Privacy Policy — Beraya

1. Who provides Beraya

Beraya is provided by Saifullah Ahad (“we”, “us”, or “our”). It helps known family households plan meals, work, visits, and useful journeys in a closed circle.

Privacy contact: www.saifullah.ai@gmail.com
Website: https://saifullah.ai
Location: Dhaka, Bangladesh

2. Data Beraya handles

• Family-circle data: household display names, household size, meal-arrival declarations, attendance history, gathering dates and places, food/access needs, assignments, hosting turns, journeys, private needs, and proxy-household records.
• Capacity and pooled intentions: a household’s selected capacity level and optional pooled amount.
• Device and sync data: a random device identifier, public cryptographic keys, an opaque circle identifier, logical clocks, operation identifiers, and an optional Firebase Cloud Messaging token.
• Feedback and safety reports: text you choose to submit, an optional reply email, app version, Android version, device maker/model, and an opaque shared-item reference for reports.
• Preferences stored on the phone: theme, reduced motion, notification choice, app-lock configuration, and a salted verifier for a Beraya PIN. We do not receive your PIN or biometric data.

Beraya does not request location or contacts. It does not collect photos, audio, advertising identifiers, analytics, or a list of other installed apps. QR capture uses the phone’s chosen camera app and a temporary file; Beraya does not request camera permission or upload that image.

3. How data is used

Data is used to calculate meal-by-meal quantities, produce feasible food-and-work assignments, coordinate a closed family circle, deliver content-free update wakes, match a private need to an existing journey, respond to feedback, investigate a report, and keep the app secure.

Beraya never holds or transfers money. A pooled amount is split into encrypted shares; individual amounts are not displayed to other households.

4. Encryption and what the service can see

Family-circle content is encrypted on the device before it is sent. The Cloudflare service stores an opaque circle identifier, device membership records, public signing keys, push tokens, operation metadata, and encrypted envelopes. It cannot read household names, capacity answers, dietary notes, pooled amounts, or private journey-need details from those envelopes.

Interest registration sends an unlinkable token plus encrypted place information. The coordination service can count registrations for a round and see the selected threshold and time window, but family members see no count or identity. A need’s readable detail is disclosed only to the matched carrier device.

Local family state is encrypted with keys protected by Android Keystore. Network connections use HTTPS. Optional app lock can use a dedicated Beraya PIN and/or device biometric matching; biometric templates remain with Android.

5. Service providers and disclosures

• Cloudflare: Workers, Durable Objects, and D1 process membership, encrypted synchronization, and necessary network metadata such as IP addresses.
• Google Firebase Cloud Messaging: processes a push token and a content-free wake message so a device can fetch an encrypted update.
• Web3Forms: processes feedback or a safety report only when you press Send, including any optional reply email and the device/app details listed above.

These companies process data to provide their services. We do not sell personal data, use it for advertising, or provide it to data brokers. We may disclose information when legally required or to address an immediate safety threat.

6. Retention and deletion

Active encrypted circle commands remain while needed for circle synchronization. Sub-threshold interest registrations are deleted when their round expires; once a threshold is reached, the tokens are removed and only the encrypted proposal remains for the round.

Open Private and access → Delete my Beraya data to leave the circle. Beraya first publishes a deletion tombstone, removes your household and its burden history from the shared cloth, compacts older active command history, unregisters the device and push token, and erases local records. If it was the circle’s last device, its active server membership, join envelope, receipts, and command state are removed. Necessary infrastructure logs and backups may persist briefly under provider retention and security practices.

You can also clear local data by uninstalling, but uninstalling alone cannot notify the family circle or remove server membership. If you cannot access the app, contact www.saifullah.ai@gmail.com; because we cannot decrypt family content or identify a person by name, include any non-sensitive technical reference you still have and we will explain the available deletion path.

7. Your choices

• Notifications are optional and can be disabled in Beraya or Android Settings.
• App lock is optional. You can change or remove the Beraya PIN and turn biometric unlock off.
• Feedback email is optional.
• You can export a readable copy using an app you choose.
• You can withdraw a household from a gathering without giving a public reason.

8. Children

Beraya is intended for adult household organizers and is not directed to children. It has no public profiles, open chat, stranger discovery, or media uploads. Structured content shared inside a family circle remains subject to our Child Safety Standards. Report an urgent concern from Beraya’s Child safety screen or email the child-safety contact below.

9. International processing

Cloudflare, Google, and Web3Forms may process data in countries other than yours. Encryption and service-provider safeguards apply during this processing.

10. Changes and contact

We may update this policy as Beraya or applicable requirements change. The current version will remain at https://privacy.saifullah.ai/beraya.html with a revised effective date.

Questions, privacy requests, or complaints: www.saifullah.ai@gmail.com.