Privacy and POPIA

Ubonile is run by AINEXIM (Pty) Ltd. Under the Protection of Personal Information Act (POPIA), we are the responsible party for the personal information described here.

Company

AINEXIM (Pty) Ltd

Registered address

[Registered address]

Registration number

[CIPC registration number]

Information Officer

[Information Officer name]

Information Officer email

[Information Officer email]

If Ubonile is later run by a separate non-profit company, we will update this page and tell the people who have an account.

• You can answer a request with no account, no name and no app.
• Footage is never public. The person who asked never sees it. Only a verified investigating officer can open it.
• We do not save your IP address with what you send. We use no analytics, no advertising and no third-party scripts.
• Phone numbers, email addresses, names, case numbers and private accounts are encrypted in our database.
• We never sell personal information, and we never sell or give access to evidence.
• You can export your data and delete your account yourself.

This is the complete list. If we ever need something that is not here, we will change this page first.

If you answer a request

We collect

• What you choose to send: footage, photos, a voice note or a written account, with the details inside the files, such as when they were recorded.
• What you tell us about when and where.
• The identity choice you make, below.
• A record that you read the warning and agreed, with the time.
• The language you used.
• The code of the share link that brought you, if there was one, such as a poster or a partner, so a partner can see how far a link travelled.

Anonymous

Nothing about you. Only your receipt code opens the answer, and we keep only a scrambled copy of that code. If you lose the code we cannot recover it.

Reachable, still hidden

Your phone number or email, encrypted. We use it only to tell you that the officer has a question or has opened your answer.

Willing to make a statement

Your name and contact, encrypted. They go to the officer only if you accept that officer's request for that case.

We do not keep

Your IP address with your answer. To limit abuse we hold a scrambled version of it, mixed with a salt that changes every day, for 24 hours, and it is never attached to what you sent. Your answer carries no account or user number.

Why

To pass what you sent to the investigating officer on the case, and to keep a record that it arrived intact.

If you ask for help

We collect

• Your phone number or email, which we check with a one-time code.
• The kind of incident, the date and time window, and the place. The exact spot you pin is kept encrypted for the officer. The position shown on the public page is moved onto a grid and, when it happened at your home, shifted.
• One short line on what to look for, which becomes public after review.
• A private account of what happened, encrypted.
• Whether someone may still be held, or is under 18.
• If you link a case: the station, the case number and the officer's name, rank and contact as you gave them.

Why

To publish the question, to check it before it goes out, and to find and verify the investigating officer. To verify an officer we phone the station on the number in the SAPS directory, never a number supplied by you.

What you see back

Progress, not content: that the request is live, how far it has reached, whether anything has come in (a yes or not yet, only after 24 hours, and a range once an officer is verified) and when the officer opened it. You never see what was sent or who sent it.

If you have a camera

We collect

• The kind of camera.
• A point on a 200 metre grid.
• The name of the suburb or area.
• How many days it keeps footage, and whether it is paused.
• An optional label that only you can read. It is encrypted.
• The check requests we sent you and your answer: found something, checked and nothing, remind me later, or not mine.

We do not collect

The exact spot of your camera, a live feed, or any footage unless you choose to send a clip. We never connect to your camera. You look and you choose, every time.

Why

To ask you, in private, when a live request covers your area and your footage is likely still there.

If you follow an area

We collect

• The areas you follow: a point rounded to about 100 metres, a radius, the area name, whether you want requests, alerts or both, and how often.
• Your notification choices and quiet hours.
• If you turn on push, the address your browser or phone gives us for sending notifications, encrypted.
• The messages we send you, which stay in your inbox.

Why

To tell you about requests and verified alerts near those areas and nothing else.

Limits

We contact you at most 3 times a day. By default we stay quiet between 21:00 and 07:00, and send what is waiting afterwards. You can change both in your settings.

If you are an investigating officer

We collect

• Your name, rank, force number (encrypted), station, work email and phone.
• A password, stored as a slow scrambled hash, and an authenticator secret, encrypted.
• A record of how we verified you, including who at Ubonile phoned the station and when.
• A log of what you open on each case, with the time.

Why

To confirm that you are the investigator on the case, and to keep a clean chain of custody for what you receive.

Who sees it

Our verifiers and administrators. The person who asked sees that you opened evidence and when, and the details of you that they entered themselves. They do not see what you looked at.

If you run a community group

We collect

The organisation's name, kind and area. The name and contact of the person who applied, encrypted. A join code. Counts of how many times your links were viewed and shared and how many people followed an area through them. We do not track individuals.

Why

To verify the organisation, give it an area feed and sharing tools, and show it its own reach.

If you report a request or an alert

We collect

The reason you choose and any note you write, encrypted. We do not ask for your name.

Why

So a person can decide whether to take the request or alert down.

• No trackers. There are no analytics, advertising tools, social widgets, third-party fonts or third-party scripts on Ubonile.
• Cookies and storage. If you sign in, a cookie called ub_s keeps you signed in. A cookie called ub_lang remembers your language. Your browser storage keeps ub_theme so we remember light or dark. That is all.
• Searching for a place. We search our own copy of South African place names. What you type is not sent to anyone else.
• Use where I am. Only if you tap it and then agree on your phone. Your phone's position is rounded to about a kilometre before it leaves your phone, is used once to find places and requests near you, and is not stored or linked to you.
• Maps. A map is optional and loads only when you ask. To draw it, your browser asks a map tile server for the pictures of that area. At the moment that is OpenFreeMap. That provider can see your device's IP address and which tiles you asked for. Nothing else from Ubonile goes with the request. [Confirm the tile provider before launch]
• Server logs. Our servers keep ordinary logs to run the service and keep it secure. On the pages where people send or open answers we do not log the IP address. [Server log retention period]

This table is the promise the whole system is built around. Every screen and every response from our servers is tested against it.

The public

The question: area, date, time and what to look for, after a person has reviewed it. A daily fingerprint of our custody log. Nothing else.

The person who asked

Their own request and private account. Progress as described above. Never footage, photos, audio, statements, or who sent them.

The verified officer on the case

The footage, photos, audio and statements for that case, the exact counts and the full custody log for the case. A contributor's identity only if the contributor agrees for that case.

Moderators and verifiers

Moderators read the request they are reviewing, including the private account, and see only counts for evidence. Verifiers see the case number and officer details so they can verify them. Neither can open evidence. Both see totals for camera areas only where there are five or more cameras.

Two people, break-glass

A 30-minute viewing copy of the files, with a written reason, written on the case record. It never includes a contributor's identity or a camera owner's location.

A court

If a court makes a lawful order, we must follow it. We can only hand over what we hold, and for an anonymous contributor that is no name at all.

Information about alleged or proven criminal behaviour is special personal information under POPIA (sections 26 and 33). It gets stricter rules than other personal information. A request, an answer and a case link are all this kind of information.

We deal with this in three ways. We ask for the minimum we need. We ask for your agreement at each step where you give us something of this kind, and we say plainly what will happen to it. And we build public text from structured fields, so names, accusations and home addresses stay out by design and not only by review.

Under 18: anything that involves a person under 18 is held for a verified investigating officer, and nothing that identifies them is published.

[Lawful basis for each purpose, to be confirmed by the attorney before launch]

• Evidence. Files are encrypted before they are stored, each with its own key, and each part is checked when it arrives. We record a fingerprint of the original so a change can be detected later. Evidence is stored in South Africa.
• Contact details and private text. Phone numbers, email addresses, names, case numbers, private accounts and labels are encrypted in the database. To find an account we use a one-way index, so we can look up a number without storing it in the clear.
• Passwords are stored as slow hashes. Officers and staff must also use an authenticator app.
• Staff. Nobody on our team can open evidence by default. Every action is written on a log that cannot be quietly changed, and we publish a daily fingerprint of that log on the transparency page.
• Backups are encrypted and kept off site. [Where backups are kept, and for how long]
• If something goes wrong. If personal information is accessed without permission, we will tell the Information Regulator and the people affected, as the law requires, and say what happened and what to do.

[Hosting provider and region for the application and database]

Answers with no verified officer

Deleted at 90 days.

Answers linked to a verified officer

Kept until the officer releases them. We review them every 12 months.

Unfinished uploads

Deleted after 24 hours.

Anything you withdraw

Deleted as soon as you withdraw it with your receipt code, if an officer has not opened it yet. After that, it stays with the case.

IP address hashes

24 hours. They are used only to limit abuse and are never attached to an answer.

Public request text

A request is live for 30 days, and an officer can extend it to 90. The "what to look for" line is removed 30 days after the request closes.

Private account, exact pin and case details

Encrypted, and deleted 90 days after the request closes, or 12 months after if a verified officer is on the case. They stay while evidence on the case is still kept, or under a legal hold, and go after that.

Requests you never finished

They lapse after 60 days with no activity and nothing public, then follow the line above.

The custody log

Hashes and event types, with no personal information in them, for 7 years. The log refers to people by an internal number, never by name.

One-time codes

10 minutes, then they stop working.

Sign-in sessions

Public accounts: 30 days since you last used them. Officers and staff: 30 idle minutes, and 12 hours at most.

Your account

Until you delete it. Then we remove your name, phone, email and password, your followed areas, your cameras, your check requests, your inbox and your push address, and we close your live requests.

Reports and data requests

[Retention period for abuse reports and for the records of rights requests]

A deletion runs every 6 hours. We publish how often data is deleted on the transparency page. A legal hold set by the officer or our Information Officer pauses deletion for the evidence it covers.

• The verified investigating officer on the case, as described above.
• Service providers that help us run Ubonile, such as hosting, email and SMS delivery, and the push services of browsers and phones. They process information for us and not for themselves. [Names of operators, once chosen]
• A court, the police or the Information Regulator when the law requires it.

We do not sell personal information. We do not share it with advertisers. We do not sell evidence and we do not sell access to it, now or later.

Real evidence is stored in South Africa. Some of the services that help us may handle small amounts of personal information outside South Africa. A message sent to your phone through an SMS or email provider is one example. A web push notification passes through the push service of your browser's maker. The map tile provider named above is another.

POPIA allows a transfer out of the country only on certain conditions (section 72). We will use it only for the purpose in question, with providers that are bound to protect the information to a similar standard, or with your consent. [Countries and providers, to be listed once chosen]

You can ask us to tell you what we hold about you, to correct it, to delete it, to stop using it for something, or to take back an agreement you gave. You can also object to how we use it.

• With an account: open Settings in My Ubonile. You can download everything we hold about you and delete your account. For anything else, send a rights request there and the Information Officer will answer.
• With a receipt code: go to Use my receipt code. You can see the state of your answer, reply to the officer, add more, and withdraw it until an officer has opened it.
• With neither: write to the Information Officer at [Information Officer email]. If you answered anonymously we hold no name, so we can act on an answer only if you give us the receipt code.

We aim to answer within 30 days. We may need to confirm who you are first. There are cases where we cannot delete something, for example while a legal hold is in place or while a court may need the record. If so, we will tell you why.

The Information Regulator oversees POPIA. If you think we have handled your information wrongly and we have not put it right, you can complain to the Regulator at inforegulator.org.za.

Ubonile processes information about criminal behaviour on behalf of other people. POPIA requires the Regulator's prior authorisation before that starts (sections 57 and 58). We will not open Ubonile to the public until the Regulator has decided on our application. Nothing on this page means the Regulator has approved or endorsed Ubonile. [Status and reference of the application, to be added when known]

When we change this page in a way that matters, we will say so at the top and tell people with an account. Older versions are available on request.

Questions, rights requests and complaints go to our Information Officer, [Information Officer name], at [Information Officer email]. Our postal address is [Registered address]. Our PAIA manual is here, and the terms of use are here.