Privacy Policy

Version 1.0 · Last updated 25 October 2026

This policy explains what personal information Makhe collects when you use the Makhe app and this website (makhe.co.za), why we collect it, who can see it, how long we keep it, and the rights you have under South Africa’s Protection of Personal Information Act, 2013 (POPIA).

The short version

• We collect what we need to run a verified community app for your ward: your name, mobile number, ward, and the things you choose to post, report or send.
• Some profile questions are optional. We do not ask for your race.
• The app uses your location only while you are using it. It does not track you in the background.
• When you raise a safety alert, verified responders for your ward can see where you are. That is the purpose of the feature.
• We do not sell your personal information. Ads in the app are chosen by ward, not by your personal details.
• Our app’s data is stored with service providers in the European Union, so it leaves South Africa (section 7).
• You can see, correct and delete your information. Deleting your account takes effect after a 14-day cooling-off period.

1. Who we are

Makhe (Pty) Ltd (“Makhe”, “we”, “us”), registration number 2026 / 306456 / 07, registered in South Africa, runs the Makhe app and this website. Under POPIA we are the responsible party for your personal information.

• Email: support@makhe.co.za
• Address: available on request from support@makhe.co.za.
• Information Officer: the head of Makhe (Pty) Ltd, who is the Information Officer under POPIA. Contact them at support@makhe.co.za with “POPIA” in the subject line.

2. What we collect in the app

Your account

• Your name and surname, and the display name other residents see.
• Your mobile number, which is how you sign in. You can instead sign in with an email address and a password. If you sign in with Google or Apple instead, they give us your name and email address.
• An email address, if you choose to add one.
• Your ward, and whether you are a resident or a visitor there.
• Your date of birth. Everyone is asked for it, because you must be at least 13 to use Makhe (see section 10).
• A 4-digit PIN to unlock the app. We store it only in scrambled (salted and hashed) form, so nobody at Makhe can read it.
• The date and time you agreed to this policy at sign-up.

Your profile

The app asks a few more questions so it can show you things that are relevant to you, such as bursaries, jobs, school help or local services. Your gender is asked during sign-up (you can choose “prefer not to say”); the rest you can skip:

• Your life stage (for example learner, student, working or retired) and employment status.
• School or college details: type of institution, its name, grade or year, field of study, matric status and whether you receive NSFAS funding.
• Household details: household size, whether you have children and how many, and which social grant (if any) your household receives.
• Your home address (street, area, ward), a short bio, a profile photo, your skills and subjects, and your preferred language.

Your real name, date of birth, gender, household details and home address are never shown on your public profile.

Special personal information

POPIA gives extra protection to some kinds of information. In the app this includes:

• Race. We do not ask for or use your race. Earlier versions of the app had an optional race question; if you answered it, that answer was deleted on 25 October 2026.
• Social grant type. Choosing “disability” may reveal health information. This question is also optional.
• Information about crime. Wanted-person alerts and anonymous tips can contain claims that someone has committed a crime. Sections 5 and 8 explain who can see these and how long we keep them.

Identity verification

To become a verified Resident you can submit a photo of your ID document and a selfie (businesses may also add a proof of address). We also keep a scrambled (hashed) copy of your ID number so the same ID can’t be used for two accounts, and the date of birth on your ID to confirm your age.

• The images are encrypted (AES-256-GCM) and stored separately from your profile.
• Only a Makhe super administrator can open them, and only to check your application. They must give a reason each time, and every view is written to an audit log.
• A person compares the images. We do not use automated face recognition.
• If your application is rejected, the images are deleted straight away. Section 9 explains how long approved records are kept.

Your location

The app asks for location permission only while you are using it. It never collects your location in the background. You can say no and pick your ward by hand, though some safety features will not work without location. The app uses your location to:

• Find your ward when you sign up or change ward. Your position is sent to our server to look up the ward. We save the ward, not the coordinates.
• Confirm you live in your ward. Until your home ward is confirmed, the app checks your location at most once a day when you open it. We save only the number of check-ins, not where you were.
• Raise a safety alert or “I feel unsafe”. Your position when you raise the alert is saved with it. If you choose to share your live location, your updated position is shared while the alert is active.
• Walk With Me. While a walk is active and the app is open, your position is sent about every 30 seconds and shared with the one contact you chose. We keep your destination and your last known position.
• Respond to an alert as a verified responder. Your position is shared with the person who raised it.
• Drop a pin on a report, event, lost-and-found item or tip. The pin you place is saved. For anonymous tips you can choose an approximate area, and the pin is rounded to about 150 metres before it is saved.
• Show you on the map and show nearby facilities.

What you post and send

• Posts, comments, likes, events, marketplace listings, jobs, services, reviews, vouches, community reports, lost-and-found items, missing-person alerts and tips.
• Photos you upload. Before uploading, the app re-saves each photo, which removes hidden data stored in the photo file, such as where it was taken.
• Private messages. These are stored on our servers so they can be delivered. They are not end-to-end encrypted (see section 5).
• Reports and flags you make about other people’s content, and moderation decisions about your own.
• Requests you make to us, such as a data request or a bug report.

Information about other people that you give us

Some features need details of someone else: an emergency contact, a Walk With Me contact (who can be a phone number of someone not on Makhe), a parent’s or guardian’s mobile number, or the person in a missing-person alert. Please share someone else’s details only if you have a good reason to and, where you can, let them know.

Usage, device and crash information

• Usage. We record which screens and features are used, together with your ward. Each record is linked to your account ID (not your name or number). We never record your searches, the content of your messages, posts or tips, or your coordinates for this. Reports we look at show grouped totals only. Individual records are deleted after 180 days.
• Ads. We record which ads you were shown and tapped (see section 6).
• Crash and error reports. When the app or our server hits an error, a report is sent to our error-tracking service, Sentry. It includes device and app details, the screen you were on and your account ID. It does not include your name or phone number, and our server removes phone numbers, email addresses and ID numbers from its reports before sending them.
• Notifications. If you allow notifications, we store your device’s push token so we can send them.

3. What we collect on this website

On makhe.co.za we only collect what you actively submit:

• Early access form: your name and email address.
• Contact form: your name, email, a reason for contact, a subject and your message.
• Cookie notice: a single value saved in your browser’s localStorage so we don’t show the notice twice.

Form submissions are emailed to our team at info@makhe.co.za (and, for the contact form, to the inbox for the topic you picked). To stop spam, our web server briefly keeps a scrambled (hashed) form of your IP address. The website is hosted in South Africa by Afrihost.

We do not use analytics or advertising trackers on this website. Its fonts are loaded from Google Fonts, so your browser connects to Google when you visit.

4. Why we use your information

POPIA lets us process personal information only for a lawful reason. Ours are:

• To provide the app you signed up for: your account, your ward, posting, messaging, the marketplace, services and notifications.
• To keep people safe: safety alerts, Walk With Me, emergency contacts and missing-person alerts. When there is a threat to someone’s life or safety, protecting that person is also a lawful reason.
• To verify identity and keep the community trustworthy: trust levels, ID checks, moderation and preventing duplicate or fake accounts.
• With your consent: optional profile details, and notifications you switch on. You can withdraw consent at any time; this does not affect what we did before.
• Our legitimate interests: keeping Makhe secure, fixing errors, preventing abuse, understanding (in grouped form) how the app is used, and showing ward-based ads that pay for the service.
• To comply with the law.

These are the grounds POPIA section 11 allows: your consent, carrying out our agreement with you, complying with the law, and our legitimate interests (or yours). Where we rely on consent, you can withdraw it at any time; this does not affect what we did before.

5. Who can see your information

Other residents

• Your display name, profile photo, bio, trust level and badges, and the things you post publicly are visible to other residents, mostly within your ward.
• When you raise a safety alert, residents in the area see your display name, your message and any photo, and a location rounded to about 1 kilometre.
• When you make a service enquiry, the service provider sees your mobile number so they can reply to you.
• Contact numbers on missing-person and wanted-person alerts are visible only to verified Residents.

Safety responders and your contacts

Makhe works with verified responders: private security companies, Community Policing Forum (CPF) members and police (SAPS) who we have approved for specific wards.

• Approved responders for your ward can see your safety alert, including your display name, message, photo, and your exact location (and your live location, if you chose to share it). When they respond, you can see their location as they come to help.
• For the two most serious alert levels (red and black), we also send an SMS to approved security companies and registered police officers for your area (for serious incident types such as hijacking, the area is wider than your ward). The SMS contains the alert level, the ward, your message, your exact coordinates and the time. It does not contain your name or mobile number.
• Your emergency contact is told when you press “I feel unsafe”, and may be told if an alert you raised is escalated.
• Your Walk With Me contact sees your journey while it is active. If your updates stop for 10 minutes or you press the panic button, they are alerted with your last known location (by SMS if they are not on Makhe).
• Anonymous tips: responders and ward leaders who review tips never see who sent them.

Makhe staff and administrators

Authorised Makhe administrators can see account and profile details when they need to for support, verification, moderation or legal requests. Most administrators can only see the wards they look after. The most sensitive actions need a reason and are logged:

• viewing ID verification images (super administrators only);
• revealing who sent an anonymous tip (super administrators only);
• reading a private conversation, which we do only to investigate a report, an automatic keyword flag or a legal request.

Private messages are checked automatically against a list of warning words so that possible abuse can be reviewed. When you send a tip about a missing or wanted person, administrators can see your name and trust level so they can follow up; only super administrators can see your full number. Flagged posts are reviewed by trusted ward leaders who cannot see who wrote them.

Service providers who work for us

We use these companies to run Makhe. They may only use your information to provide their service to us. Each provider handles your information under its own data processing terms, which require it to keep the information secure and confidential and to use it only for the service it provides to us.

• Supabase — our database and sign-in system. Germany (EU).
• Railway — hosts the Makhe app server. The Netherlands (EU).
• Expo — sends push notifications and delivers app updates. United States. Push notifications then pass through Google (Android) or Apple (iPhone). A notification about a new message shows the first part of that message.
• Sentry — crash and error reports. Germany (EU).
• Resend — sends sign-in emails if you use email to sign in. Ireland (EU).
• SMSflow — sends SMS messages: sign-in codes, alert messages to responders, Walk With Me alerts and parental consent requests. South Africa.
• CARTO (map images) and unpkg (the map software). When you use the map, your device contacts these services directly. They can see your device’s internet address, and CARTO can see the area of the map you are viewing.
• OpenStreetMap Nominatim — turns a pin you drop into a street name. Your device does not contact it: our server asks on your behalf and sends only the pin’s position, rounded to about 11 metres.
• Google and Apple — only if you choose to sign in with them.
• PayFast — handles card payments for advertisers. Makhe never sees card details. South Africa.
• M.Y Tech Guys — builds and supports the Makhe app and website, and may access our systems to do that. South Africa. M.Y Tech Guys acts as an operator for Makhe under POPIA: it may only process personal information on our instructions and must keep it secure and confidential.
• Afrihost — hosts this website and the form emails. South Africa.

Police and the law

Apart from the responder features above, which you choose to use, we give personal information to police or other authorities only when the law requires us to (for example, under a court order or subpoena) or when it is necessary to prevent a serious and imminent threat to someone’s life or safety. If we are asked for information without a legal requirement, we refuse.

We do not sell your information

We do not sell, rent or trade your personal information, and we do not share it with anyone for their own marketing.

6. Advertising

The app shows ads from Makhe itself and from local advertisers. Ads are chosen by your ward and the screen you are on, not by your age, gender, race, profile details or what you do in the app. We record which ads you were shown and which you tapped, linked to your account, so we can avoid showing you the same ad too often and count views and taps. Advertisers only see totals such as the number of views and taps. They never see who saw or tapped their ad.

If you advertise on Makhe, we keep your business name, contact name, mobile number, ward and payment records. Card payments are handled by PayFast, who receive your first name and the payment amount.

7. Information sent outside South Africa

No suitable South African region is available from our main service providers, so the app’s data is stored in the European Union (Germany and the Netherlands), and some services (such as Expo push notifications) are based in the United States. The EU is covered by the General Data Protection Regulation, which gives protection similar to POPIA. Under POPIA section 72 we only send information outside South Africa where the recipient is bound by law (such as the GDPR) or by contract terms that give protection substantially similar to POPIA, or where the transfer is needed to provide the service you asked for. Where a provider is outside the EU, we rely on its contract terms to protect your information.

8. How long we keep it

• Your account and profile: while your account is open. Section 9 explains what happens when you delete it.
• Posts, messages and other content: until you or we remove them, or your account is deleted (some content stays visible to the people you shared it with, see section 9).
• Safety alerts: once an alert has ended and is 180 days old, its message, photo and location are erased and responses to it are deleted.
• Missing-person and wanted-person alerts: photos and contact numbers are erased 12 months after the alert is resolved. An alert that is taken down disappears from the app immediately.
• Anonymous tips: the text, photo, location and link to the sender are erased once a tip is closed and 180 days old, and for every tip after 365 days at most.
• Usage records: 180 days. After that only grouped daily totals remain, which do not identify anyone.
• Records of an administrator reading a private conversation: 90 days.
• Walk With Me history: 90 days after the walk ends. A walk that is still active is never deleted.
• Advertiser proof-of-payment images: 90 days after the payment is completed, rejected, expired or cancelled.
• Ad view and tap records: 13 months. After that they are added to anonymous daily totals per ad and ward, which do not identify anyone, and the individual records are deleted.
• Administrator audit logs: 5 years, then deleted.
• Website early access list: sign-ups were kept only as emails in our inbox. Now that the app has launched, we will delete them by 31 December 2026. Ask us at any time to delete yours sooner.
• Website contact messages: up to 24 months after our last exchange with you.

9. Deleting your account

You can delete your account in the app: open the Me tab, scroll to the bottom and tap Delete Account. If you no longer have the app, email support@makhe.co.za with the subject “Delete my account”. Full steps are on our account deletion page.

Your account is closed straight away and you are signed out. For 14 days it can still be restored by signing in again. After 14 days the deletion is permanent, and we erase:

• your name, mobile number, email address and profile photo;
• your bio, home address, date of birth, gender and other profile details;
• your Google or Apple sign-in link and your Makhe sign-in account;
• your notification (push) token;
• any ID verification documents that were not approved.

Usage statistics are kept only in anonymous form, no longer linked to you. We also delete your Walk With Me history and lost-and-found items, remove your location from safety alerts and responses, remove your number from service enquiries, and remove the link between your account and the ads you were shown or tapped.

We keep:

• Approved ID verification records for 5 years after your account is deleted, to help prevent fraud and repeat abuse (for example, a banned person signing up again) and to deal with legal claims. They are then permanently deleted.
• Content you shared with other residents, such as posts, comments and messages, may remain visible to the people you shared it with.

10. Children

You must be at least 13 to use Makhe. The app asks everyone for their date of birth and will not accept an age under 13.

If you are 13 to 17, you need permission from a parent or guardian. During sign-up you enter their South African mobile number and we send them an SMS. Your account stays locked until your parent or guardian contacts Makhe to approve it and a Makhe administrator records the approval. Under-18s cannot use the marketplace, services or jobs.

If we learn that someone under 13 has an account, or a parent or guardian tells us they did not give permission, we will close the account. Contact safety@makhe.co.za.

How parental consent works (POPIA section 35): when someone under 18 signs up, we ask for a parent or guardian’s mobile number and send them an SMS link to give consent. Until they do, the account stays locked: the child’s name, date of birth, mobile number and ward are used only to ask for consent and are not shown to anyone. A parent or guardian can withdraw consent, or ask us to delete the account, at any time by emailing safety@makhe.co.za.

11. How we protect your information

• Information travels between the app, this website and our servers over encrypted (HTTPS) connections.
• ID verification images are encrypted, and PINs are stored only as salted hashes.
• Administrator access is role-based and limited by ward, and administrator actions are logged.
• Signing out, changing your phone number or a ban ends your sessions on all devices.

No system is completely secure. If your personal information is accessed without permission, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA requires.

12. Your rights

Under POPIA you can:

• Ask what information we hold about you and get a copy. In the app, open the Privacy screen and tap Export My Data, or email us.
• Correct information that is wrong, by editing your profile or by asking us.
• Delete your account and information (section 9).
• Object to us using your information, including for our legitimate interests.
• Withdraw consent you gave, for example by removing optional profile details or turning off notifications. Some features may stop working.
• Complain to the Information Regulator of South Africa at inforegulator.org.za if you believe we have mishandled your personal information.

To use any of these rights, email support@makhe.co.za with the subject line “POPIA request”. We will confirm it is you before acting, and we will respond within 30 days.

13. Automatic decisions

Some things happen automatically: content that is flagged by three people is hidden until it is reviewed, messages that match warning words are flagged for review, and your trust level can go up automatically when neighbours vouch for you. Decisions with serious effects, such as approving your ID, applying a strike or banning an account, are always made by a person.

14. Changes to this policy

When we update this policy we will change the version and date at the top. If a change materially affects how we use your information, we will tell you in the app before it takes effect.

15. Contact us

Questions about this policy or your information: support@makhe.co.za. Information Officer: the head of Makhe (Pty) Ltd, at support@makhe.co.za (subject “POPIA”).