Umtu Privacy Policy
Plain answers about your data. Last updated 26 July 2026.
1. Who we are
Umtu ("we", "us") is an Africa-first social platform — posts, reels, stories, chats, creator support, a marketplace and a rewards wallet — operated from Zimbabwe and available at umtu.me and through our mobile apps. This policy explains what data we collect, why, and the choices you have. It applies to the website, the web app and the Android app.
2. What we collect
Account details: name, date of birth, email address, username, password (stored only as a secure hash), country, and optionally your phone number. Profile details you choose to add: photo, bio, interests, gender, city. Content you create: posts, reels, stories, comments, reactions, messages (including photos and voice notes), reviews and support tickets. Wallet and transactions: your points balance, points history, top-ups, redemptions, and the mobile-money number you provide for cash-outs. Card and mobile-money payments are processed by licensed payment providers — we never see or store your card number or wallet PIN. Device and technical data: basic device information when you register a device, and the country derived from your connection for traffic statistics. Our analytics are self-hosted and privacy-preserving: we do not use third-party analytics or advertising trackers, and we do not store your raw IP address with analytics data. Location: only what you type or explicitly share — for example a delivery address, or a business pickup point. The app asks for device location only if you choose to use map features.
3. How we use your data
To run the platform: accounts, feeds, chats, the wallet ledger, the marketplace and deliveries. To pay you and protect the money system: verifying rewarded-ad engagement, detecting fraud and abuse, processing top-ups and cash-outs, and meeting our bookkeeping and tax obligations (for example ZIMRA-compliant transaction records). To keep the community safe: enforcing the Community Guidelines, reviewing reports, and moderating content. To communicate: verification codes, receipts, and notifications you can control in Settings. We do not sell your personal data, and we do not share it with data brokers.
4. Rewarded ads
Watching ads on Umtu is optional and rewarded. Advertisers see aggregated results (views, answers, demographics in aggregate) — never your private profile, contact details or wallet. We do not use third-party ad networks or cross-app tracking; ads are served from our own platform.
5. Who we share data with
Payment providers (for example ContiPay or Paynow in Zimbabwe) to process top-ups and payouts; our hosting providers (DigitalOcean, with data stored in the European Union — Frankfurt) and email/SMS/WhatsApp delivery providers for verification codes; and authorities where the law requires it (for example tax records or a lawful request). This means your data is stored and processed outside Zimbabwe, in Germany — a European Union country with strong data-protection law (GDPR) — in line with the Cyber and Data Protection Act [Chapter 12:07]. Public content — your public posts, reels, profile name and photo — is visible to others by design; you control post visibility per post.
6. How long we keep data
Account and content data stay while your account is active. Traffic analytics rows are deleted automatically after 180 days. Read notifications are removed after 2 days. Financial ledger records are kept as required by tax and accounting law even after account deletion. When you delete your account, your profile and content stop being visible immediately and are then permanently removed from the platform, except for records we must keep by law.
7. Your choices and rights
In the app you can edit your profile and account details, control who sees your posts, manage notification preferences, and delete your account (You → Settings). You may also ask us to access, correct or delete your data by contacting support. Cash-out requires a verified phone number; everything else works without one.
8. Security
All traffic is encrypted with TLS. Passwords are stored as strong one-way hashes. Sessions can be revoked, and suspicious refresh-token reuse revokes all sessions automatically. Payments run through licensed processors — card details never touch our servers. No system is perfectly secure; if we learn of a breach that affects you, we will notify you.
9. Children
Umtu is for people aged 15 and over. We do not knowingly collect data from anyone younger; accounts that misstate their age are removed. If you are under 18, involve a parent or guardian — Umtu includes earning, spending and marketplace features.
10. Changes and contact
We will post any changes to this policy here and, for material changes, notify you in the app. Questions or requests: email [email protected] or use Help inside the app. Last updated: 26 July 2026.