Privacy

Contents

  1. The short version
  2. What we store about you
  3. What we never collect
  4. What becomes public on the blockchain — permanently
  5. Cookies
  6. Server logs and your IP address
  7. Who else handles your data
  8. How long we keep it
  9. Security of the wallet key
  10. Changes to this page
  11. Contact

1. The short version

African Shilling is built to hold as little about you as possible. We never learn your name, your email address, your date of birth, or where you live beyond which country you selected. Your phone number and your ID number are never stored — only fingerprints of them, each computed with a secret key held by the server. Without that key they cannot be worked backwards to the originals, so a copy of our database on its own reveals neither. There are no advertising cookies, no analytics scripts, and no third-party trackers on this site of any kind.

2. What we store about you

Everything held about you, field by field:

Phone number
Stored as a keyed fingerprint (HMAC-SHA256), never as the number itself. It is your account identifier and what you sign in with. The calculation uses a secret key that only our server holds, so the fingerprint cannot be worked backwards to your number — which also means we cannot text or call you.
National ID number
Stored as a keyed fingerprint (HMAC-SHA256) of your country code together with your normalised ID number. It exists so the same ID cannot claim twice, and so your identity can be checked if you forget your PIN. Because the calculation uses a secret key that only our server holds, nobody else can work out your ID number from the fingerprint — including from the copy of it published on the blockchain.
PIN
Combined with a secret key held by the server and then stored as a bcrypt hash. The key matters: a PIN is only four digits, so a bcrypt hash alone could be guessed by anyone who obtained our database. With the key they cannot even begin. We cannot reverse it either, which is why a forgotten PIN has to be reset rather than looked up.
Country
Stored as the two-letter code you selected, so we know which ID format to check and which countries people are joining from. It is kept in plain form in our database, and it is not published on the blockchain. See section 4.
Wallet address and encrypted key
The address of the wallet created for you, and its private key in encrypted form. See section 9.
Your balances and history
Every claim, transfer, saving and reward is a double-entry record with an amount and a timestamp. This ledger is what your balance is calculated from.
Referral link data
Your own invite code, and — if you joined through someone else’s link — a reference to the account that invited you, so their reward can be paid.
Settlement details
Whether your claim has been written to the blockchain yet, the transaction reference once it has, and any error if it failed.

That is the complete list. Nothing else about you is stored.

3. What we never collect

We do not collect or store your name, email address, date of birth, home address, GPS or precise location, photographs, scans or copies of identity documents, bank details, or card details. We do not ask for them anywhere in the app, and we have no way to obtain them.

4. What becomes public on the blockchain — permanently

This is the section to read carefully, because it is the one thing that cannot be undone. When your claim is written to the Celo blockchain, two things are published permanently and publicly: the wallet address created for you, and the amount of AFS claimed. Anyone in the world can read them, forever — that is how a public blockchain works, and the record cannot be edited or deleted by us or by anyone else. Your phone number, your PIN and your country are never written to the blockchain at all. The keyed fingerprint of your ID number is — it is what stops the same ID claiming twice — but because it is computed with a secret key, it cannot be turned back into your ID number by anyone reading the chain. Your country used to be published alongside every claim; we removed it, because nothing needed it.

5. Cookies

We set exactly one cookie: your session. It holds a signed token, is marked httpOnly (so page scripts cannot read it), is sent only over HTTPS, and expires after 7 days. It exists so you stay signed in. We set no advertising cookies, no analytics cookies, and no third-party cookies. There is nothing to opt out of because there is nothing else being set.

6. Server logs and your IP address

Our web server keeps a standard access log, which records the IP address of each request along with the page requested and the time. These logs rotate daily and are deleted after 14 days. They are used for diagnosing faults and spotting abuse. Your IP address is never written to our database, never linked to your account, and never used to limit how often you can act — those limits are keyed on the same one-way fingerprints described above, never on where you are connecting from.

7. Who else handles your data

These are the services that handle data on our behalf, and what each one can see:

Our database host
Stores everything listed in section 2, in the form described there.
A managed hardware key service
Encrypts and decrypts wallet keys. It never sees your phone number, ID or PIN.
Our network provider
Sits in front of the site to serve it quickly and absorb attacks. It terminates the HTTPS connection, which means it can see the full contents of each request — including your ID number, phone number and PIN as you send them — as well as your IP address and the page requested. It also forwards email sent to our contact address.
A blockchain node provider
Relays our reads and writes to the Celo network. It sees wallet addresses and transactions — the same information that is public on the blockchain anyway.
The Celo blockchain itself
Public and permanent. See section 4.

8. How long we keep it

Your account record and ledger history are kept for as long as the account exists, because the ledger is the record of what you own — deleting an entry would destroy the accounting that proves your balance. Server access logs are deleted after 14 days. Anything already written to the blockchain is permanent and outside anyone's control, including ours.

9. Security of the wallet key

The private key of the wallet created for you is encrypted using a managed hardware key service before it is stored, and the raw encryption key never enters the application. The app deliberately contains no code path that decrypts a wallet key — the ability to decrypt exists at the infrastructure level for recovery, but nothing in the running application can spend from your wallet.

10. Changes to this page

This page describes how the app works today. When the app changes, this page is updated to match. It is not a promise about the future — it is a description of the present, and it is only useful if it stays accurate.

11. Contact

Questions about anything on this page can go to [email protected].

← Back to home