Privacy Policy

Ranga, Kigali, Rwanda (“Ranga”, “we”) is the data controller for personal data processed through the Ranga Platform. We process personal data in line with Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy. Contact us about anything in this policy at support.ranga@gmail.com.

• Account: name, email address, password (stored hashed by our authentication provider), profile photo, district and sector you choose to add.
• Google sign-in: if you continue with Google, we receive your name, email address and profile photo from Google. We do not receive your Google password or contacts.
• Mobile Money number: used to pay rewards and shown to the other party only after a verified recovery.
• Reports: item category, description, place and date, photos, and for documents the name printed on the document.
• Document numbers: never stored in readable form. We keep only a one-way fingerprint (SHA-256 hash) to compare numbers, and the last four characters of a number you report as lost, shown only to you.
• Verification: the private question a Finder sets and its answer, stored separately and never shown to claimants. For claimants, we record which questions were answered and the result, never the answer itself.
• Payments: amounts, invoice numbers, status and MTN Mobile Money references. We never see your MoMo PIN. Payment records are kept as proof of each transaction; Recovery Fees are final and non-refundable, as set out in our Terms.
• Messages you exchange with another user after contact is unlocked, and ratings you give or receive.
• Technical data: sign-in sessions, device and browser type, IP address in server logs, and actions you take, for security and fraud prevention.

• To provide the service (performance of our contract with you): publishing reports, matching lost and found items, verifying ownership, processing payments and rewards, messaging and notifications.
• To keep the Platform safe (legitimate interests and legal obligations): preventing fraud and false claims, limiting verification attempts, resolving disputes, and keeping records.
• To meet legal obligations: accounting and tax records, and lawful requests from authorities.
• With your consent: optional notifications, which you can switch off in Settings.

We do not sell personal data and we do not use it for third-party advertising.

Ranga uses automated tools to read document photos and blur sensitive areas, to suggest matches between lost and found reports, and to check verification answers. Matches are suggestions; a person always decides whether to claim. If an automated check affects you, for example a failed verification, you can ask for a human review at support.ranga@gmail.com.

• Other users: public listings show the item, place, date, photos with sensitive areas blurred, the name on a found document, and the reporter’s display name. Your phone number and email are shared with the other party only after ownership is verified and the Recovery Fee is paid.
• MTN Mobile Money, to process payments and payouts.
• Service providers that host and run the Platform for us under contract, such as our database, authentication and file-storage provider (Supabase), our web hosting provider, and Google for sign-in.
• Authorities such as the Rwanda National Police and Rwanda Investigation Bureau, when required by law or to prevent fraud or harm, as described in our Terms.
• A successor if Ranga’s business is transferred, under the same protections.

Some of our service providers store data on servers outside Rwanda. Where this happens, we rely on the safeguards and authorisations required by Rwandan data protection law, including contractual protections, encryption in transit, and access controls.

• Account and report data: while your account is open, and up to 2 years after closure to handle disputes and fraud.
• Payment and payout records: for the period required by Rwandan tax and accounting law.
• Verification and audit records: as long as needed to resolve disputes and meet legal obligations, then deleted or anonymised.
• Records we are asked to preserve by a court or authority are kept until that request ends.

We use encrypted connections, access controls, private storage for original photos, one-way hashing for document numbers, a separate locked store for verification answers, limits on verification attempts, and an audit log of administrative actions. No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify the supervisory authority and you as required by law.

Under Rwandan law you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have data deleted, unless we must keep it by law or for an ongoing dispute;
• object to or restrict certain processing, and withdraw consent at any time;
• ask for your data in a portable format;
• complain to the National Cyber Security Authority (NCSA), which supervises data protection in Rwanda.

Most of this can be done from your profile and settings. For anything else, email support.ranga@gmail.com. We reply within 30 days.

Ranga is for people aged 18 and over. Younger people may use it only with a parent or guardian who accepts our Terms for them. If you believe a child has given us data without this, contact us and we will delete it.

We only use what the Platform needs to work. We do not use advertising or cross-site tracking cookies.

• Sign-in cookies keep you signed in securely. They are strictly necessary.
• Local storage in your browser remembers your light or dark theme and your recent searches. You can clear it in your browser at any time.

We will post any update here with a new date and version, and tell you in advance by email or in the app when a change is significant.