Privacy Policy

The short version

Akari is a shared event gallery. A host creates an event, shares a QR code, and guests add photos, videos and messages to one gallery, without an account.

• Guests don't need an account, an email address or a phone number. A first name is optional.
• What you add to an event is shared with everyone who has that event's link.
• Events are temporary. Uploads close 48 hours after the event, the gallery stays open for 14 days after it (or a year, if the host pays to keep it), and everything is then deleted.
• Face grouping only happens when the host turns it on, the join screen tells you, and face data is deleted when the event expires.
• We never sell your information, never show ads, and never use your photos or videos for advertising or to train AI models.
• There are no advertising, analytics or tracking tools in our apps or website.

The rest of this policy gives the details.

Who we are

Akari is run by veTech (Private) Limited, Highlands, Harare, Zimbabwe (vetech.co.zw). We are responsible for the personal information described here (under the GDPR we are the "controller"). You can reach us at info@vetech.co.zw.

This policy covers the Akari app for iPhone and Android, the Akari App Clip, the guest web app at akari.vetech.co.zw, the live wall, and our emails.

What we collect from guests

When you join an event as a guest, we collect:

• A random device identifier. The app, App Clip or browser makes a random code the first time you use Akari and keeps it on your device, so you stay the same guest when you come back. It is not your phone's advertising ID or serial number.
• Your name, if you give one. You can type a first name. If you don't, you are shown as "Guest" and a number.
• What you add. Photos, videos, text stories and the text you write on photos.
• Information inside your files. Photos and videos can contain hidden details from your camera, such as when and where they were taken. We read the time taken, size and length to sort the gallery. See "Location in your photos" below for what happens to location.
• Your activity in the event. When you joined and last visited, whether you used the app, App Clip or web, which stories you have seen, and any reports you make.
• A notification token, if you ask for one. If you turn on "Tell me when it's ready", we store your device's push notification token so we can tell you when the gallery is ready.
• An account, only if you choose one. In the app, a guest can sign in to keep a list of the events they joined. Signing in works like a host account (see below).

We do not ask guests for an email address, a phone number or an account.

What we collect from hosts and co-hosts

To create or help run an event you need an Akari account. We collect:

• Your sign-in details. You sign in with Apple, Google or a link sent to your email, through Google Firebase Authentication. We store your name (as given by Apple or Google, which you can change), your email address and an account identifier. We never set or store a password. If you use "Hide My Email" with Apple, we only see the relay address.
• Your events. Event name, type, dates, cover photo, settings, co-hosts and invitations.
• Payments. What you bought, the amount, the payment method, status and receipt number. For EcoCash, your EcoCash phone number. For card payments, you type your card details on our payment provider's page; we never see or store them. For purchases in the app through Apple or Google, we receive a record of the purchase from the store, not your card details.
• Notification settings and tokens. Your push notification token and which notifications you have turned off.
• Google Photos access, only if you export to it. If you export an event to Google Photos, Google gives us permission to add photos to your library. We keep that permission encrypted only until the export finishes (or 7 days, if it fails and you may retry), then revoke and delete it.

Information collected automatically

• Network address (IP address). When your device talks to Akari, our servers and Cloudflare, our network provider, see its IP address. We use it for a few minutes, in memory, to stop people guessing event links and to limit abuse. We do not store guests' or hosts' IP addresses in our database or logs.
• Server logs. Our servers log technical details such as the time, the page or action requested and whether it worked. They do not record IP addresses, names, email addresses, tokens or the content of what you upload.
• On your device. Akari keeps your device identifier, your event access keys and the last first name you typed on your device (in the app's secure storage, or in your browser's local storage on the web). Our website does not use cookies.
• Install counts. We count, per event and per day, how many times the "get the app" prompt was shown, tapped and led to an install. These are totals, not linked to you.

We do not use advertising IDs, fingerprinting, analytics tools or crash-reporting tools from other companies.

Permissions on your phone

Akari asks for permissions only when you first need them:

• Camera, to take photos and videos and to scan event QR codes. QR codes are read on your phone.
• Microphone, to record sound with videos. If you say no, videos record without sound.
• Photos, when you choose photos to add, or to save photos to your phone. Only the photos you pick are uploaded.
• Notifications, for the alerts described below.

Akari never asks for your location and does not add location to photos and videos taken in its camera.

How we use your information

We use your information to:

• run events: show the gallery, live wall and stories, and keep you the same guest across visits;
• check content for safety and handle reports (see "Automatic safety checks");
• group photos by face, only when the host turns it on;
• take payments, send receipts and handle refunds;
• send the notifications and emails described below;
• prepare downloads and exports for hosts;
• keep Akari secure, stop abuse and fix problems;
• delete events on schedule and keep the records the law requires.

Our legal bases (where the GDPR or a similar law applies): to provide the service you asked for (our contract with you); our legitimate interests in keeping Akari safe and working, balanced against your rights; your consent, for face grouping (given through the host's choice and the notice you see when you join), push notifications and Google Photos export; and legal obligations, such as accounting records.

Who can see what you add

• Everyone with the event's link can see your name (or guest number) and what you add, and when you added it. Treat an event link like an invitation: anyone who has it can join.
• The host and co-hosts can see everything in the event, and can hide or delete items and remove guests.
• The live wall. If the host uses the live wall, your photos, videos (without sound) and messages may be shown on a screen at the event.
• Downloads and exports. Guests using the app can save single items. The host and co-hosts can download the whole event as a ZIP file, and the host can export it to Google Photos. A copy that a host or guest has downloaded is theirs to keep; we can't delete it.
• A view-only link. The host can share a link that lets people view the gallery until the event expires.
• Our staff. A small number of veTech staff can view events to handle reports, support requests and safety issues. Their access is limited by role and every action is recorded.

Location in your photos

Photos and videos taken with your phone's own camera app may contain the place where they were taken. We remove all hidden details, including location, from every copy shown in the gallery, on the live wall and in stories. We keep your original file unchanged so the host gets full quality, which means the original in the host's download can still contain its location. If you don't want to share where a photo was taken, take it in the Akari camera (which never adds location) or turn off location for your camera before the event.

Automatic safety checks

To keep events safe, every photo, video, text story, written message and guest name is checked automatically before it is shown, using the moderation service of OpenAI. We send OpenAI the display copy of photos (with all hidden details and location removed), up to 30 still frames from videos, and the text. We do not send originals, names of hosts or events, or any link to our storage. OpenAI processes this to give us safety scores and, under its terms for this service, does not use it to train its models. We keep the result (allowed, held for review or blocked, and the reason) with the item, and delete it with the event.

If something is blocked, you see "Couldn't post that". If you receive several blocks in a short time, uploads from your device to that event pause for a while. When a guest reports an item, it is hidden at once until the host reviews it.

Face grouping

Face grouping is an optional feature that sorts an event's photos into groups of the same person, so people can find photos of themselves. Because it uses facial features, we treat it as biometric data and give it extra protection.

• Off unless the host turns it on, for that event only.
• You are told. When it is on, the join screen says that photos in this event are grouped by face.
• How it works. For each photo (not videos), our own face software, running on our own servers, finds faces and turns each into a list of numbers (a "face template"). It also saves a small cut-out of each face. Similar templates are put in one group. No face data is sent to any other company.
• Who sees it. The groups are shown in the Akari app to the event's guests and hosts. The host can name, merge or hide groups.
• Only within the event. Face templates are never compared across events, never used to find out who anyone is, never shared, and never used to train any model.
• Removal. In the app, you can ask for a face group to be removed. It is hidden from guests at once, and the host decides whether to remove it. If it is removed, we delete the faces, cut-outs and name, and keep only one summary template so that new photos of the same person are not grouped again; that is deleted when face grouping is turned off or the event expires. You can also email us.
• Deletion. All face data is deleted when the host turns face grouping off, and when the event expires, even though photos are kept a little longer (see "How long we keep information").

Notifications and emails

• Push notifications are sent through Google Firebase Cloud Messaging (and Apple's push service on iPhone). They tell hosts about items waiting for review, when their memories are ready, export results and expiry reminders, and tell guests who asked when the gallery is ready. Notifications contain no photos. You can turn off the optional ones in the app's settings, or all of them in your phone's settings.
• Emails go only to hosts (and guests with an account), sent through Resend. They are receipts, download links, reminders before an event expires, account deletion confirmations, and notices about refunds or a suspended event. These are service emails, not marketing. When you open one, your email app may load fonts from Google.

Payments

• In the Akari app, purchases are made through Apple's App Store or Google Play. Apple or Google handles the payment under their own terms and privacy policies, and tells us the purchase was made.
• On the web, payments are made through Pesepay, a payment provider in Zimbabwe, by EcoCash or card. We send Pesepay the amount, a payment reference, a description ("Akari event fee"), your email address and, for EcoCash, your phone number. Cards are entered on Pesepay's page; we never see card details.

Moving to the app

If you start in the App Clip or on the web and then install the app, we move your guest identity across so your name and uploads come with you:

• On iPhone, the App Clip leaves the event code and your guest access key in storage shared only with the Akari app on your phone. The app reads it once and deletes it; anything not used is ignored after 30 days.
• On Android, Google Play passes the event code and a single-use hand-over code to the app when it is installed from our link. The code works once and expires after 7 days.

We don't use any third-party linking or attribution service for this.

Companies that help us run Akari

We share personal information only with these service providers, only for the purposes described, and under contracts that require them to protect it:

We do not sell personal information, share it for advertising, or give it to data brokers. We may disclose information if the law requires it, to protect people from harm (for example, reporting child sexual abuse material to the authorities), or as part of a sale or reorganisation of our business, in which case this policy continues to apply.

International transfers

veTech is in Zimbabwe, and our providers process information in other countries, including the United States and countries in the European Union. When information about people in the EU or UK leaves those regions, we rely on safeguards such as the European Commission's standard contractual clauses or the provider's certification under the EU-US Data Privacy Framework. Transfers out of Zimbabwe are made in line with the Cyber and Data Protection Act.

How long we keep information

When a host deletes an event early, or deletes their account, the event and its content are deleted in the same way, without the 30-day hold.

How we protect your information

• All connections are encrypted (HTTPS), and stored data is encrypted.
• Event links use long random codes, and guessing them is rate-limited. A host can reset an event's link at any time.
• Photos and videos are never public. They are delivered through links that work for a short time and for one file only.
• We store only scrambled (hashed) versions of guest access keys and invitation codes.
• Staff access requires an individual account, is limited by role, and is recorded in an audit log that cannot be edited.
• Our logs never contain the content you upload, access keys, email addresses or payment details.

No system is perfectly secure. If a breach puts your information at risk, we will tell you and the authorities as the law requires.

Children

Akari is not meant for children to use without an adult, and host accounts are for adults (18 or older). Children may appear in photos at family events such as weddings and birthdays. Hosts are responsible for telling guests about the gallery and for getting the consent of parents or guardians where children are photographed. Parents or guardians can ask the host or us to remove photos of their child, and we will act on it quickly.

We do not knowingly collect information from children under 16 using Akari on their own. If you believe a child has done so, contact us and we will delete it. Anything that sexualises a child is removed at once and reported to the authorities.

Your rights

Under Zimbabwe's Cyber and Data Protection Act [Chapter 12:07], and for people in the European Union or United Kingdom under the GDPR, you have the right to:

• access the personal information we hold about you and get a copy;
• correct it if it is wrong;
• delete it;
• object to or restrict how we use it;
• take it with you in a common format (portability);
• withdraw consent at any time, for example to notifications or face grouping, without affecting what happened before;
• complain to a data protection authority.

How to use them:

• Delete what you added: open the item in the gallery and delete it.
• Remove your face group: ask for removal from the face group in the app, or email us.
• Delete your account: in the app, go to Account and choose Delete account. This removes your name and email, signs you out everywhere and deletes the events you host. Without the app, see how to delete your account.
• Anything else: email info@vetech.co.zw. Because guests don't have accounts, tell us the event and your guest name or number, and we may ask you to show us it's you (for example, from the device you used). We reply within 30 days.

You can complain to Zimbabwe's Data Protection Authority (POTRAZ) or, in the EU or UK, to your local data protection authority. We'd appreciate the chance to help first.

Changes to this policy

If we change this policy, we will update the date at the top. If a change matters, we will tell hosts by email or in the app before it takes effect.

Contact us

veTech (Private) Limited, Highlands, Harare, Zimbabwe
Email: info@vetech.co.zw
Website: vetech.co.zw