Contents
African Shilling is built to hold as little about you as possible. We never learn your name, your email address, your date of birth, or where you live beyond which country you selected. Your phone number and your ID number are never stored — only fingerprints of them, each computed with a secret key held by the server. Without that key they cannot be worked backwards to the originals, so a copy of our database on its own reveals neither. There are no advertising cookies, no analytics scripts, and no third-party trackers on this site of any kind.
Everything held about you, field by field:
Short-lived counters: how many wrong PINs were entered against your phone fingerprint in the last hour, kept in memory and discarded after that. That is everything stored with your account. Short-lived counters tied to network addresses are described in section 6.
We do not collect or store your name, email address, date of birth, home address, GPS or precise location, photographs, scans or copies of identity documents, bank details, or card details. We do not ask for them anywhere in the app, and we have no way to obtain them.
This is the section to read carefully, because it is the one thing that cannot be undone. When your claim is written to the Celo blockchain, three things are published permanently and publicly: the wallet address created for you, the amount of AFS claimed, and a random reference number that marks your claim as used. Anyone in the world can read them, forever — that is how a public blockchain works, and the record cannot be edited or deleted by us or by anyone else. The reference number is random: it is not made from your ID number and cannot be traced back to it. Your phone number, your PIN, your country and your ID number are never written to the blockchain, not even as a fingerprint. Your country used to be published alongside every claim; we removed it, because nothing needed it.
We set exactly one cookie: your session. It holds a signed token, is marked httpOnly (so page scripts cannot read it), is sent only over HTTPS, and expires after 7 days. It exists so you stay signed in. We set no advertising cookies, no analytics cookies, and no third-party cookies. There is nothing to opt out of because there is nothing else being set.
Our web server keeps a standard access log, which records the IP address of each request along with the page requested and the time. These logs rotate daily and are deleted after 14 days. They are used for diagnosing faults and spotting abuse. Your IP address is never written to our database or linked to your account. To slow down automated guessing, we also count how many times each IP address uses the login, PIN-recovery and claim forms. These counts are kept in memory for five minutes and then discarded, and they are never linked to your account.
These are the services that handle data on our behalf, and what each one can see:
Your account record and ledger history are kept for as long as the account exists, because the ledger is the record of what you own — deleting an entry would destroy the accounting that proves your balance. Server access logs are deleted after 14 days. Anything already written to the blockchain is permanent and outside anyone's control, including ours.
The private key of the wallet created for you is encrypted using a managed hardware key service before it is stored, and the raw encryption key never enters the application. The app deliberately contains no code path that decrypts a wallet key — the ability to decrypt exists at the infrastructure level for recovery, but nothing in the running application can spend from your wallet.
This page describes how the app works today. When the app changes, this page is updated to match. It is not a promise about the future — it is a description of the present, and it is only useful if it stays accurate.
Questions about anything on this page can go to [email protected].