Personal data

Gerege never introduces a person to your system by name. You know a person only by a pseudonymous id, and (in a mini app) only what the person agreed to share.

1. How you know a person

	Mini app (app)	Merchant (qr, redirect, terminal)
Id	sub = user_ref = u_ + 32 hex	user_ref = u_ + 32 hex
How it is made	HMAC(the app's salt, the person's id) — stable for your app, unlinkable across apps (pairwise)	New and random for every payment — on every claim (new again if a claim lapses and someone else takes it)
When	from launch (the token's user)	null until claimed, then in the intent and the webhooks
Why	the person opened your app and consented	the person gave you no consent: a machine that could link one buyer's purchases would be tracking a person it was never introduced to

A merchant that needs to recognise returning customers (membership, points) does it with its own sign-in and the person's own consent — not with Gerege's user_ref.

2. What never arrives

• The person's name, national id number, date of birth, age (only the decision of min_age is enforced — 403 age_restricted).
• Accounts, account numbers, balances, banks.
• A phone number — to a mini app with the profile.phone scope only, when the person agreed and verified it by SMS (E.164). Never to a merchant.
• An e-mail — to a mini app with the profile.email scope only, when the person agreed. Never to a merchant.
• The platform's internal user id.
• In the public /pay views: the description, reference, metadata, who claimed — nothing (only claimed: true|false).

A name (given_name) is «удахгүй»; when it comes, it comes with the person's consent only.

3. What the person sees

Field	On the payment sheet	In notifications	In the public /pay
The app's name and icon (registry, review)	✓	✓	✓
The terminal's label, location; the sub-merchant's display_name	✓ (before Face ID)	—	terminal ✓
Amount	✓	✓	✓
description (yours, 1–80)	✓	never	—
reference, metadata	—	—	—

description is a short order label («Order #1001»), not a product category: no tobacco or alcohol names. App- written text under the platform's title would be a phishing channel — so notifications carry only the amount and the app's approved name.

4. Your duties

• Keep user_ref, intents and webhook data under your own privacy policy (privacy_url is required at registration and must answer 200).
• What the person gives you themselves (a delivery address, a phone) is yours to answer for; say in your policy whether you store it beside Gerege's id.
• When a person disconnects your mini app (consent.revoked), close that user_ref's session.
• Age-restricted goods: the intent's min_age (13–21) — Gerege checks the age and decides; neither the age nor the national id reaches you. Your own check at the machine (an eID QR, say) stays your responsibility.