Mesh Safety — Privacy Notice
Last updated: 6 August 2026 Applies to: the Mesh Safety mobile app, the coordinator console, and the service behind them.
1. Who is responsible for your information
| Responsible party | Jaden Digital Solutions (Pty) Ltd, registration number 2025/626467/07 |
| Address | 2 River, Midros, Middelburg, Eastern Cape, 5900 |
Write to privacy@meshsafety.co.za, which reaches both officers. If you would rather reach one of them directly, or by telephone:
| Information Officer | Isodore Jaden Fitz | +27 72 551 8965 |
| Deputy Information Officer | Xhoba Bukho Mngeni | +27 82 538 4662 |
The Information Officer is registered with the Information Regulator as required by section 55 of POPIA, under registration number 2026-063807, registered on 5 August 2026. You can verify this yourself by searching for Jaden Digital Solutions on the Regulator's eServices portal at eservices.inforegulator.org.za.
2. What we collect, and why
Mesh Safety is a neighbourhood watch tool. It exists so that when somebody presses the panic button, the people near them find out. Almost everything below serves that one purpose.
2.1 When you create an account
| Information | Mandatory? | Why we need it | If you don't provide it |
|---|---|---|---|
| Mobile number | Mandatory | It is your identity here — there is no password. It is also how you receive a sign-in code, and how responders can be reached. | You cannot use the service. |
| First name | Mandatory | Shown to neighbours when you respond to an alert, so they know who is coming. | You cannot complete sign-up. |
| Email address | Voluntary | An alternative channel for a sign-in code. | Nothing — sign-in by SMS still works. |
We deliberately do not ask for a surname, a photograph, an identity number, or a date of birth. The less we hold, the less there is to lose.
2.2 While you are using the app
| Information | Mandatory? | Why we need it |
|---|---|---|
| Your location | Voluntary, but the panic button will not work without it | Two purposes: it is sent with your alert so responders know where to go, and it counts you as coverage for the people around you. |
| Device notification token | Voluntary | So your phone can be woken when a neighbour nearby raises an alert. |
| Community membership | Voluntary | Which neighbourhood watch you belong to, whether your application is pending, and who approved it. |
We keep only your most recent position. No history, no movement trail. Each location update overwrites the previous one. If you delete your account, it is erased outright.
2.3 When you raise or respond to an alert
| Information | Why |
|---|---|
| Alert type, location and time | This is the alert itself. |
| A short description, on emergency alerts only | So responders know what they are coming to — "trapped on the second floor". Not available on crime, suspicious or other reports. |
| Photos you attach, on emergency alerts only | Documentation of an emergency. Entirely voluntary, and not available on crime, suspicious or other reports. |
| A cryptographic checksum (SHA-256) of each file | So a file can later be shown to be the one that was uploaded, and not something substituted afterwards. |
| Your responses to other people's alerts | So the person in trouble can see that somebody is coming. |
2.4 Details of other people that you give us
If you add emergency contacts, you give us another person's name and phone number. We use those details for one thing only: to text them if you raise an alert. We do not market to them, and we do not add them to the service.
We text that person once, when you add them, to tell them you have listed them and how to have their details removed. They did not sign up with us, and finding out only when an alert arrives at two in the morning is not good enough.
You are responsible for having that person's agreement before you enter their details. A contact who wants their details removed can email privacy@meshsafety.co.za, and we remove them — see section 9. We also record the objection, so that adding the same number again does not start the messages over. Nobody should have to object twice.
2.5 Information generated about you
The system calculates a standing score for each member from your own history: how many alerts you have raised, how many turned out to be false alarms, how many times you have turned out for someone else, and how long you have been a member. See section 6 — this is automated, and you have rights in respect of it.
3. Sensitive information
POPIA calls some categories special personal information and restricts them more tightly (sections 26 and 27). Two of them can arise here:
- Health. Raising a
medicalalert reveals something about someone's health — yours, or that of the person you are reporting on. - Alleged criminal conduct. A
crimeorsuspiciousalert, and any evidence attached to it, concerns conduct alleged to be unlawful.
About you. We process special personal information regarding your own health or safety based on your explicit consent, obtained at the exact moment you raise the relevant alert — not from a box ticked when you signed up. You will be asked each time, and you can decline and raise a different kind of alert instead.
About other people. POPIA does not let us process someone else's health information or alleged criminal conduct without their consent, and there is no way to obtain that from an injured stranger or from a suspect.
So the app does not accept it. Reports of crime or suspicious activity carry no description and no photographs at all — only what kind of report it is, where, and when. Descriptions and photos exist solely on emergency alerts (SOS, fire, accident, medical), where they tell responders what they are coming to, and there we ask you to describe what is happening rather than who.
If a description or a photograph does identify somebody, a coordinator of your watch can remove it immediately, and we ask them to.
Report a crime or a suspect to the police. This service is not a substitute for that, and is not designed to hold that kind of record.
4. Children
Mesh Safety is not intended for people under 18. POPIA prohibits processing a child's personal information without the consent of a competent person — normally a parent or guardian (sections 34 and 35).
You must be 18 or older to use Mesh Safety. We do not knowingly create or keep an account for anyone younger. We do not ask your age at sign-up, so we rely on this rule being observed rather than enforcing it technically — but if we learn that an account belongs to a child, we delete it and everything that identifies its holder.
If you believe a child has an account, contact the Information Officer and we will act.
5. Who can see what
This is the section worth reading twice.
Other members near you see that an alert exists, its type, and roughly how far away it is. Ordinary alerts stay inside your watch. An SOS does not — it reaches everyone nearby, whether or not they share a community with you, because someone fifty metres away should not be prevented from helping by an administrative boundary. Notifications do not name the person who raised the alert.
Nobody sees your live position. The map shows coverage in aggregate — how well an area is covered — never individual member locations.
Coordinators of your watch can see its member list — including phone numbers — act on its alerts, and view coverage and risk. This is how a watch is run, and it reaches that watch only. Somebody who coordinates a different neighbourhood watch is an ordinary member here: they cannot see your details, cannot change your alerts, and cannot see your watch's figures.
Two things are worth being precise about:
- Coordinating is per watch, not per account. If you belong to two watches, each one's coordinators see you as a member of their watch. Nobody has a view across all of them.
- Coverage maps are the exception, and are deliberately not restricted to one watch. Any coordinator can look at how well-covered an area is, anywhere. That map is made of counts per square — how many people are around — and never of individual positions or names. It is drawn from everyone present rather than only their own members, because a map that showed a street as empty while another watch was standing on it would send people to cover ground that is already covered.
Your emergency contacts receive a text message when you raise an alert. It names you, states the alert type, and includes your coordinates and a map link.
We do not sell your information, and we do not use it for advertising.
What we do not do
- We do not contact the police, an ambulance, or any emergency service on your behalf. The app shows you their numbers; calling them is your decision.
- We do not track your movements over time.
- We do not share your information with anyone except the operators in section 7.
6. Decisions made automatically
Section 71 of POPIA gives you rights where a decision that affects you significantly is made solely by automated processing that profiles you.
The service calculates, without human involvement:
- a standing score for you, from your own history;
- a credibility and severity score for each alert, from that standing, the plausibility of the location and time, and whether others nearby reported something similar;
- a priority, and a ranked list of recommended responders.
These influence how prominently your alert is presented and who is asked to respond. They never prevent an alert from being sent, and never stop somebody from responding.
Every score is recorded with the individual factors that produced it — the system does not use an opaque model, and there is no step in it that cannot be explained. You have the right to:
- an explanation of the logic behind any score affecting you;
- to make representations about a decision, and have a person review it.
Contact the Information Officer.
7. Who else processes your information
We use these operators. Each processes information only on our instructions.
| Operator | What they handle | Where |
|---|---|---|
| Clickatell | Sign-in codes and emergency-contact alerts — your number and the message text | South Africa |
| Fly.io | Hosting the service and the database — everything in section 2 | Johannesburg (jnb) |
| Tigris | Stored evidence files | Johannesburg (jnb) only — the bucket is pinned to that one region |
| Expo | Push notifications — device token, alert type and distance | United States |
| Vercel | Hosting the coordinator console | United States (Washington DC, iad1) |
| OpenStreetMap Foundation | Map tiles in the coordinator console | United Kingdom |
| Apple, Google | The map inside the app. iPhones draw it with Apple Maps and Android phones with Google Maps, so the part of the map you are looking at reaches them | United States |
The database and the application both run in Johannesburg, so the information in section 2 — your number, your name, your position, your alerts — does not leave South Africa in the ordinary course. The exceptions are the rows above that say otherwise.
We may also disclose information where the law requires it, or to establish, exercise or defend a legal claim.
8. Sending information outside South Africa
Some operators in section 7 process information outside the Republic. Section 72 of POPIA permits this only on specific grounds — broadly, where the receiving country's law gives protection substantially similar to POPIA, or where a binding agreement secures equivalent protection.
Your alerts, your position, your number, your name and your photographs do not leave the Republic. The service and its database run in Johannesburg, and the evidence store is pinned to a single South African region — so a photograph you attach is written there and stays there. Section 72 is not engaged for any of it.
What does leave: the push notification that wakes a neighbour's phone (the device token, the alert type and a distance — never your name or your exact position) is delivered through a service in the United States, and the coordinator console is hosted there. Map tiles are drawn by providers outside the country, which necessarily tells them which part of the map is being looked at.
None of that is special personal information, and none of it is your identity: a push notification carries a device token, a type and a distance, never your name or your exact position.
We rely on section 72(1)(a) for those three transfers — each operator is bound by a written agreement with us that requires them to protect the information to a standard equivalent to POPIA, to process it only on our instructions, and not to disclose it further.
9. How long we keep it
Section 14 of POPIA says information may not be kept longer than the purpose requires.
| What | Kept for |
|---|---|
| Your location | Until the next update replaces it. No history is kept. |
| Sign-in codes | 5 minutes, then discarded. Used codes cannot be reused. |
| Your account | Until you delete it. |
| Emergency contacts | Until you remove them, or delete your account. |
| Anything you typed on an alert | 90 days, then permanently removed from the record. |
| Photos, video and audio | 90 days, then deleted — the files themselves, not just the reference. |
| The alert itself (type, place, time) and responses to it | 90 days, then deleted. |
Ninety days is not an arbitrary choice. It is the point past which the service itself stops reading an incident: coverage and risk are calculated from the last 90 days, and nothing in the system looks further back. Beyond that, an alert serves no purpose we have — so it goes.
We previously kept the bare record of what happened where for a year. We stopped, because we could not name a purpose that needed it: nothing in the software reads that far back, and POPIA does not allow keeping information for a reason you cannot state.
When you delete your account
Everything that identifies you is erased: your phone number, email, name, your live position, your emergency contacts, and any photos, video or audio you uploaded — the files themselves, not merely the reference to them.
Evidence that other people attached to your alerts stays. It is their contribution, not yours.
The incident record remains, with your name removed and its location blurred. We keep it because deleting an alert would also delete the responses other people made to it — someone who turned out at two in the morning would lose that from their own record because a different person left.
Removing the name alone was not enough. An exact coordinate and a timestamp can point at a particular house, so the record would still have been about you. On deletion we therefore also coarsen the coordinates of your alerts to roughly a 110-metre square — enough to show the watch that something happened on that block at that hour, not enough to say which door.
Delete your account from Profile → Delete account, or ask the Information Officer. If you no longer have the app — you uninstalled it, lost the phone, or cannot sign in — the same request can be made at mesh-safety.vercel.app/delete-account. Losing the handset must not mean losing the right.
10. How we protect it
- Sign-in is by one-time code. There are no passwords to steal or reuse.
- Sessions expire, and are checked against the account on every request — a deleted account cannot keep acting.
- Evidence files are stored privately. Links are generated on demand and expire after 15 minutes.
- Location and phone numbers are never written to application logs; phone numbers appear redacted.
- Traffic is encrypted in transit.
- Coordinator functions are restricted to members holding that role.
No system is perfectly secure. If a security compromise occurs, section 22 of POPIA requires us to notify the Information Regulator and you as soon as reasonably possible, describing what happened, what we are doing about it, and what you can do to protect yourself.
11. Your rights
Under POPIA you may:
- ask what we hold about you and receive a copy (section 23);
- correct or delete information that is inaccurate, irrelevant, excessive, out of date, misleading or unlawfully obtained (section 24);
- object to processing on reasonable grounds (section 11(3));
- withdraw consent where we relied on it;
- not be subject to a solely automated decision, and to make representations about one (section 71 — see section 6 above);
- complain to the Information Regulator.
Most of these you can do in the app. For anything else, write to privacy@meshsafety.co.za. We will respond within 14 days.
If we need longer — because a request is complex, or because answering it would reveal something about another person that we have to consider first — we will tell you inside those 14 days, say why, and give you a date.
12. Complaints to the Regulator
If you are unhappy with how we have handled your information you may complain directly to:
Information Regulator (South Africa) Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 P.O. Box 31533, Braamfontein, Johannesburg, 2017 Telephone: 010 023 5200 · Toll free: 0800 017 160 Enquiries: enquiries@inforegulator.org.za POPIA complaints: POPIAComplaints@inforegulator.org.za Website: inforegulator.org.za You can also complain through the Regulator's eServices portal at eservices.inforegulator.org.za
You do not have to raise it with us first.
13. Changes
If we change this notice we will post the new version here and update the date above. Where a change materially affects you, we will tell you in the app.
Drafted with reference to POPIA sections 5, 11, 13, 14, 18, 19, 22, 23, 24, 26, 27, 34, 35, 55, 57, 71 and 72.