Mudiwa Privacy Policy

Version: 1.0 · Effective date: 26 October 2026

Dating is personal. Much of what you share on Mudiwa, such as your gender, age, what you're looking for and your face, is what Zimbabwean law calls sensitive data. We treat it that way. This policy explains, in plain words, what we collect, why, who sees it, where it is kept, how long we keep it, and how you stay in control.

It is written to follow Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] ("the Act") and its regulations.

The short version

1. Who is responsible for your data

Mudiwa is the service in this policy. It is run by its founder, who decides how and why your data is used and is responsible for protecting it. In the language of the Act, we are the data controller.

You can reach us about anything in this policy, and make any request in section 9:

We answer privacy requests personally. If you are not happy with how we handled your data, you can also complain to the regulator (see section 9).

2. What we collect, and why

We only collect what we need to run a safe dating app (Act s13(d)). If a field is optional, we say so in the app.

2.1 Details you give us

2.2 Your selfie check (biometric data)

Before you can message anyone, you do a short selfie liveness check. Here's exactly what happens:

What we use it for, and nothing else:

What we never do with it: show it on your profile or to other members; use it for ads; sell it; or use it to identify you anywhere outside Mudiwa.

Where it goes: our verification provider, Smile ID, processes it for us under a written contract (Act s18(4)–(5)). Smile ID may process face data outside Zimbabwe and the European Union; it is listed in section 5 and section 6.

If you don't want to do the selfie check: you can still create a profile and browse, but you won't be able to message. We require the check before messaging because it is the main way we keep fake profiles, catfishing and scams out of Mudiwa.

2.3 Location

2.4 Information about other people

2.5 Information collected automatically

We don't use advertising trackers and we don't sell data to data brokers. Our analytics (PostHog) and crash reports (Sentry) are hosted in the European Union and listed in section 5. Our website does not use advertising cookies.

2.6 What we don't collect

3. The legal basis we rely on: your written consent

The Act says we may only process sensitive data if you've given consent in writing (s11(1)), and biometric data only with consent in writing (s12(1)). Because almost everything on a dating profile is sensitive, consent is the main basis for what we do.

How we ask. During sign-up, before you enter any sensitive details or take your selfie, we show a consent screen with three separate ticks:

Nothing is pre-ticked. Each tick has a "Why we ask" link explaining it in plain words. Ticks 1 and 3 are needed to use Mudiwa at all. Tick 2 is needed before you can message.

How we record it. For each tick, we keep a record of: your account; which consent; the exact wording version you saw; the date and time; the app version and device; and whether you gave or withdrew it. You can see your consent history in Settings → Consents & my data, and it's included in your data download. This record is your consent in writing.

Other bases we rely on, for limited things:

4. Automated tools and decisions

We use automated tools to help keep Mudiwa safe:

A person makes the decision before any ban for a rule break. Automated tools can show warnings, blur photos or put something in a queue for review. They don't ban you on their own. You have the right not to be subject to a decision based solely on automated processing that significantly affects you (Act s25).

To detect scams, our systems process the text of messages. Your messages are encrypted in transit and when stored, but they are not end-to-end encrypted. This is so our safety tools can work and our team can review messages that are reported. Our team only reads messages when they are reported to us, when our systems flag a serious risk, or when the law requires.

5. Who we share your data with

Other members see your profile: first name, age, photos, prompts, interests, area or approximate distance, what you're looking for, and your verified badge. They never see your email address, selfie, exact location, birthday or who you've liked (only the person you liked sees your like).

Service providers (data processors). We use trusted companies to run Mudiwa. Each one is bound by a contract or terms with us that require it to keep your data secure and use it only to provide its service to us (Act s17, s18(4)–(5)).

Law enforcement and courts. We only share data with the police or other authorities when there's a valid legal order under Zimbabwean law (for example, a magistrate's order under the Criminal Procedure and Evidence Act [Chapter 9:07]), or in a genuine emergency where someone's life is at risk. We share only what is needed. Our Law Enforcement and Data Requests policy explains this in full.

Reporting illegal content. If we become aware of child sexual abuse material or other clearly illegal content, we will remove it and tell the police (the Zimbabwe Republic Police), as the law expects of hosting providers.

If Mudiwa is sold or restructured, your data may pass to the new owner, who must keep protecting it under this policy and the law. We'll tell you in the app first and you'll be able to delete your account before the change.

We never sell your data and we never share it with advertisers.

6. Hosting in the European Union, and other countries (cross-border transfer)

Mudiwa is made for people in Zimbabwe, but our main servers are in the European Union, in Frankfurt, Germany. That means your data is transferred outside Zimbabwe.

7. How long we keep your data

We keep data only as long as we need it (Act s7(1)(c), s13). The Act doesn't set fixed periods, so these are the periods Mudiwa applies:

Deleted means deleted. When data is erased, it's removed from our live systems and drops out of backups within 35 days.

8. How we keep your data safe

We take appropriate technical and organisational measures to protect your data (Act s18). These include:

If there's a data breach

9. Your rights, and how to use them

Under the Act (s14, s25) you have the right to:

What happens when you withdraw consent:

Withdrawing doesn't affect what we did lawfully before you withdrew.

Other ways to ask. If you can't use the app, email us (section 1) from the email address on your account. We may need to confirm it's really you before we act. We respond to requests within 30 days at most, and usually much faster. We don't charge for requests.

10. Children

Mudiwa is only for adults aged 18 and over. The Act defines a child as anyone under 18 (s3), and children's data needs a parent's or guardian's consent (s26), which doesn't fit a dating app. So:

If you think a child is using Mudiwa, please report the profile in the app or email us (section 1).

11. Ads: not active

There are no ads in this version of Mudiwa. If we introduce ads, we'll update this policy and tell you in the app before they start.

When ads start, we commit to the following:

12. Payments: not active

There are no payments in this version. When paid features start, we'll update this policy to explain what payment data we collect (for example, transaction reference, amount and date). We'll never store full card numbers or mobile-money PINs.

13. Changes to this policy

If we change this policy, we'll update the version number and date. For important changes, especially any new use of sensitive data, we'll tell you in the app before the change and ask for your consent again where the law requires it.

14. Contact us