Legal

Privacy Policy

Version 1.0

Tujuane is operated by Truth Wireless Limited. This policy explains what we collect, why, how long we keep it, and what you can do about it. It describes how the service actually works today, not how it might work later.

1. What we collect

To create an account: your phone number. It is how you sign in, and it is how we make sure one person does not run many accounts.

Your profile: your first name, date of birth, gender, who you want to meet, your photos, your bio, the interests and prompt answers you choose, and your matching preferences.

Your approximate location: used to show you people who are nearby and to show them how far away you are. We show a distance, never a point on a map.

How you use Tujuane: who you swiped on and which way, your matches, the messages you send, the perks you earn and spend, and the ads you choose to watch.

Verification: described in full in section 3, because it deserves its own section.

Your device: a push notification token if you allow notifications, and basic device information needed to deliver the app and keep your session secure.

2. Why we are allowed to hold it

We process your profile, location and usage data to provide the service you asked for. We process verification data only with your explicit consent, and you can withdraw that consent at any time. We keep limited records to meet legal obligations and to investigate reports of abuse, because a safety report is worth nothing if the evidence behind it is already gone.

3. Verification, and what happens to your face

This is the part most people care about, so it is written plainly.

Verification runs on our own servers. Your selfie is not sent to an identity verification company. There is no third-party provider involved in checking that you are real.

When you verify, the app captures a short burst of frames while you perform a simple action, such as blinking or turning your head. Those frames are sent to us over an encrypted connection.

The raw frames are deleted as soon as they have been checked. They are never added to your photos, never stored alongside your profile, and never kept as a video. They exist only for the seconds it takes to run the check.

What we do keep is a mathematical representation of your face, derived from those frames. It is a list of numbers. It is stored encrypted, and it cannot be turned back into a picture of you. We keep it so that if you change your profile photos later, we can check the new ones are still you, which is the entire reason a verified badge means anything here.

You can delete it. Withdrawing biometric consent in Settings removes it, returns your account to unverified, and takes away the features that require verification.

What our liveness check does and does not prove. It is designed to tell a live person apart from a photograph, a printed image, or a face on a screen held up to the camera. It is not proof against every possible attack, and we do not claim it is. We would rather tell you its limits than imply a certainty we cannot back.

For higher-tier verification, which involves a government issued identity document, review is carried out by a person. We keep a one-way code derived from the document rather than the document itself, so that the same identity cannot quietly hold several accounts. That code cannot be reversed back into your document number.

4. How long we keep things

• Swipe history: 12 months.
• Daily activity counters: 90 days.
• Read notifications: 90 days.
• Data export download links: 72 hours, after which the link stops working and the file is removed.
• Your account: until you delete it.
• Raw verification frames: deleted immediately after the check, as described above.

When you ask us to delete your account, deletion begins after a 14 day grace period. Nothing is erased during those 14 days, so if you change your mind you can simply log back in and cancel. After that, it is permanent.

What deletion removes, and what survives it

Deletion removes your profile, your photos, your messages, your matches, your swipes, your devices, your verification records and the face representation described above. Your phone number, email, date of birth and name are erased from your account record.

A few things are kept, and you should know which:

• Financial records, reduced to totals with your identity removed, because we are required to be able to account for money that moved.
• Proof that you gave a consent, with the identifying details stripped out. The record that a consent existed is the evidence we relied on to process your data lawfully, so deleting it would defeat its purpose.
• Safety records, where someone has been banned or an abuse report has been acted on. Otherwise deleting an account would erase the reason it was banned, and a ban that forgets itself protects nobody.

None of these can be used to rebuild your profile or to identify you to another member.

5. Who else sees your data

We do not sell your personal data. Not to anyone, not for any purpose.

Some things cannot be done without a third party, and where that is true we use them only for that purpose:

• Sending you a login code. Your phone number is passed to a messaging provider so the code can reach you.
• Advertising. Perks on Tujuane are earned by watching ads rather than bought, so advertising is part of how the service works. Ads are served by Google AdMob, which receives the signals it needs to select and measure an ad. Where the law requires a choice about personalised advertising, Google's consent flow asks you before any ad loads, and choosing non-personalised ads does not change how you earn perks. Outside those regions that prompt does not appear, and ads may be personalised by Google under its own policies.
• Signing in. If you sign in with Apple or Google rather than a phone number, that sign-in happens through Apple or Google, and we store the account identifier they give us.
• Notifications. If you turn on notifications, the token used to reach your device is issued through Expo's push service and delivered by Apple's or Google's notification network. It is an address for your device, not a copy of the message content.
• Payments. Premium subscriptions are handled by the app store you bought them through. We never see your card details.
• Government or legal requests, where we are legally required to respond.

Your photos, your messages, your verification frames and your face embedding are not shared with any of them.

6. Where your data lives

Tujuane runs on infrastructure we control. Your photos are held in our own storage, reachable only through short-lived links tied to your session, rather than in a public bucket that anyone with the address could read. Traffic between the app and our servers is encrypted, and your face embedding is encrypted where it is stored.

7. Your rights

You can, from inside the app:

• See and export your data. The export bundle contains your profile, your photos, your matches, your messages and your consent history.
• Delete your account, with the 14 day grace period described above.
• Withdraw a consent you previously gave, including biometric consent.
• Block or report anyone.

If you are in a jurisdiction that grants you further rights, such as correction, restriction, objection, or the right to complain to a data protection authority, those rights apply and you can exercise them by contacting us.

8. Age

Tujuane is for adults. You must be 18 or older, and we check your date of birth on our servers rather than trusting the app to enforce it. If we find an account belongs to someone under 18, we remove it.

9. Changes to this policy

This policy is versioned. When we publish a materially different version, we will ask you to review and accept it before you carry on using Tujuane, rather than changing it quietly underneath you.

10. Contact

Truth Wireless Limited is the data controller for Tujuane. Contact details for privacy questions, data requests and complaints are published at tujuane.africa/support.