Rembug Privacy Policy

1) Who provides Rembug

Rembug is provided by Saifullah Ahad ("we", "us", "our"). Contact [email protected] or visit saifullah.ai.

2) What Rembug does

Rembug helps adult relatives compare the full cost of care choices and make one invite-only family decision. Members can privately state what they can contribute in money, time, or a room, grade the choices, and keep a signed record. Rembug does not provide medical, legal, or financial advice and does not hold or move money.

3) Information kept on your device

• Cost preparation: care-option wording and cost inputs remain in app memory while you compare them. The worked example is built into the app.
• Round records: joined rounds, this installation's member state, readable local copy of the family record, your own private capacity and calculated part, pending network entries, signatures, and exported records you choose to save.
• Security material: the join-code secret, cryptographic identity and agreement keys, and locally sealed round secrets. Sensitive stored values are protected using Android Keystore.
• App lock: a salt and one-way verification hash for the 4–8 digit number you choose. Android performs biometric matching; Rembug receives only success or cancellation, never a fingerprint template.

Android cloud backup is disabled. Local app data remains until you clear Rembug's storage or uninstall it. A signed family record is deliberately append-only inside the app and is not presented as editable history.

4) Information processed for an invite-only family round

Using only the cost-comparison screens sends nothing anywhere. Opening or joining a family round sends limited coordination data to Rembug's Cloudflare-hosted relay:

• a thirteen-character random round identifier derived from a hash of the join-code secret; the secret itself is never sent;
• the fixed decision deadline, member count, creation time, ordered position, and timing of each appended record; and
• opaque encrypted blobs containing the round protocol record.

The encrypted family record can include member-chosen display names, the question, care options, grades, capacity shares, group totals, the result, and signatures. It is encrypted on the device with a key derived from the join code. Individual capacity numbers are additionally split into random recipient-specific shares before transmission.

Service boundary: the relay has no account, user, device, phone, email, capacity, grade, option, result, or payment field. It cannot derive the join code from the round identifier and cannot decrypt the blobs.

5) What invited family members can learn

People who receive the join code can decrypt the shared round record needed to participate. The app reveals the family question, options, group totals, feasible choices, shared result, and signatures at the protocol's proper stage. It never shows one member another member's readable capacity or personal calculated part. At the fixed deadline, it may state that somebody marked a choice "I really cannot" without naming that person.

Anyone who has the join code can enter the round until its configured member places are full. Share it only with the intended relatives. With two participants, one person's hidden amount can be inferred from the total and the other's amount; Rembug warns about this and refuses to claim that a two-person split is hidden.

6) Why information is used

• Open, join, synchronise, and complete an invite-only family round.
• Enforce the fixed deadline so answers cannot be revealed early.
• Route encrypted shares and maintain one ordered, append-only record.
• Calculate group feasibility, a majority-judgment result, and each device's own part.
• Prevent conflicting writes and limit malformed or oversized requests.

7) Service provider and disclosure

Cloudflare Workers, Durable Objects, and D1 operate the relay and database. Cloudflare may process ordinary connection information such as IP address and request timing to deliver and secure requests. The Rembug application does not write IP addresses to its database and does not include analytics, advertising, crash-reporting, social-login, or tracking SDKs.

We do not sell personal information or share it for advertising. Encrypted round content is delivered only to people using the same join code, as the user-directed purpose of the feature. We may disclose narrowly necessary information if required by law or to protect the service from abuse or security threats.

8) Retention and deletion

The relay stores the fixed round facts and opaque encrypted record for service operation. The current service has no account system and no remote deletion endpoint, so an accepted server record is not editable or deletable from the app. Because the relay has no identity directory, an email address alone cannot identify a person's round. A privacy request concerning relay data should include the round identifier shown by the app; never email a join-code secret or private capacity value.

Clear Rembug's storage or uninstall it to remove its local records and lock data. Files you deliberately export are controlled by the destination you selected and must be deleted there. Cloudflare infrastructure and security logs follow Cloudflare's operational retention practices.

9) Security

Network requests use HTTPS. Round blobs use AES-256-GCM encryption under a key derived from a 120-bit random join-code secret. Recipient-specific capacity shares use X25519 key agreement, and record entries use Ed25519 signatures and an append-only hash chain. Android Keystore protects local secrets. No security method is absolute; keep the join code within the intended family and protect access to each device.

10) Your choices

• Use the cost comparison without opening a networked round.
• Choose a non-sensitive display name and share a join code only with intended relatives.
• Use the local app number, and use fingerprint unlock only when the device offers it.
• Export a signed record only through an Android destination you select.
• Clear app storage or uninstall Rembug to remove local data.
• Email [email protected] with privacy questions or requests.

11) Children's privacy

Rembug is intended for adults making family care decisions and is not directed to children under 13 or the equivalent minimum age in a jurisdiction. We do not knowingly seek personal information from children.

12) International processing, changes, and contact

Cloudflare may process service data in countries other than yours under its applicable safeguards. We may update this policy when Rembug's practices or legal obligations change; the effective date will be updated at this same URL.

Saifullah Ahad
Email: [email protected]
Website: https://saifullah.ai
Location: Dhaka, Bangladesh