Privacy Policy
Last updated: 26 October 2026
⚠ ACTION REQUIRED BEFORE PUBLISHING
This policy is complete and accurate as to what the app does — every data category below was verified against the database schema, the API controllers and the Flutter source. What it cannot contain is legal and business information that does not exist anywhere in the project.
Replace every highlighted value below, then delete this box. Google Play requires a reachable, accurate privacy policy URL before your listing can go live.
Contents
1. Who we are
Bonga is a mobile application combining three experiences under one account: Social (posts, replies and follows), Dating (profile discovery) and Odds (sports predictions).
Bonga is operated by TechOn — full registered legal entity name, based in Dar es Salaam, Tanzania. Registered address: full postal address. Company registration number: registration number.
This policy explains what we collect, why, and what control you have over it.
2. Information we collect
Information you give us
| What | When | Why |
|---|---|---|
| Username, email address, phone number | Registration | To create and identify your account |
| Password | Registration | Stored only as a cryptographic hash — we never store or can read your actual password |
| Gender and date of birth | Registration | Required for dating features and to confirm you are 18 or over |
| Profile photo, bio, interests and goals | Profile setup, optional and at any time | To build your public Bonga profile |
| Posts, replies, photos and videos | When you post | To publish content you choose to share |
| Messages | When you chat | To deliver your messages |
Information created by your activity
- Social activity — likes, saved posts, reposts, post views and who you follow.
- Dating activity — the profiles you like or pass on, so we do not show you the same profile twice.
- Odds activity — which predictions you have unlocked.
- Account state — subscription status and wallet balance.
Information collected automatically
- Authentication tokens — an access token is stored on your device so you stay signed in.
- Approximate location — only if you grant permission, and only when you add a location to a post. See §5.
- Technical information — your device makes standard network requests to our servers, which record the usual details required to serve them.
What Bonga does not do. We do not run third-party advertising SDKs, we do not sell your personal information, and we do not track you across other apps or websites.
3. How we use your information
- To create your account and keep you signed in.
- To show your profile, posts and activity to other users as you have chosen.
- To show you other people's content, and dating profiles you have not already seen.
- To deliver your messages.
- To process purchases of premium predictions and subscriptions.
- To notify you when someone likes or replies to your post, or follows you.
- To keep Bonga secure and to investigate abuse.
4. Sharing and third parties
Bonga uses a small number of third-party services. Each receives only what it needs to function:
| Service | What it receives | Why |
|---|---|---|
| Google Sign-In | Your Google account identity, if you choose that sign-in method | To authenticate you without a password |
| Google Firebase (Authentication & Firestore) | Your Bonga user identifier, username, profile photo URL, and your message content | Chat is delivered through Firestore |
| CashPay | The phone number you enter for payment, the amount, and a reference for the purchase | To process mobile payments |
We also share information where we are legally required to, or where it is necessary to protect the rights and safety of our users.
5. Location
Bonga requests location permission only when you choose to attach a location to a post. If you decline, everything else in Bonga continues to work.
Your coordinates never leave your device. The conversion from coordinates to a readable place name is performed by your phone's own geocoder — it is not sent to us or to any third party. Only the resulting place name (for example "Dar es Salaam, Tanzania") is attached to your post, and only if you choose to post it.
We do not track your location in the background, and we do not store your precise coordinates.
You can revoke location permission at any time in your device settings.
6. Photos and media
When you add a profile photo or post an image or video, the file is uploaded to and stored on our servers, and is served over HTTPS. Camera and photo-library permissions are requested only at the moment you choose to add media, and declining them does not prevent you from using the rest of Bonga.
7. Messages
Messages are delivered and stored using Google Firestore. They are transmitted over encrypted connections and are accessible to you and the person you are messaging.
Please note: Bonga messages are not end-to-end encrypted. They are encrypted in transit and at rest by the storage provider, but they are not technically inaccessible to us. Do not use Bonga to send information you need to be end-to-end encrypted.
8. Payments and purchases
Payments are processed by CashPay. Bonga never receives or stores your full payment credentials. We record which prediction or subscription you purchased, the amount, and whether the payment succeeded — so we can unlock what you paid for.
A purchase is only ever treated as complete once our payment provider confirms it. If a payment is pending, Bonga will tell you it is pending rather than implying success.
9. How long we keep your information
- Account information — for as long as your account exists.
- Posts and messages — until you delete them, or until your account is deleted.
- Purchase records — retained after account deletion where we are required to keep financial records. Retention period: confirm with your accountant / Tanzanian tax requirements.
10. Security
- All traffic between the app and our servers uses HTTPS. Plain-text HTTP is disabled in the app.
- Passwords are stored only as cryptographic hashes.
- Access tokens are stored in the app's private storage and are cleared when you sign out.
No system is perfectly secure. If you believe your account has been compromised, contact us immediately at the address in §15.
11. Your rights and choices
- Access and correction — you can view and edit your profile in the app at any time.
- A copy of your data — contact us and we will provide one.
- Deletion — see §12.
- Permissions — location, camera and photo access can be granted or revoked at any time in your device settings.
12. Deleting your account
You can permanently delete your Bonga account from inside the app at any time:
Profile → Settings & privacy → Delete account
You will be shown exactly what is removed, asked to confirm that you understand it is permanent, and asked to confirm a second time before anything happens.
What is deleted
- Your profile, photo, bio, interests and goals
- Your dating moments and the photos and videos attached to them
- Your likes, saved posts, reposts and follows
- Your swipe history and discovery preferences
- Your notification history
- Your sign-in credentials and all active sessions — you will not be able to sign back in
- Your chat identity, so the account can no longer be used to message anyone
What remains, and why
- Discussion posts and replies you wrote stay visible, but are anonymised — your name and photo are removed and replaced with "Deleted user". This is because other people have replied to those posts, and deleting them would destroy other users' contributions to a conversation you do not solely own.
- Messages you already sent remain in the other person's conversation. A message is a shared record between two people; removing it from someone else's history would rewrite a conversation they participated in. Your account and identity are gone, so no further messages can be sent or received.
Deletion is immediate and permanent. There is no recovery period and no way to restore a deleted account — you would need to register again from scratch.
If you cannot access the app to delete your account, contact us at privacy@ your verified domain from the email address registered to your account.
13. Age requirement
Bonga includes dating features and is strictly for people aged 18 and over. Registration requires a date of birth and rejects anyone under 18. If we learn that an account belongs to someone under 18, we will remove it.
14. Changes to this policy
We may update this policy as Bonga changes. The date at the top always reflects the current version. Material changes will be communicated in the app.
15. Contact us
Questions about this policy or your information:
- Email: privacy@ your verified domain
- Postal address: full registered address, Dar es Salaam, Tanzania
⚠ These contact details must be real and monitored. No verified
contact address exists anywhere in this project — the only mail configuration
found was Laravel's default hello@example.com placeholder. Google
Play will reject a listing whose privacy contact does not work.