Privacy Policy

1. Who we are

Khapha is a commuter safety app that helps people request and provide escorted, on-foot journeys. Khapha is built and operated by NEXARYO (“we”, “us”, “our”), which is responsible for the personal information processed through the app. This Privacy Policy explains what we collect, why, and what choices and rights you have. It is written to align with South Africa's Protection of Personal Information Act, 2013 (POPIA).

2. Information you give us

Some information is provided directly by you when you create an account, complete onboarding, or use core features of the app:

• Onboarding and identity information: your South African ID number, date of birth, gender, phone number, and profile photo. We do not keep your full ID number. Instead, we store a one-way (irreversible) code derived from it, together with only the last four digits, which is enough to support identity checks without retaining the complete number.
• Journey information: your destination, pickup point, and any notes you add for a requested or active journey.
• Crime report information: the location and details you submit when filing a crime report through the app.

3. Information collected as you use the app

As you use Khapha, we also collect information generated by that use, including:

• Location data: used to match journeys, guide escorts, and support safety features.
• Journey records: trip history, status, and related activity.
• Notification tokens: device identifiers used to deliver push notifications.
• Security logs: technical logs used to protect accounts and detect misuse.

4. How we use your information

We use the information described above to:

• Create and manage your account.
• Verify your identity, including the ID checks described in section 2.
• Match commuters with available escorts.
• Plan and guide routes for active journeys.
• Generate and verify trip codes used to confirm pickups and journeys.
• Send notifications relevant to your journeys and account.
• Review safety concerns, crime reports, and incidents.

We do not sell your personal information, and we do not use it for advertising.

5. What other users can see

Khapha limits what one user can see about another:

• Escorts viewing open journey requests see only the general area and time of the request — not the commuter's identity or exact address.
• Once an escort accepts a request, they receive the commuter's name, pickup point, destination, and any notes provided for that journey.
• Crime reports are visible to relevant users without the reporter's name attached.
• Your ID number, phone number, and date of birth are never shown to other users.

6. Service providers we use

We rely on trusted third-party service providers to operate Khapha. These providers process information on our behalf and under instruction:

• Google Firebase and Google Sign-In — authentication, app infrastructure, and data storage.
• Geoapify — place search and route/direction calculation.
• OpenFreeMap — map tiles used to display maps in the app.
• Google ML Kit — on-device face detection used for identity checks. This processing happens locally on your phone.

Some of these providers may process or store data outside South Africa. Where this occurs, we take reasonable steps to work with providers that offer an appropriate level of protection for your information, consistent with POPIA's requirements for cross-border transfers.

7. Device permissions

Khapha may request the following device permissions to function correctly:

• Location: to match journeys, display maps, and guide escorts and commuters.
• Camera: to capture a profile photo and support on-device face detection during identity checks.
• Notifications: to deliver journey updates and safety alerts.

You can manage these permissions at any time through your device settings.

8. How long we keep your data

We keep personal information only for as long as necessary to provide the app, meet safety and legal obligations, and resolve any disputes or reports. Journey and crime report records may be retained longer where needed for safety review or legal compliance. When information is no longer needed, we delete it or retain only the minimum necessary in de-identified form.

9. Your rights

Under POPIA, you have the right to:

• Ask whether we hold personal information about you, and request a copy of it.
• Request that we correct or update inaccurate information.
• Request that we delete personal information we hold about you, subject to legal or safety-related retention needs.
• Object to certain processing of your personal information.
• Lodge a complaint with us, or directly with the Information Regulator of South Africa, if you believe your information has been mishandled.

To exercise any of these rights, contact us at admin@nexaryo.co.za. We may need to verify your identity before completing your request.

10. Safety and legal disclosure

Khapha is intended for use by adults aged 18 and over only. We may disclose personal information where required by law, to protect the safety of a user or the public, or to respond to a lawful request from police or another authority investigating a crime report or safety incident submitted through the app.

11. Security

We apply reasonable technical and organisational measures to protect your personal information, including restricting access to sensitive data such as your ID-derived code, encrypting data in transit, and limiting what is visible to other users as described in section 5. No system connected to the internet can be guaranteed completely secure, and we continue to work to reduce risk and respond quickly to any incident.

12. Contact us

If you have questions about this Privacy Policy or how your information is handled, contact us at: