Consent is enforced in shared code that both the server and the app use.
Every person in a recording has their own record
built
Records are never edited; changes add a new record
built
Each record names the exact text shown, by version and SHA-256
built
A conversation is used only if every speaker allows it
built
Withdrawal stops all future use
built
Re-consent when the consent text changes
planned
Note
Consent is never machine-translated. A translated agreement is a new text with its own version and hash, reviewed by a native speaker.
Phone number, to sign in, and its hash
stored
Profile: name, languages, optional bands
stored
Per recording: language, length, date, status, consent
stored
Ledger entries and invite codes
stored
Session tokens and sign-in codes, as hashes only
stored
The audio: it stays on the phone
not stored
Your contacts, or the codes made from them
not stored
Ethnicity, health, religion
rejected
Payout methods and requests
on the phone
Hashing a phone number limits casual exposure. It does not make the number secret. What matters is that hashes are not stored, requests are capped at 2,000 contacts, and matching is rate-limited.
03
What Anonymisation Can and Cannot Do
A voice can identify a person. Speech data can be pseudonymised and stripped of personal details. It cannot be made fully anonymous. Nzinga says so to members and buyers.
Pseudonymous speaker ids, different per buyer
No names, numbers, device ids or precise location
Prompts that avoid personal details
Names, numbers and places silenced and masked
Bands, not values; rare combinations merged
Licences ban identification and voice cloning
Limit
Models already trained cannot forget a withdrawn recording. Open data cannot be recalled once released.
Nzinga's purpose is African control of the tokenizer, the data, the standard it is measured against, and the infrastructure. Each layer is measured separately, with a baseline and a target. The layers are not combined into one score.
Share of the vocabulary designed from Nzinga's own corpus
10.9% (32,000 of 294,145 tokens); the rest are Gemma 3's
Today
100%: an own base vocabulary
Target
Share of tokens used on Tier 1 text that come from Nzinga's own vocabulary
Freedom to modify, redistribute and sell
Code: Apache 2.0. Tokenizer: bound by the Gemma Terms of Use; porting to Gemma 4 (Apache 2.0) removes this
Today
Unrestricted for every layer
Target
Who decides releases and changes
HQ Protocol, informally; no published change policy
Today
A governed institution with a published change policy
Target
Training text with community consent or from African partners
0%: all training text is open web or research data
Today
Tier 1 languages with training text
Token premium against English, Tier 1 average (FLORES+)
1.55x; 6 of 12 languages within the 1.3x to 1.5x target
Today
Accuracy gap with English
Not yet measured (model experiment)
Today
Gap closed against the base model
Target
Storage and compute hosted in Africa
GitHub, Hugging Face, Modal and Cloudflare; none hosted in Africa
Today
Training data and production serving in Africa
Target
Model families the tokenizer works with
Three or more, plus an own model
Target
Africa-based share of maintainers and contributors
To be reported by HQ Protocol
Today
Benefit-sharing with communities that contribute data
The voice network adds its own indicators in the same format. They are proposed until adopted.
Every recording carries a consent record per speaker
Built (shared consent rules)
Today
Licences are non-exclusive
Proposed; no licence signed yet
Today
Members can withdraw any recording
Built: never more than two taps away
Today
Raw and cleaned audio hosted in Africa
A named governance body for the library
Named before public launch
Target
Share of licence income to members and a community fund
Native-speaker reviewers paid by the network
Paid reviewers per language collected
Target
Not yet true
Nzinga data is not hosted in Africa. No community has signed an agreement. The library has no governing body yet.
05
Security and Compliance Status
Nzinga is jurisdiction-neutral by design: one strict common standard, with country modules for payouts and legal text.
before external members record
Legal review in the pilot country
planned
Data protection impact assessment
planned
Plain-language privacy notice
draft
Licence and data processing agreement templates
planned
Retention, breach response, data protection contact
planned
Encrypted storage with keys per member
planned
Independent security review
before launch
Note
The privacy screen in the app and the summary on this site are drafts, not legal text.
To report a concern, contact the team.
