Privacy summary

1. What we collect

We keep what the app needs to work: your phone number to sign you in, your profile, the details of each recording and every consent record. The audio itself stays on your phone today.

What you give

• Profile: name, main language, other languages and optional details.
• Optional details: dialect, region as free text, age band and gender, each with its reason shown. Never a precise location.
• For each recording: language, length, date, review status and every consent record you make.

What sign-in keeps

• Your phone number, and its hash, so friends who have your number can find you.
• Session tokens and one-time codes, kept only as hashes; codes expire after ten minutes.

Never stored

The server never keeps your audio, your contacts or the codes made from them, or payout details. The profile rejects ethnicity, health, religion and anything else it does not list.

2. How we use it

To sign you in, match friends, review recordings and pay you. Each recording is used only as its speaker chose. Your number is never in any dataset.

• Sign you in with your number and a one-time code.
• Match friends from hashed contacts, without keeping any of them.
• Send recordings for native-speaker review.
• Keep the earnings and invites ledger.
• Train or license models only as each speaker's choice allows.

3. Consent and choices

Every recording carries a choice: Only me, Nzinga's models, Nzinga and approved partners, or Everyone. Each wider choice includes the narrower ones.

Consent records are never edited. A change or a withdrawal adds a new record, so the history is kept. Each record names the exact consent text you saw, by version and hash. Anyone who has not consented is excluded.

4. Sharing

Recordings are shared only as each speaker chose: with Nzinga's models, approved partners under licence, or as open data. "Only me" is never shared.

When a partner licenses recordings that include your voice, part of what they pay comes back to you, in proportion to your accepted minutes. No part of the service returns another member's phone number, and there are no public profiles.

5. Infrastructure

The project runs on outside services today. None is hosted in Africa yet. When audio upload is built, the plan is encrypted storage with keys per member, described in the specification.

• Source code · GitHub, private repositories for the app, server and tokenizer.
• Websites and the tokenizer demo · Cloudflare Pages · static pages, served globally.
• Tokenizer releases · Hugging Face · the tokenizer release, kept private at this stage.
• Compute · Modal · model training and experiments.
• Phone app · Expo · builds and updates of the app.
• Payment partner, later · not chosen yet · payout requests stay on the phone.

Before any public launch, a published data-use and licensing policy is required. For questions, see Contact.

6. Your contacts

Contacts are read only if you allow it. Each number becomes a one-way code on your phone, and only the codes are sent. The server keeps none. A hash can be reversed by trying every number, so what protects you is that none are kept, plus rate limits and a cap per request.

7. Audio storage

Audio stays on your phone today; upload to encrypted storage is not built yet. The development server keeps data in memory only.

• Recording details and consent records: kept so the history of every choice can be shown.
• Sign-in codes: kept only as hashes, and they expire after ten minutes.
• Account and shared recordings: removed within 30 days of deletion.

8. Your rights

You can download your data, pause sharing or withdraw. See Profile in the app, at any time.

Withdrawing is never more than two taps away. Your voice is removed from all future training and licensing. Models already trained cannot forget it. You keep what you were paid. You can also delete your account.

9. Security

Sign-in uses one-time codes; codes and session tokens are stored only as hashes, and contact matching is rate-limited and capped at 2,000 contacts per request.

Legal and security reviews are required before any public launch and have not been done yet. Who governs the library, a trust, a cooperative or a foundation, is still open. Read more on our security page.

10. Contact

HQ Protocol, GitHub. This page is a draft summary of how Nzinga handles data, and not a legal policy.