We made our server dumb. On purpose.
It keeps public keys, checks signatures, and passes on sealed envelopes it can’t open. What you share is locked on your phone before it leaves.
One row for one message
A message from Sekar to Raka. On its way, Patepang’s server keeps one row for it: Raka’s account and device, a rounded size, contents it cannot open, and the time it arrived. There is no sender. The row is deleted once the message is delivered.
| Column | What it holds |
|---|---|
| To | Raka’s account and device 1. An account, not a name. |
| From | There’s no column for it. |
| Size | 1,024 bytes. Rounded up to a fixed size, so its length says nothing. |
| Contents | Locked on Sekar’s phone. Only Raka’s can open it. |
| Arrived | Kept only until it’s delivered. |
What it still knows
We list these because a promise you can check is worth more than one you have to trust. Each line is a table in its database.
- Which accounts did a tempel together, and when, to the minute
taps - Who is in a group
group_members - Who your guardians are
guardians - Whether you subscribe, and the space you use
subscriptions - The last day you were active, not the time
last_active_day
What it does not keep
The server does not keep sign-in logs, app usage history, or IP address history. Besides the date you were last active and the date each of your devices last signed in, the server keeps your tempel history (with whom and when, down to the minute) and the time of every change to your keys, which is public.
The app contains no ads or analytics tools.
The network in front of it
Cloudflare, the network in front of the server, sees every request except the encrypted content, including IP addresses, account ids, and message recipients.
The privacy policy lists everything the server keeps, what for, and for how long. trust.patepang.com explains how Patepang protects the people who use it, and its limits.