Privacy Policy

Last updated: 12 July 2026

This Privacy Policy explains how ZimChat ("we", "us", "our"), a product of BFSENTAIN Technologies (Pvt) Ltd, collects, uses, stores, and protects your information when you use the ZimChat mobile application. We are committed to protecting your privacy and complying with Zimbabwe's Cyber and Data Protection Act [Chapter 12:07].

1. Information We Collect

• Account information: your phone number, used to verify your identity via one-time password (OTP) sent through our SMS provider.
• Profile information: display name, profile photo, and status message you choose to add.
• Messages and calls: message content is end-to-end encrypted using the Signal Protocol, meaning ZimChat cannot read the content of your personal chats. Metadata such as timestamps and delivery status is processed to make the app function.
• Media: photos, voice notes, and files you send are stored securely using Cloudflare R2 storage.
• Verification information: if you choose to verify your identity for Pro features, business accounts, or elevated limits, we collect the identity documents required for that verification.
• Usage data: basic technical data such as app version, device type, and crash reports, used to fix bugs and improve stability.

2. How We Use Your Information

• To create and secure your account through OTP verification.
• To deliver messages, voice calls, status updates, and channel content.
• To operate our Trust Gate system, which restricts Pro features, admin access, mobile money functions, and elevated limits to verified accounts only.
• To provide customer support and respond to reported issues.
• To maintain the security, stability, and integrity of the platform.

3. End-to-End Encryption

Personal chats and calls in ZimChat are protected using the Signal Protocol, the same encryption standard used by leading secure messaging apps worldwide. This means message content is encrypted on your device and can only be decrypted by the intended recipient. BFSENTAIN Technologies does not have access to the content of your encrypted personal messages.

4. Data Storage and Security

Account and app data is stored using Google Firebase (Cloud Firestore) and Cloudflare R2. We apply access controls and encryption in transit to protect your data. No system can guarantee absolute security, but we take reasonable technical and organizational measures to protect your information from unauthorized access, loss, or misuse.

5. Data Sharing

We do not sell your personal information. We may share limited data with:

• Service providers who help us operate ZimChat, such as our SMS/OTP provider, cloud storage provider, and calling infrastructure provider — solely to deliver the service.
• Law enforcement or regulatory authorities, only where required by Zimbabwean law, and following our internal Law Enforcement Cooperation Policy.

6. Your Rights

You have the right to access, correct, or request deletion of your personal information, subject to legal and technical limitations. You may contact us using the details below to exercise these rights.

7. Children's Privacy

ZimChat is not intended for children under the age of 16. We do not knowingly collect personal information from children under this age.

8. Changes to This Policy

We may update this Privacy Policy from time to time as ZimChat develops and as our regulatory registration progresses. Material changes will be reflected here with an updated date.

9. Contact Us