TransparencyDraft

Once Patepang has launched, the Patepang server serves public files that anyone can check, without personal data. The files for the real service do not exist yet, because the service is not running yet.

Transparency file

The root keys for the tempel witness, recovery, the key transparency log, and moderation; the fingerprints (measurements) of the enclaves that may be trusted; and the official addresses, including the policies page.

Moderator list

Moderator ids, public keys, and the languages they read, without names or emails, signed by two of the three root key holders.

Release list

Every release version, its fingerprint (hash), and its number in the public Sigstore Rekor log, so that anyone can check that a release file is the same as the one recorded in Rekor.

Key transparency log

A public record that only grows, of the key changes of every account, with a signed summary every hour. Its contents show how many changes there were and when, not which accounts.

security.txt

The security contact and the vulnerability disclosure policy (see Security).

Every half year we publish a report from daily counts that name no one's account. The first report comes out after the launch. It contains:

• reports received, by language;
• moderation decisions by type, and appeals by outcome;
• requests from the authorities and the government, by type, outcome, and the country the request came from;
• security incidents, by severity;
• policy changes forced by outside parties.

The report only contains numbers, without anyone's account.

We do not keep anyone's name, phone number, or email, so we ourselves cannot look up an account by identity. A request must name an account id. Every request is recorded by country, type (user data, content removal, data preservation, emergency, interception, or other), and outcome (no data, refused, partly fulfilled, or fulfilled), without naming the account, and then counted in the transparency report.

What the server has for an account id

• the account record, its devices and their public keys, and its key chain;
• tempels: with which account, when down to the minute, their type, and their room;
• group memberships, participation in event rooms that are still open, and guardians;
• message envelopes not yet fetched (encrypted, with recipient, size, and time) and encrypted media data;
• subscription status, quota, and moderation cases and decisions;
• the random subscription identifier, which Apple or Google also holds with the purchase, and the phone's notification token, which the server can decrypt.

The last two items can link an account to the person behind it. Apple or Google can match the subscription identifier with the buyer's store account (name, email, and payment method), and the notification token with its device and the Apple or Google account on that device. So Patepang's data combined with Apple's or Google's records can show who owns an account.

What does not exist, and so cannot be handed over

• the content of messages, updates, moments, or media in readable form;
• names, photos, phone numbers, emails, or address books;
• IP addresses, the phone's location (GPS), or call records;
• who sent a message, except the first messages after a tempel, which are tied to their tempel (Privacy policy section 4.3).

The only location data on the server is cities: the city that an account not yet born writes for the birthplace waiting list (for at most 90 days), and the city of each birthplace while its room exists, which tempels there refer to.

The first version of Patepang has no legal hold: deletions already scheduled still go ahead. Report evidence can only be read by moderators, not by the server.

[A written policy for requests from the authorities, including the legal bases accepted and when users are told: awaiting a decision and review by legal counsel]

Official requests are sent to [email protected].