What we do with your data, in plain terms.

The law we build to

Tanzania's Personal Data Protection Act, 2022 and the Data Protection (Collection and Processing of Personal Data) Regulations, GN No. 349 of 2023. Each product publishes its own privacy policy setting out what is collected, the lawful basis for each use, how long it is kept, whether it leaves the country, and the rights the Act grants.

How we protect accounts

• Passwords are never stored. Only a one-way hash. We could not tell you a user's password if we wanted to.
• Sessions can be revoked. Changing a password immediately invalidates every session opened before it — so a password change genuinely removes an intruder.
• Everything is rate limited. Sign-in, registration and password reset all throttle, so an attacker cannot grind away at them.
• All traffic is encrypted in transit, and our email is authenticated so it cannot easily be spoofed.

How we check our own work

Code is put through adversarial security review — deliberately trying to break it rather than confirming it works. The most recent review of SokoVerse, on 2 August 2026, found eleven issues. All were fixed and verified against the live system the same day.

We mention the number because a vendor who has never found anything is a vendor who has never looked.

What we have not done yet

Being straight about this is the point of the page.

• We have not yet had an independent penetration test by an external firm.
• We do not yet carry professional indemnity or cyber insurance.
• Registration with the Personal Data Protection Commission is in progress.
• Our products are operated by a small team, and we will tell you honestly what that means for continuity if you ask.

Reporting a problem

If you believe you have found a security issue in any jApps product, please write to security@japps.co.tz. Tell us what you found and how to reproduce it. We will acknowledge it, and we will not take action against anyone who reports something in good faith.