Privacy Policy — Simpulan

Plain-language summary: Simpulan never moves money. Names, exact amounts, dates, reasons, and notes are readable only on participating devices. If you enable a clearinghouse, the app also keeps a client-side encrypted recovery copy that can be opened only with your recovery code. The service uses pseudonymous graph data and coarse amount bands to find possible clearing loops.

1) Who we are

Simpulan is provided by Saifullah Ahad (“we”, “us”, “our”). Contact us at [email protected] or visit saifullah.ai.

2) What Simpulan does

Simpulan lets adults in a closed, trusted group record obligations that both people approve. It can propose equal reductions around a directed cycle without paying, lending, collecting, transferring, or holding money. Every participant must sign the exact same clearing before it applies.

3) Information kept on your device

The following information is stored locally and encrypted with keys protected by Android Keystore:

• Names you assign to a clearinghouse and paired people.
• Exact obligation amounts, dates, agreed reasons, optional notes, and cryptographic commitment openings.
• Your private signing and key-agreement material. Private signing keys are non-exportable.
• Your local activity trail, preferences, and clearing certificates.

Android system backup is disabled for Simpulan. Clearing app storage or uninstalling removes the copy on that device. A separately encrypted Simpulan recovery copy remains on the clearing service until it is replaced or deleted as described below.

4) Information processed by the clearing service

To provide private matching and abuse protection, our Cloudflare-hosted service processes:

• Random clearinghouse identifiers, invite-code hashes, and pseudonymous member identifiers.
• P-256 public keys, dual signatures, cryptographic commitments, coarse magnitude buckets, arc direction, state, and sequence numbers.
• End-to-end encrypted relay payloads for a proposed obligation. These expire after seven days if not accepted.
• Masked-comparison shares, clearing proposals, all-member completion certificates, blocks, and safety reports.
• A client-side encrypted recovery snapshot containing that member's local records, plus a one-way recovery verifier. The recovery code and the snapshot encryption key are never uploaded.
• Current and retired public signing keys needed to verify records after a device is recovered. Private keys are never uploaded.
• A Firebase Cloud Messaging registration token, stored separately, only to wake the app for sync. Firebase also processes a per-installation ID, app version, and basic app/device metadata needed to provide Cloud Messaging.
• Short-lived sessions, one-time authentication challenges, network addresses used temporarily for rate limiting, and operational request/error telemetry needed to authenticate requests and protect the service.

The service is not sent readable names, exact amounts, dates, reasons, ordinary notes, private keys, commitment openings, recovery codes, or recovery encryption keys.

5) Pair-to-pair notes and reports

An optional note is encrypted for the other participant before relay. The service cannot routinely read it. If you deliberately report a note, the app creates a separate evidence package encrypted to the developer’s moderation public key. Only the corresponding moderation private key can open that evidence for safety review. The report also includes a category, pseudonymous parties, and a content digest.

6) Feedback

If you choose “Send feedback”, Simpulan opens your email app with a draft addressed to the developer. You decide whether to send it, and your email provider handles the message under its own terms. Do not include obligation details or sensitive financial information.

7) Permissions

• INTERNET connects to the clearing service and Firebase Cloud Messaging. Support links and feedback open in external apps.
• ACCESS_NETWORK_STATE helps avoid network work while the device is offline.

Simpulan does not request contacts, camera, microphone, location, storage, SMS, phone, calendar, accessibility, biometric, or notification permission.

8) Service providers and disclosure

We use Cloudflare for API, database, encrypted relay and recovery storage, coordination, security, and operational telemetry, and Google Firebase Cloud Messaging for data-only sync wakes. These providers process data for us under their own security and privacy terms. We do not sell data, serve advertising, build marketing profiles, or share data with data brokers.

We may preserve or disclose information when reasonably necessary to comply with law, protect a child or another person from harm, investigate abuse, or defend the service. Because ordinary note content is end-to-end encrypted, we may not possess readable content unless a participant reports it.

9) Retention and deletion

• Unaccepted encrypted obligation relays expire after seven days.
• Push tokens expire after 30 days unless refreshed.
• The latest encrypted recovery snapshot remains until it is replaced by a newer snapshot or deleted after a verified request. One-time recovery and session challenges are valid for ten minutes.
• Dual-signed graph records, certificates, blocks, and audit entries remain while needed to operate and secure the clearinghouse.
• Retired public signing keys remain while needed to verify previously signed records and preserve ledger integrity.
• Reports and encrypted evidence remain only as long as needed for review, enforcement, legal obligations, and abuse prevention.

Use Settings → “Remove all local Simpulan data” for device data; this does not delete the encrypted server recovery copy. For server-side access or deletion requests, email [email protected] with “Simpulan privacy request” in the subject. We may ask for a signed challenge so one member cannot delete another member’s records.

10) Security and integrity

Simpulan uses TLS in release builds, Android Keystore, AES-GCM local and recovery encryption, P-256 signatures and key agreement, pair-to-pair sealed payloads, Pedersen commitments, replay-resistant sequences, and all-member signed completion certificates. Recovery replaces the lost device's active session and rotates its signing key. Keep the recovery code private: anyone who has it can replace that device's access and decrypt its recovery snapshot. No system is perfectly secure; please keep your device updated and protected.

11) Children

Simpulan is intended only for adults aged 18 and older and is not directed to children. Child sexual abuse and exploitation are prohibited. See the separate Simpulan Child Safety Standards.

12) International processing

Cloud service providers may process information in countries other than yours. We use the minimum service-visible information required and protect data in transit.

13) Changes

We may update this policy when the app, law, or service changes. The current version will remain at privacy.saifullah.ai/simpulan.html with a revised effective date.

14) Contact

Saifullah Ahad
Email: [email protected]
Website: https://saifullah.ai
Location: Dhaka, Bangladesh