Contents
African Shilling is built to hold as little about you as possible. We never learn your name, your email address, your date of birth, or where you live beyond which country you selected. Your phone number and your ID number are never stored — only fingerprints of them, each computed with a secret key held by the server. Without that key they cannot be worked backwards to the originals, so a copy of our database on its own reveals neither. There are no advertising cookies, no analytics scripts, and no third-party trackers on this site of any kind.
Everything held about you, field by field:
That is the complete list. Nothing else about you is stored.
We do not collect or store your name, email address, date of birth, home address, GPS or precise location, photographs, scans or copies of identity documents, bank details, or card details. We do not ask for them anywhere in the app, and we have no way to obtain them.
This is the section to read carefully, because it is the one thing that cannot be undone. When your claim is written to the Celo blockchain, two things are published permanently and publicly: the wallet address created for you, and the amount of AFS claimed. Anyone in the world can read them, forever — that is how a public blockchain works, and the record cannot be edited or deleted by us or by anyone else. Your phone number, your PIN and your country are never written to the blockchain at all. The keyed fingerprint of your ID number is — it is what stops the same ID claiming twice — but because it is computed with a secret key, it cannot be turned back into your ID number by anyone reading the chain. Your country used to be published alongside every claim; we removed it, because nothing needed it.
We set exactly one cookie: your session. It holds a signed token, is marked httpOnly (so page scripts cannot read it), is sent only over HTTPS, and expires after 7 days. It exists so you stay signed in. We set no advertising cookies, no analytics cookies, and no third-party cookies. There is nothing to opt out of because there is nothing else being set.
Our web server keeps a standard access log, which records the IP address of each request along with the page requested and the time. These logs rotate daily and are deleted after 14 days. They are used for diagnosing faults and spotting abuse. Your IP address is never written to our database, never linked to your account, and never used to limit how often you can act — those limits are keyed on the same one-way fingerprints described above, never on where you are connecting from.
These are the services that handle data on our behalf, and what each one can see:
Your account record and ledger history are kept for as long as the account exists, because the ledger is the record of what you own — deleting an entry would destroy the accounting that proves your balance. Server access logs are deleted after 14 days. Anything already written to the blockchain is permanent and outside anyone's control, including ours.
The private key of the wallet created for you is encrypted using a managed hardware key service before it is stored, and the raw encryption key never enters the application. The app deliberately contains no code path that decrypts a wallet key — the ability to decrypt exists at the infrastructure level for recovery, but nothing in the running application can spend from your wallet.
This page describes how the app works today. When the app changes, this page is updated to match. It is not a promise about the future — it is a description of the present, and it is only useful if it stays accurate.
Questions about anything on this page can go to [email protected].