point or Tap corners.

Information processed for private neighbour groups

Using neighbour rounds sends limited coordination data to the Musaya service hosted by Cloudflare:

• a random eight-character group code, opaque group and participant identifiers, hashed access tokens, device public keys and join/expiry times;
• opaque parcel identifiers and positive adjacency confirmations from two distinct group members;
• during an active round, commitment hashes and the minimum opaque acceptance edges needed to clear it, walking-hour benefit, and hard yes/no feasibility results;
• for a possible ring, opaque member identifiers, encrypted all-member shares and accept/wait states; and
• a Firebase Cloud Messaging routing token. FCM messages contain only a content-free event type telling the app to check the service.

Never uploaded: names, phone numbers, email addresses, contacts, village names, homestead location, parcel geometry, private comparison answers, learned preference weights, ownership or title records.

Cloudflare processes coordination data to operate private groups and rounds. Google Firebase processes routing tokens and content-free data messages to wake the app. We do not use Analytics, advertising, crash reporting, Firestore, cloud storage, user accounts, or public profiles.

Sharing

We do not sell personal data. Limited data is disclosed only to Cloudflare and Google Firebase as service providers needed to deliver the neighbour-round features, or when legally required. Group members receive ring contents only after every member accepts. One decline dissolves the proposal without revealing its members or strips.

Retention

• Raw round commitments and reveals are erased when a round closes.
• A declined proposal is erased immediately. Other proposal coordination is erased no later than seven days after round close.
• Hashed round-deletion records are erased after 30 days.
• Invite-code routing records expire after 365 days.
• Leaving a group clears its credentials and received candidate strips from your phone; it does not erase a group for other members.

Your controls and deletion

You can deny or revoke location in Android Settings, leave a private group in Musaya, clear the app's storage, or uninstall the app. Server round data expires automatically as described above. For a privacy question or deletion request concerning server coordination data, email [email protected]. Because Musaya has no identity account and uses opaque identifiers, we may need the group information available on your phone to locate a record.

Security

Group routes require an invite code and a 256-bit bearer token. Tokens are stored server-side only as SHA-256 hashes. Requests use encrypted HTTPS and no-store responses. Private transport and signing keys remain non-exportable in Android Keystore. Ring contents are split into all-member shares and released only after unanimous acceptance. No method of storage or transmission is completely secure.

Children's privacy

Musaya is intended for adults arranging seasonal cultivation. It is not directed to children under 13, and we do not knowingly collect personal information from children.

Child sexual abuse and exploitation (CSAE), including child sexual abuse material (CSAM), is prohibited in Musaya. See the separate Musaya Child Safety Standards for how to report a strip name or ring offer, how to block a member, and how reports are handled.

The Report action opens your chosen email app with a draft addressed to the developer. The draft names the reported item and includes its details, such as the strip name. Musaya does not transmit the report itself: nothing is sent unless you send the email, and then your email provider and the developer receive it. Block this member stores that member's random identifier in Musaya's storage on your phone and does not notify the member. It stays there until you clear Musaya's storage or uninstall it.

International processing

Cloudflare and Google may process limited coordination data in countries other than yours under their applicable safeguards.

Changes and contact

We may update this policy as Musaya changes. The effective date above will be updated. Questions can be sent to [email protected].