Privacy policy

Last updated 4 October 2026

This policy explains what the newFrequency app and this website collect, why they use it, who receives it, how long it is kept, and how you can exercise your rights.

New Frequency is based in South Africa. We handle personal information in line with the Protection of Personal Information Act (POPIA) and applicable app-store privacy requirements.

Who is responsible

New Frequency is responsible for the app and this website. Contact us about privacy, access, correction or deletion through the contact form on this site.

The app and website

The public feedback, invite-request and contact forms use the shared app database. When available, the Business and contribution workspaces use your existing newFrequency account and the app’s Supabase authentication and database. This does not create a second user identity.

If Mission campaigns are available, a form can include campaign details, media, reward split and schedule, plus legal and trading names, registration number, business type and industry, business contact information and representative name and role for verification. The database also records verification status, the submitted Mission terms version, declarations and campaign review state.

Project contributions record your account ID, chosen project and amount, payment reference, verified payment status, receipt and any refund request or outcome. Paystack processes payment details on its hosted checkout; this website does not collect your card number. The team can review contribution and refund records to operate the service and resolve disputes. Public project totals do not identify contributors.

An optional investment conversation records your name, organization, contact preference, proposed amount, introduction, consent and review history. Only your account and authorized reviewers can access it. If you separately opt in to company updates, we record your account, consent version and time. You can withdraw that preference in your conversation workspace.

Information collected by the app

Account and profile

Email address, password-related authentication data held by Supabase Auth, your name, profile picture, bio, phone number where supplied, account timestamps and account status. This is used to create and secure your account, show your profile and provide account support.

Your activity and content

Posts (Reels, Snaps, Tunes and Chat posts), captions, audio and music metadata, thumbnails, likes, follows, saves, shares, views, comments and replies. We use this to publish and operate the feed, search and creator features. Public profiles, posts, comments, likes, follows and some gift activity may be visible to other users according to the app’s settings and access rules.

Search and messages

Search terms used to find users or content, direct-message conversations and messages, message replies/reactions and related timestamps or participant IDs. We use these to return results, deliver messages and keep conversations working.

Wallet, coins and transactions

ZAR earnings balances, coin balances, gifts, tips or legacy tip records, eligible paid-scroll activity, marketplace orders for goods and services, fees, payment references and transaction timestamps. These records operate the ledger, show your history, pay creators and investigate disputes or refunds. ZAR balances are for earnings; users cannot top them up with a deposit.

Payment and payout details

ZAR wallet withdrawals are currently disabled. If payout processing is enabled, the service may receive the bank account number, bank code and optional account name needed to make a payout, and store the payout status and provider references. New Frequency’s app code does not collect or store your card number, CVV or online-banking password. Paystack processes payment details on its own payment pages and may retain them under its own policy. When Mission checkout is enabled, the app calculates the campaign total, starts a hosted Paystack transaction and stores the Mission, amount in minor currency units, provider reference, status and verification timestamps needed for the funding ledger. The app does not receive or store your full card number, CVV or online-banking password. The Mission is credited only after server-side Paystack verification.

Creator and seller verification

If marketplace selling is available, sellers can submit an ID document, a face/document photograph, and a bank statement or certificate. These files and the review status are used for identity, seller and payout checks. If brand or business Mission features are available, they can also contain business profile, authorisation, verification documents, campaign information, declarations, reward and usage-rights information.

Missions and brand interactions

If a Mission campaign is available, its records may contain a brand, brief, requirements, eligibility, campaign media, deadline, prize pool, reward split, usage rights and submission status. A creator’s selected post can be linked to a mission submission; review decisions and reward records are kept to run the campaign and pay approved rewards.

Reports and safety records

Reports about posts or comments, selected report reasons, optional notes, moderation status, hidden/restored content, suspensions or related review and appeal information. Moderators use these records to enforce rules, investigate abuse, protect users and keep an audit trail of safety decisions.

Camera, microphone, photos and uploads

The app asks for camera access when you choose to take a Reel, Snap or other camera content. It asks for microphone access when you choose to record sound or a Reel. It asks for photo/media access when you choose existing photos or videos. It can also use the document picker for audio files, PDFs and other creator or seller documents. These permissions are optional, but the related capture or upload feature will not work if you deny them.

Selected media is uploaded only when you publish or submit it. Photos, audio, covers, thumbnails and ordinary post media are stored in Supabase Storage. Video may be uploaded to Cloudflare Stream when that service is configured; otherwise it uses Supabase Storage. Seller and identity documents use a private storage area, not the public post-media bucket.

Notifications, device and diagnostic data

If you grant notification permission, the app registers an Expo push identifier, platform and the device name supplied by the operating system against your account. The identifier is used to deliver activity such as likes, messages and purchases; it is removed when you sign out where the service can do so. Notification records also appear in the app’s activity inbox.

The app stores a small local diagnostic log in AsyncStorage: time, error context, error message and a short JavaScript stack. It is used to help diagnose failures and can be cleared through the app’s diagnostics controls. The app does not currently include a separate crash-reporting or analytics SDK in its shipped dependency graph.

Advertising and coin purchases

The Android app uses the Google Mobile Ads SDK (AdMob) to show native ads in the feed and may also show interstitial ads when that placement is configured. The app requests non-personalized ads. Google’s SDK automatically collects and shares the device’s IP address (which may be used to estimate general location), product interactions, diagnostic information, and device or account identifiers for advertising, analytics, and fraud prevention. Google processes this information to provide its advertising service. SeeGoogle’s Privacy Policy.

Where consent is required, Google’s User Messaging Platform (UMP) collects and stores your advertising privacy choices before the app requests ads. You can review or change available choices in the app under Account → Advertising privacy options. Whether an ad is shown also depends on your choices, device settings, and ad availability.

Where coin purchases are available, Android uses Google Play Billing and iOS uses Apple In-App Purchase. Google and Apple process the payment credentials and store payment records under their own terms. New Frequency does not receive your full card number, CVV, bank password or Apple/Google account password from these purchases. New Frequency receives and stores the selected store, product ID, purchase identifier, the account linked to the purchase, transaction and verification status, refund or reversal status, timestamps and the store response or verification data, and the coin-credit record needed to prevent duplicate crediting and to reconcile the coin balance. New Frequency verifies the purchase with the relevant store before crediting coins, and may reverse or record a coin adjustment when the store reports a refund. Coins are for in-app spending and cannot be withdrawn. The ZAR wallet is for creator earnings; deposits are not available and withdrawals are currently disabled.

Website information

The feedback form can send your answers, rating, whether you would keep using the app, optional device description and optional email, plus submission time and referring page. The contact form sends your email, topic, message, submission time and referring page. An iOS invite request sends your email, platform, submission time and referring page. The forms also use local browser storage for a short submission cooldown and a hidden anti-bot field.

This website’s code contains no analytics SDK, advertising tracker or third-party cookie integration. Your browser, hosting provider or security infrastructure may still create ordinary technical logs; those are controlled by the relevant hosting provider rather than by the form code.

Service providers and international processing

Supabase: authentication, database, Row Level Security, Edge Functions and file storage for the app. The Business workspace uses the same app account and database when configured. Website feedback forms use the endpoint configured by the site operator.
Paystack: Mission checkout where enabled, payment verification and payout processing where available.
Cloudflare Stream: video upload, encoding, playback, thumbnails and downloads when enabled for the project.
Expo services: the app uses Expo/EAS update and push-registration infrastructure. Push delivery can involve the platform notification services required by Android or iOS.
Google Mobile Ads (AdMob): delivers and measures Android in-app ads. Its SDK may process the information and purposes described in the advertising section above.
Google Play and Apple: process coin purchases where available. New Frequency sends the product and purchase identifier to the relevant store for verification and receives the verification result and store transaction information needed to credit or reverse coins.

These providers may process information outside South Africa. We use them only for the functions described here, apply contractual or technical safeguards where available, and require appropriate security for information entrusted to them.

How long information is kept

We keep account, content, messaging, wallet, safety and mission information while needed to provide the service and resolve disputes. Website enquiries and feedback are kept while they are being handled and for a reasonable follow-up period. Payment, payout, tax, ledger, fraud, moderation and audit records may be retained for as long as needed for legal, accounting, security or dispute purposes.

You can request account deletion in the app. The request starts a 14-day period during which you can sign in and cancel it. After that, the service deletes account content, messages, posts, comments, reports, notifications, push identifiers and ordinary media where the system can identify it, and anonymises the profile before deleting the authentication account. Transaction and coin ledger rows may be retained and de-identified because they reconcile another person’s wallet and may be needed for accounting or disputes. Store purchase records, coin-credit and refund records may likewise be retained for fraud prevention, refunds, accounting and reconciliation. Private KYC documents and their audit record may also be retained where required for seller, payment, fraud or legal obligations. Media deletion can depend on the relevant storage or video provider completing its job.

Security

The app uses authenticated Supabase requests, database access rules, private storage for KYC files, signed temporary document links and server-side verification for payment and payout operations. Network connections use HTTPS where provided by the service. No online system is completely secure, so keep your password private and tell us about suspected account or safety problems promptly.

Children

If you are a child or minor, use New Frequency only where you are legally permitted to do so and where any parent, guardian or other consent required by POPIA or applicable law has been obtained. We do not use this policy to impose a separate fixed 18+ rule. A parent or guardian who believes a child has provided personal information may contact us so we can investigate and remove it where appropriate.

Your POPIA rights

Subject to lawful limits, you may ask us to:

confirm whether we hold personal information about you and give access to it;
correct or update inaccurate information;
object to processing or ask us to stop or restrict it where POPIA permits;
ask for deletion, subject to records we must retain;
ask about the source, purpose and recipients of your information; and
complain to the Information Regulator of South Africa.

Send a request through the contact form on this site. We may need enough information to verify that you are the account holder. We will respond within the period required by applicable law and explain any lawful reason we cannot complete a request.

You can contact the Information Regulator at inforegulator.org.za.

Changes

We will update the date above when this policy changes. If a change materially affects how the app uses personal information, we will use an appropriate in-app or website notice where practical.