Privacy Policy — Badilisha Kituo
Effective date: 6 September 2026 Last updated: 6 September 2026
Every factual claim below was derived by reading this codebase — the columns the API stores, the files it accepts, the third parties it actually calls — so it describes the product as built rather than a product in general.
Before publishing: this document has not been reviewed by anyone qualified to advise on Tanzanian data protection law (the Personal Data Protection Act, 2022 and its 2023 regulations). Have it reviewed — and pay particular attention to the cross-border transfer basis under Where it is stored, which is the one paragraph here that states a legal conclusion rather than a fact about the software.
Every right described below is implemented, tested and working. There are no claims here the product cannot honour.
Who we are
Badilisha Kituo ("the app") is operated by Swala Technologies Limited ("we", "us"), of Kijitonyama, Dar es Salaam, Tanzania.
For anything in this policy, or to exercise any right described in it, contact us at privacy@swalatech.com.
What the app is for
Badilisha Kituo helps public-service employees in Tanzania find a reciprocal workplace transfer — someone posted where you want to be, who wants to be where you are. Matching people to each other is the whole product, so some of what you give us is shown to other members. This policy is specific about which.
What we collect, and why
You give us
| Why | Required? | |
|---|---|---|
| Phone number | Your account identity. We send a one-time passcode to it to prove the number is yours, and you sign in with it. | Yes |
| Name | Shown to other members as your display name. A separate legal name is stored privately and is used only for verification. | Yes |
| Profile photo | Shown on your discovery card. Stored on a private disk and served only to signed-in members through an authorised request — never at a public URL. | No |
| Employment details | Your profession, your current station and the regions you would transfer to. These are what the matching engine compares; without them the product cannot work. | Yes |
| Verification documents | If you choose to verify your account: an identity photo, an employment letter, a payslip or another supporting document (up to five files). Reviewed by our staff, stored privately, never shown to other members. | No |
| Messages | What you write to members you have matched with. | No |
| Email address | Optional, for account recovery. | No |
We do not collect your device's GPS location. Where you are is the region and district you tell us, chosen from a list.
The app collects automatically
| Why | |
|---|---|
| Notification token | A Firebase token so we can send you a push notification. Rotates; it is not a permanent device identifier. |
| Installation identifier | A random identifier generated on first launch and kept across token rotations, so we can tell one installation from another. Not a hardware ID. |
| App version, build and platform | Sent as headers with each request. This is what lets us tell whether a fault affects one release, and what makes it possible to ask an out-of-date build to update. |
| Device integrity signals | Whether the Android device the app is running on is rooted or has developer options enabled. This is checked on the device and is not sent to us. See Device integrity below. |
| Crash diagnostics | If the app crashes, Firebase Crashlytics reports the fault, the app version and the device model. Not tied to your name or phone number. |
What other members can see
Your discovery card shows limited professional information — your display name, your profile photo if you added one, your profession, and the stations involved in the transfer you are looking for.
Your phone number, your legal name, your email address and your verification documents are never shown to other members, and nothing gives another member access to them without an action you take: contact details are exchanged only when you share them.
You can block another member at any time, which stops them seeing you.
Device integrity
The Android app checks whether it is running on a rooted device, or one with developer options or USB debugging switched on. If it is, the app refuses to run and shows you which check failed.
This protects other members, not us: an account taken over on a compromised device is used to talk to real people about a real move, and the documents in this system are government identity papers and payslips.
These checks happen entirely on your device and their result is not sent to us. We do not collect a device fingerprint, an advertising identifier or a hardware serial number, and nothing about this check can be used to identify your device across apps.
Who we share it with
We do not sell your personal data, and we do not share it for advertising.
We use these processors, each of which receives only what its job requires:
| Processor | What it receives | Why |
|---|---|---|
| Google (Firebase Cloud Messaging) | Your notification token and the notification | Delivering push notifications |
| Google (Firebase Crashlytics) | Crash diagnostics, app version, device model | Diagnosing faults |
| SwalaSMS | Your phone number and the passcode | Delivering your sign-in passcode |
| Hostinger | Everything stored, as the host of our servers | Running the service |
Artificial intelligence. The app uses an AI service to read and tidy publicly published government vacancy notices for the job catalogue. It is not given member profiles, messages, photographs or verification documents.
We may also disclose information where the law requires it, or to establish or defend a legal claim.
Where it is stored
On servers in the European Union, operated by Hostinger.
That is outside Tanzania, so the Personal Data Protection Act, 2022 applies to the transfer. We make it on two bases: it is necessary to perform our agreement with you — the service you signed up for runs on those servers, and there is no version of it that does not — and the destination is subject to a data-protection regime (the EU General Data Protection Regulation) offering protection comparable to Tanzania's, under written data-processing terms with our host.
If the Personal Data Protection Commission directs otherwise, we will change where your data is stored rather than continue on a basis it has rejected.
How long we keep it
| Your account and profile | Until you delete your account |
| Verification documents | 90 days after a decision is made, or immediately when you delete your account. Deleted automatically — the decision is kept, the documents are not |
| Messages | Until you or the other member deletes them, or either account is deleted |
| Crash diagnostics | As retained by Firebase Crashlytics (currently 90 days) |
| Deletion requests made through our website | 12 months, as the record of a request we acted on |
| Records we must keep by law | For as long as the law requires |
How it is protected
Sign-in credentials are held in your device's secure storage. Profile photos and verification documents are kept on a private disk and are streamed only through authenticated requests, never from a public address. Sensitive columns are encrypted. Staff access to member data is limited by role, and actions staff take on an account are recorded in an audit log.
No system is perfectly secure, and we do not claim otherwise.
Your rights and controls
You can, from within the app:
- change what your profile shows,
- control which notifications you receive,
- block another member,
- remove your profile photo,
- withdraw a transfer request,
- download a copy of your data — Account → Download my data. It arrives as a JSON file containing your account, profile, transfer requests, settings and the messages you sent.
- delete your account — Account → Delete account.
Deleting your account
Deletion from inside the app is immediate and permanent. There is no grace period and it cannot be undone. Because of that, we ask you to confirm with your password, or — if you have not set one — by typing your own phone number.
What is erased: your profile, your photo, your employment details, every transfer request you published, your matches and the conversations inside them (for both people), your verification documents, your notification settings, your saved destinations and your devices.
What is kept: reports other members made about your account, with your identity removed, so that the same conduct can be recognised again; and anything the law requires us to retain. Keeping the first is necessary to protect other members, and it no longer identifies you.
If you cannot sign in — you lost the phone, changed number, or removed the app — request deletion at https://api.badilishakituo.co.tz/account-deletion. We will contact you to confirm the number is yours, and then delete the account within 30 days. We verify because otherwise anybody who knows your number could delete your account.
You may also ask us for a copy of your data or its deletion by writing to privacy@swalatech.com. We will respond within 30 days.
Children
Badilisha Kituo is for employed adults in the public service. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will remove it.
Changes to this policy
If we change this policy we will update the date at the top, and we will tell you in the app where the change is significant.
Contact
Swala Technologies Limited Kijitonyama, Dar es Salaam, Tanzania privacy@swalatech.com
If you are not satisfied with our response, you may complain to the Personal Data Protection Commission of Tanzania.