Privacy Policy — Sutampa
1. Who we are
Sutampa is provided by Saifullah Ahad. Contact [email protected] or visit saifullah.ai.
2. What Sutampa does
Sutampa lets two aid organizations compare household registers and identify records present in both without exchanging their complete source lists. It supports comparison over a local Wi-Fi connection or an optional encrypted relay.
3. Data stored on your device
The app stores the organization name you enter, household head and other-member names, coarse area, household-size band, partner identities, comparison events, shared rows, and signed receipts in an encrypted SQLCipher database in the app's private Android storage. A random database passphrase is protected by Android Keystore. Backup and device transfer are disabled.
Each installation creates a device-bound signing identity. Optional PIN material is stored only as a salted password-derived value. If biometric lock is enabled, Android performs the biometric match; Sutampa does not receive or store biometric templates.
4. Data disclosed during a comparison
The selected partner receives your organization identity, device public-key identity, the count of households included, cryptographic protocol values, the final shared count, and signed consent, refusal, and receipt metadata. Each participant sees only the matching rows from its own local register. The other organization's non-matching household rows are not disclosed.
Data minimization: registers are compared with a reciprocal oblivious pseudorandom function protocol. Protocol lists are padded to a fixed size, and transport messages use fixed sizes. This reduces information exposed by list and result sizes but cannot prevent disclosure caused by screenshots, modified software, colluding identities, or information already known to a participant.
5. Optional relay processing
Relay mode sends fixed-size, end-to-end encrypted protocol frames to a Cloudflare Worker and SQLite-backed Durable Objects. The relay does not receive decryption keys, household records, organization names, list counts, shared counts, or signed receipts in readable form.
The service stores random session codes, one-way hashes of invitation and access tokens, expiry and join-attempt metadata, and encrypted frames. A session is deleted after both participants retrieve the final frame, after both close it, or no later than 24 hours after creation. An IP-derived one-way daily bucket and a count are stored for up to 26 hours to limit session creation. Cloudflare and network providers necessarily process connection metadata such as IP address to deliver and protect requests.
6. Reporting and support
Report this comparison opens your chosen email app with only a run identifier and partner fingerprint in the draft. Household names are never attached by Sutampa. Nothing is sent unless you choose to send it, and your email provider then handles the message under its own terms.
7. Permissions
INTERNET: connect directly to a selected partner on the local network or use the optional encrypted relay.USE_BIOMETRIC/ fingerprint compatibility: authenticate locally only after you enable biometric app lock.
The app does not request contacts, location, camera, microphone, SMS, call logs, advertising ID, or broad file access. CSV import uses Android's system document picker for the file you select.
8. Sharing, advertising, and analytics
Sutampa does not sell personal data and contains no advertising, analytics, account, social-profile, billing, or crash-reporting SDK. Data is shared only with the partner you select and, when relay mode is chosen, processed by Cloudflare as described above. Google Play distributes the app and handles its own store and device telemetry under Google's policies.
9. Retention and deletion
Local records remain until you delete a household, choose Delete all Sutampa data, clear app storage, or uninstall. The in-app deletion action erases the encrypted register, comparison history, app-lock settings, protected database key, and device signing identity. Relay data follows the short retention periods in section 5. For help with an emailed report, contact [email protected].
10. Security and limits
Sutampa uses encrypted local storage, Android Keystore, HTTPS for relay traffic, end-to-end encrypted frames, signed protocol records, fixed-size padded exchanges, replay checks, minimum-list rules, and partner attempt limits. No system can guarantee absolute security. Coordinators should confirm the partner and pairing code in person or through a trusted channel and review all shared rows before acting.
11. Children and household data
Sutampa is intended for authorized aid coordinators and is not directed to children. Household registers may contain names entered by organizations, so users must have an appropriate legal and safeguarding basis before entering or comparing them. Child sexual abuse and exploitation content or behavior is prohibited. Read the separate Child Safety Standards.
12. International processing
Cloudflare may process relay service data in countries other than yours. By choosing relay mode, you direct that processing as described above. Direct local comparison does not use the Sutampa relay.
13. Changes
Material changes will be posted at privacy.saifullah.ai/sutampa.html with a revised effective date.
14. Contact
Saifullah Ahad · Dhaka, Bangladesh
[email protected]