← Back to Briefs

Privacy Policy

Last updated: 11 October 2026

This explains what personal information Briefs collects, why, who it's shared with, and the rights you have over it. Briefs is based in South Africa, so it follows the Protection of Personal Information Act (POPIA).

1. Who is responsible for your data

Briefs is run by Mulisa Maphaha, an individual developer in South Africa, who is the "responsible party" and Information Officer for Briefs under POPIA. Contact: info@zareg.co.za.

2. What we collect

  • When you sign up: username, email, password (or your Google account), and date of birth (to check you're old enough). Optionally: display name, phone number, country and gender. If you're 13–17, we also record that you confirmed a parent or guardian agrees.
  • Profile details you choose to add: photo, cover, bio, work, education, relationship status, hometown, location, business details and links.
  • Content: posts, comments, messages, stories, photos, videos, stickers and marketplace listings you create.
  • Activity: friends, follows, blocks, likes and reactions, saved posts and listings, who viewed your stories, notifications, and reports you make or that are made about your content.
  • Live video: if you go live, your camera and microphone are used only while you are live, and we keep a record that the live happened (who, the title you gave it, when it started and ended, and the most people watching). The video itself is not recorded or stored by us. Live chat messages are not saved.
  • Active status: while the app is open, other people can see a green dot next to your name. You can turn this off in Settings, on that device.
  • Notifications: if you turn on push notifications, the push address your browser gives us.
  • Payments: if you've paid for a post boost, the amount and whether it succeeded. PayFast handles the payment itself — we never see your card or bank details.
  • Technical: our hosting provider's request logs (which include IP addresses), and the bot check at signup.
  • Security log: to spot attacks and bugs we keep a log of events such as failed sign-ins, changes to an account's security settings, and app errors, with the IP address and browser type they came from. Security events are deleted after 90 days and app error reports after 30.

We only ask for what the app needs. Phone number, country and gender are optional and you can remove them anytime in Settings.

3. How we use it

To run the app: create and secure your account, check your age, show your feed, deliver messages and notifications, let people find and friend you, keep the app safe (spam and bot checks, handling reports), and process any payment you make. We don't sell your data, share it with advertisers, or use it for advertising tracking.

3a. Live video

Going live is for people 18 and over; anyone can watch. Anyone can open a live, be counted as a viewer, and chat without joining. The video is passed from phone to phone: the host's phone sends it to a few people, and viewers on Wi-Fi may pass it on to others watching (you can turn this off in Settings, under "Help others watch lives"). Everyone in that chain can see the IP address of the phones next to them. People the host accepts to join (up to 8 at a time) sit closest to the host. Our servers do not receive or store the video. Anything you say or show on a live can be seen, recorded or shared by viewers, so only share what you are happy for them to keep. You can report a live video from inside it, and we can end a live video or suspend an account that breaks our rules.

4. Automatic account suspension

To protect people from abuse, an account is automatically suspended when more than 5 different people report it. Suspended accounts and their content are hidden, not deleted. If you think your account was suspended unfairly, email us and a person will review it.

5. Who else processes it

  • Other users see what your settings allow — public posts are public, "friends" posts go to your accepted friends, "only me" posts aren't shown to anyone else, and a private profile hides your posts from non-friends.
  • Supabase — database, sign-in and file storage.
  • Vercel — hosts the app and its server.
  • Google — sign-in if you choose "Continue with Google" (we receive your name, email and profile photo),
  • KLIPY — serves the GIFs and stickers you search for in the picker. When you open the picker, KLIPY receives your IP address, your browser type, your screen size and language, what you search for, and an anonymous code made from your account by one-way scrambling, so it does not show who you are. It never receives your name or email. KLIPY also shows advertisements in the picker, to people aged 18 and over only (see section 5a).
  • Cloudflare Turnstile — checks you're not a bot when you sign up; it receives your IP address and browser signals.
  • Resend — sends our emails (verification codes and password resets).
  • Mux — streams some older videos.
  • Your browser's push service (for example Google or Apple) — delivers push notifications if you turn them on.
  • PayFast — processes payments; they receive the billing details you give them directly.
  • Law enforcement and government authorities, if required by a valid subpoena, court order or other legal process, or if we believe in good faith it's necessary to comply with the law or protect someone's safety.

Some of these providers store or process data on servers outside South Africa. We only use providers that protect personal information to a standard comparable to POPIA.

5a. Advertising

Some people see an advertisement between the GIFs in the GIF and sticker picker. Ads are supplied by KLIPY and its advertising partners, and they pay us when ads are shown. Ads are shown only to people who are 18 or over, and never to anyone under 18 or whose age we do not know. We do not give advertisers your name, email, posts or messages. To choose an ad that fits your screen, KLIPY gets the information listed in section 5. The ad itself runs in a sealed frame that cannot see the rest of Briefs, but the advertiser can see your IP address and may set its own cookies or identifiers inside that frame. If you do not want ads, do not open the GIF picker. Tell us at the address in section 12 if you have a question about an ad or want to report one.

6. Cookies and local storage

Briefs itself doesn't use advertising or analytics cookies, and doesn't track you across other sites. The one exception is the advertisement in the GIF picker described in section 5a, which comes from KLIPY and its partners and may use its own cookies or identifiers inside its sealed frame. The app keeps a few things in your device's local storage so it works properly: your sign-in session, a copy of your profile for faster loading, your light/dark theme, whether you've seen the install prompt, and an invite code if you arrived through a friend's link. These are strictly necessary, so there's no cookie banner. Clearing the app's site data removes them.

7. How long we keep it

We keep your information while your account exists. Stories disappear after 24 hours. When you delete your account in Settings, your account, content and media are deleted straight away, apart from copies that may stay in our providers' backups for a short period before they're overwritten. Messages you sent stay in the other person's chat so their conversation isn't broken, but are no longer linked to your account.

8. Your rights

Under POPIA you can ask to see the personal information we hold about you, have it corrected or deleted, and object to how it's used. You can edit or remove most of it yourself in Settings, and delete your account there at any time. For anything else, email us. If you're unhappy with how we handle your data, you can complain to South Africa's Information Regulator.

How to delete your account

In the app, go to Profile → Settings → Delete account and confirm. Your account, posts, comments, stories, listings and media are deleted immediately. If you can't sign in, email info@zareg.co.za from the address on your account with the subject "Delete my Briefs account", and we'll delete it within 7 days. See "How long we keep it" above for what happens to messages and backups.

9. Security

We never store your password ourselves — sign-in is handled by Supabase Auth. Database access is restricted with row-level security so only the right people (and our server) can read your data. Messages are stored on our servers and are not end-to-end encrypted. No system is perfectly secure, so we can't guarantee absolute protection, but we take reasonable steps to protect your information.

10. Children

You must be at least 13 to use Briefs. Under POPIA, anyone under 18 is a child, so 13–17 year olds can only sign up if a parent or guardian agrees, which they confirm at sign-up. If we learn that a child under 13 has an account, or that a 13–17 year old signed up without a parent's agreement, we'll delete the account. Parents or guardians can email us to review or delete their child's account.

11. Changes

If this policy changes materially, we'll let you know in the app.

12. Contact

Questions or requests about your data? Email info@zareg.co.za.

Read our Terms of Service →  ·  Open-source licences →