Principles
Five commitments decide what a Nzinga screen may ask for, what it must explain and what it must never do.
Each one is already enforced somewhere in the code; where it is not yet true, this page says so.
Privacy by Design
Members decide, recording by recording, who can use their voice. The design makes that choice visible everywhere, easy to change and impossible to bury.
Consent for Every Recording
- Every person whose voice is in a recording has their own consent record. A choice applies only to the member's own voice; anyone else in the recording makes their own choice for theirs.
- Records are never edited. A change or a withdrawal adds a new record, so the history is kept and shown in order on Recording Detail.
- Every consent names the exact text the member was shown, by version and SHA-256 hash.
- A whole conversation is used only if every speaker allows it. Anyone who has not consented is excluded, never overridden.
The Four Choices
The choices are always these four, in this order, with these exact names. Each wider choice includes every narrower one.
Words from apps/mobile/lib/consent-copy.ts. "Nzinga's models" is the suggested starting choice.
Who can use this recording?
Withdraw Any Time
Any recording can be withdrawn from its own page, or every recording at once under Consent and Privacy. Withdrawing is never more than two taps away.
The real sheet on Recording Detail. It says what happens, what cannot be undone, and what the member keeps.
Vague, and it uses fear to keep sharing switched on.
Contacts Are Hashed, Never Stored
- Contacts are read only if the member allows it. Each number is put in international form and turned into a one-way code (SHA-256) on the phone.
- Only the codes are sent. The server answers with the codes that belong to members and keeps none of the codes it receives.
- Each request is capped at 2,000 contacts, and matching is rate-limited.
- The app never messages contacts. Invites go out through the phone's own share sheet, sent by the member.
What Is Stored, and What Is Not
On the server
- Your phone number, to sign you in, and its hash, so friends who have your number can find you.
- Your profile: name, main language, other languages, and optional dialect, region (free text, never a precise location), age band and gender, each with its reason shown.
- For each recording: language, length, date, review status and every consent record.
- Earnings and invites: ledger entries, invite codes and who used them.
- Sign-in: session tokens and one-time codes are kept only as hashes; codes expire after 10 minutes.
Never on the server
- The audio, today. It stays on the phone; upload to encrypted storage is not built yet.
- Your contacts, or the codes made from them.
- Sensitive categories. The profile schema rejects ethnicity, health, religion and anything else it does not list.
- Payout methods and requests. Kept on the phone until the server has a payout endpoint.
- Your number in any dataset, or sold with your contacts or name.
SPEC.md).Export and Delete
All four live on Profile, Consent and Privacy (app/screens/privacy.tsx).
Sovereignty by Design
Nzinga's purpose is sovereignty, not only better models: African control of the tokenizer, the data it is built from, the standard it is measured against and the infrastructure it runs on. The app is the data engine of that stack. Its library trains the speech and language models built on the Nzinga tokenizer.
Your language, your voice, your terms.
The stance behind the name. Njinga Mbande, Luanda, 1622.
The Member Owns Their Voice
- The member decides who can use each recording, can change it on any recording, and can withdraw at any time.
- Members are paid only for their own voice, and only when they chose to share it.
- Copy says "your recordings" and "you decide". It never implies that Nzinga owns a voice it has been allowed to use.
Language Communities
- Collective benefit follows the CARE Principles for community data: Collective benefit, Authority to control, Responsibility, Ethics. Communities that join together can hold a shared agreement and a shared benefit.
- Ideas to record are designed to fill gaps in the library: under-represented languages, dialects, topics and speakers.
- No language is given a special place. Pickers sort the list alphabetically and put the member's own languages first.
Four Layers of Control
The wider project measures sovereignty layer by layer and keeps the layers separate rather than combining them into one score. Today's figures, as recorded in the scorecard:
Honest About What Is Not Yet True
A promise the infrastructure and governance do not keep yet.
Culture
Naming
The brand is Nzinga; the product line is Nzinga Network. Never "Nzinga Voice" in anything a member, partner or the public reads. The wordmark is drawn, never typed (see Logo).
Njinga refused the lower seat.
Luanda, 1622. Sent to negotiate with the Portuguese governor, Njinga Mbande found no chair set for her. She had an attendant kneel, sat at the governor's eye level, and negotiated as an equal. The stance behind the words: your language, your voice, your terms.
The historical figure is written Njinga Mbande; the brand keeps the spelling Nzinga.
The Cowrie
Cowries were everyday currency across West, Central and East Africa for centuries, and the Akan word for cowrie, sedie, gave Ghana's cedi its name. The shell's opening has always been read as a mouth. Nzinga pays people for their voice, so the mark holds both halves of that sentence: payment and speech.
Greetings in the Member's Language
Home greets each member in their main language, from the list in languages.ts. The greeting is the member's, not a decoration.
Imagery
The app has no stock photography. Colour panels, the cowrie and the member's own photo carry the visual weight, and the six guided sessions are everyday life: Greetings and Introductions, Market Day, Numbers and Prices, Family Stories, Weather and Seasons, Health Visit. Earlier decorative marks (a woven lusona, a talking drum) were withdrawn in favour of one clear idea.
Exoticism turns members into subjects. The brand is about people speaking for themselves.
Respect for Elders and What Is Not Ours to Record
- Prompts ask the member to speak as they would at home: "Greet an elder you respect, the way you were taught." They describe the member's own life, never someone else's secrets.
- Nobody is recorded without their agreement, and each person in a recording chooses for their own voice. A recording of an elder needs the elder's own consent.
- "Only me" is always one tap away for anything private, sacred or not the member's to share. Prompts never ask for ritual, sacred or restricted knowledge.
Fair Pay
Money is shown plainly, in the member's currency, with nothing rounded in Nzinga's favour and nothing promised that the ledger does not hold.
Plain money
Amounts are kept as whole minor units (cents and the like), so totals never drift through rounding, and are shown with formatMoney(minor, currency) in the server's currency.
Your own voice
In a conversation each person is paid only for their own speech, and only if they agreed. "Only me" is never paid and never used.
Licence share
When a partner licenses recordings that include yours, part of what they pay comes back to you in proportion to your accepted minutes. It is shown separately and starts when the first licence is signed.
Social by Design
Trust travels through invitations. Nzinga grows through circles of people who know each other, and the design keeps those circles private and fair.
Invite-only
Members join only with an invite code from an existing member; a few founder numbers seed the network. Members start with three invites, earn one more for every accepted hour, and hold at most ten unused at once.
Codes are eight characters without I, L, O or U, so they are easy to read aloud and type. Each code works once.
Inviters vouch
The person who invites someone stands behind them. If an invitee is confirmed as fraudulent, the inviter loses three invites.
Direct inviter only
An invite bonus is paid when someone you invited has a first recording accepted. It goes to you only, never further up the chain, so nobody earns from the people others bring in. The programme cannot become a multi-level scheme.
No public profiles
There are no member profiles to browse. Friends on Nzinga shows names from your own contacts. No part of the API returns another member's phone number; matching returns member ids only, so other members never see your number.
Untrue by design, and the language of a pyramid scheme.
Community benefit is part of the same idea: the CARE Principles in Language Communities let communities that join together hold a shared agreement and a shared benefit.