Legal
How Mudiwa responds to police, court and data requests
Version: 1.0 · Effective date: 26 October 2026
People share personal things on Mudiwa, so we're careful about who we give data to. This page explains how we handle requests from the police, courts and other authorities. It's written for our members and for officers who need to make a request.
The laws it refers to are the Cyber and Data Protection Act [Chapter 12:07], the Criminal Procedure and Evidence Act [Chapter 9:07] (which that Act amended by adding Part XXA, sections 379A to 379E), and the Interception of Communications Act [Chapter 11:20].
Our principles
- Lawful requests only. We disclose member data to authorities only when Zimbabwean law requires it, usually through a valid court order such as a magistrate's order. Exceptions are genuine emergencies (see below) and members asking for their own data.
- Only what's needed. We check every request and give only the specific data the order covers. If a request is too broad or unclear, we ask for it to be narrowed or clarified.
- We stand up for members. If a request isn't valid, we'll decline it. Where appropriate, we'll challenge it through the proper legal channels.
- We tell members, unless we can't. We notify the member before disclosing, unless the law or a court forbids it, or telling them would put someone in danger or harm an investigation.
- Emergencies are different. If someone's life is at real and immediate risk, we act quickly.
- We help victims. If a member has been harmed by someone they met on Mudiwa, we'll help them and the police get the evidence they need, within the law.
- We aim to be open about numbers. We plan to publish a transparency report (see below).
What data we have, and what we don't
We collect as little as we can, and we can't hand over what we don't hold. Please read our Privacy Policy for details and retention periods.
| Data | Do we hold it? |
|---|---|
| Email address, sign-up date, account status | Yes, while the account is open (and in limited form after a ban for serious harm) |
| Profile details and photos | Yes, while the account is open. Erased within 30 days of deletion |
| Messages and voice notes | Only while the chat is open. Erased 90 days after the chat ends (an unmatch or a deleted account), unless they are part of a report, in which case they're kept for 1 year after the case closes (up to 6 years if the person was banned for serious harm) |
| Log-in and IP records | 90 days |
| Approximate area | Current area only. We don't keep a location history |
| Check-in location | Only for check-ins the member chose to use. A missed check-in's approximate location is kept for 30 days |
| Selfie check data | Raw selfie deleted 30 days after the check is decided. Face template kept while the account is open, and erased within 30 days of deletion |
| Trusted contact | The name and phone number a member typed in, while they keep it |
| Sexual orientation | We don't collect this |
| Payment data | None. Mudiwa has no payments at this time |
Once data has been deleted under our retention schedule, we cannot recover it.
Types of request we handle
1. Orders to produce data
Under the Criminal Procedure and Evidence Act s379A, a magistrate may, on a police officer's application supported by an affidavit, order a person in control of a computer system to produce specified data, or order an electronic communications service provider to produce information about the people who use its service.
What we need to see:
- the order itself (original or certified copy), signed by a magistrate or judge, and in force;
- the name of the court and the case or CR number;
- the specific account(s) concerned. A Mudiwa profile link or user ID is best. An email address is acceptable;
- the specific data requested and the time period;
- the name, rank, station and contact details of the requesting officer.
What we do:
- We check that the order is genuine, valid, specific and issued under Zimbabwean law. This can include confirming it with the court that issued it.
- We disclose only the data the order covers, for the time period stated.
- We provide data securely, with a covering letter describing what we provided and how it was extracted, so it can be used as evidence.
2. Requests to preserve data
Under s379A(4)(a), a police officer who holds a warrant may give written notice requiring data to be preserved for up to 7 days, unless a magistrate extends it. Under s379B, a magistrate may order traffic data to be preserved or collected for a specified period.
- When we receive a valid preservation notice or order, we take a secure copy of the specified data and keep it for the period stated. We do this even if the member deletes their account or the normal retention period runs out.
- Preserved data is not disclosed until we receive a valid order to produce it.
- Informal preservation. Where a police officer tells us a serious crime is being investigated (for example rape, robbery, threats or child abuse linked to a Mudiwa account) and that an order is being sought, we'll preserve the relevant data for up to 30 days while the order is obtained, but won't disclose it without the order.
3. Requests to remove content
- Court orders. We promptly remove or disable access to specific content when we receive an order from a court (CPEA s379C(3)(a)).
- Other requests. Requests from authorities to remove content without a court order are checked against our Community Guidelines. If the content breaks our rules, we remove it under those rules. If it doesn't, we ask for a court order.
- Illegal content we find ourselves. If we become aware of clearly illegal content, especially any sexual image of a child, we remove it, preserve evidence, and promptly inform the appropriate authority, in line with CPEA s379C(3)(b). For child sexual abuse material and threats to life, that means the Zimbabwe Republic Police.
4. Interception requests
We don't offer anyone a way to watch members' conversations live. If we receive a warrant or direction under the Interception of Communications Act [Chapter 11:20], or a real-time collection order under CPEA s379B, we'll review it straight away. We will comply only to the extent the law requires, and we'll count it in our transparency report as far as the law allows.
5. Requests from outside Zimbabwe
- Foreign authorities (including in Germany and other European Union countries, where our servers are) should make their request through the proper international channel, such as mutual legal assistance, so that a Zimbabwean court or authority can review it.
- If a foreign authority approaches our hosting providers directly, we ask them to tell us where the law allows, and not to hand over data unless the request is lawful. Some of our providers, for example Supabase and Cloudflare, are headquartered in the United States, so authorities there could also ask them for data they hold for us, even though it's stored in the EU.
6. Civil and private requests
- Lawyers, employers, family members, private investigators or the media cannot get member data from us just by asking. We need a court order or the member's own written consent.
- Divorce, custody and maintenance matters: we need a court order or subpoena that specifically names Mudiwa and the data required.
7. Members asking for their own data
Members don't need a court order. They can download their own data in the app (Settings → Consents & my data → Download my data), or email us. A member may then choose to share it with the police or their lawyer.
If you've been harmed by someone you met on Mudiwa, report it in the app and to the police. We'll keep the reported conversation and profile safe as evidence and work with the police when they bring a valid order. On request, we can give you a copy of your own side of the conversation and our report record, to take to the police. We won't give you the other person's account details without an order.
Emergencies: imminent risk to life or serious harm
If we believe in good faith that someone faces an imminent risk of death or serious physical harm (for example a kidnapping, a threat to kill, a missing person last seen meeting a match, or a child at risk), we may disclose limited information to the police without waiting for a court order.
- The request should come from a police officer, by email to kudzilenett@gmail.com with "EMERGENCY" in the subject line, and must explain the emergency and why it can't wait for an order.
- We share only what is needed to deal with the emergency (for example, the account's email address and the last log-in time and area).
- A senior member of our team approves it, and we record what was shared, with whom and why.
- We then ask the police to follow up with a court order, and we include emergency disclosures in our transparency report.
If you or someone else is in danger right now, call the police on 995 or emergency services on 999. Don't wait for an email reply.
Mudiwa's own safety features (Share my date and missed check-in alerts) send information to a member's chosen trusted contact, not to the police.
Telling members
We will tell a member, through the app or by email, before we disclose their data, so they have a chance to get legal advice. We won't tell them where:
- a court order or a law forbids it;
- telling them could put someone in danger (for example, the person who reported them);
- it would clearly harm an investigation into a serious crime, such as child abuse, rape or violence, and the police confirm this in writing;
- the account was banned for child sexual abuse material or similar serious harm.
If a gag period ends, we'll tell the member then.
Transparency report
We plan to publish a transparency report every six months, once we have requests to report. It will show:
- the number of requests received, by type (production, preservation, removal, emergency, foreign, interception) and by requesting body;
- how many we complied with fully or in part, and how many we declined or challenged;
- how many accounts were affected;
- how many reports of illegal content we made to the authorities;
- any restrictions that stopped us reporting something (stated as far as the law allows).
We report numbers, never member details.
How to submit a request
Law enforcement and courts:
- Email: kudzilenett@gmail.com. Put "Legal request" in the subject line and attach a scan of the order.
- Emergency requests only: the same address, with "EMERGENCY" in the subject line.
Please send requests from an official address and include the details listed under "What we need to see". We don't accept requests through the in-app support chat or our public WhatsApp line.
Members: email kudzilenett@gmail.com from the address you sign in with.
Changes to this policy
We'll update this page if the law or our practice changes, and show the date of the latest version at the top.