What Watchit knows about you, and what it does with it.

This is the paperwork behind the promises on the front page. It is written to be read, not skimmed past. Last updated 22 August 2026.

Draft. Items marked [TO CONFIRM] need a fact only Eval Geniuses can supply before this page is published.

Who we are

Watchit is operated by Eval Geniuses [TO CONFIRM: registered entity name and registration number], a company in Cape Town, South Africa. For anything in this policy, write to [TO CONFIRM: privacy contact email] or use the contact form.

The short version

Incident reports are public. That is the point of Watchit: everyone can see what everyone has reported — the last week without an account, six months with a free one.
Reports carry no names and are shown to the nearest block, never the door.
We do not track you, do not advertise, and will never sell your information to anyone.

What we collect, and why

When you report an incident

What happened — the type of incident, an optional description, optional photos, and when it happened. This is public.
Where it happened — the location you give. Before it is shown to anyone, it is moved to the centre of a block roughly 100 metres across, so the map never points at a particular house. The exact location you gave is kept, but never shown — not on the map, not in the app, not to neighbourhood watches, security companies or government customers. It exists for three reasons: so we can redraw the public map if we change how coarse it is; so your report can be counted in the right suburb and ward; and to answer a lawful order from a court or authority, which we would comply with as the law requires.
Two scrambled keys, and nothing else about you. Every report carries a hash of two secrets that only your device holds: one that lets you find, correct and delete your own reports, and one that tells us when the same device reports again, so that nobody can flood Watchit. Neither can be turned back into anything, and no account is recorded on a report — not even when you are signed in. Signed in, your key is made from your password on your device, so the same password on a new phone finds the same reports; we never see the password. A report made while signed in is marked as such, because it counts for more, but not as whom.
Your internet address is used only to slow down abuse when a device sends no key, counted for an hour and then forgotten. It is never kept with a report.

When you create an account

Your email address, name, and a scrambled version of your password (we cannot see the password itself).
Your role — citizen, responder, analyst or admin — and, for responders, the areas an administrator has assigned you to.
The areas you choose to follow. These hint at where you live, so they are shown only to you: not to administrators, not to anyone else, and they are never aggregated or sold. If investigators ask about incidents in an area you follow, we may email you to say so — only that, with a link to stop.
A default area for the dashboard to open on, if you set one.

When you use the app

Your phone's location is used on the phone to show you the map around you. It is never stored by us unless you attach it to a report, and you can place a report by pointing at the map instead, with no location at all. Location is only ever used while the app is open — never in the background.
The map asks us for reports in the area you are looking at. That tells us roughly where you are looking, and nothing else.
Who to call finds the numbers for one spot — where you are, or the middle of the map. That spot is sent to us once, to look up the numbers that cover it, and is not stored or logged.
No tracking. The app uses no advertising identifier, no analytics that follow you between apps, and asks for no permission it does not need. Photos are taken or chosen only when you tap to attach one, and the app never reads your photo library on its own.

When you post a notice

A notice says that something ordinary is happening — a party, building work, a removal truck — so that it does not read as suspicious to anyone who cannot see the street. We keep what kind of activity it is and where, moved to the centre of a ~100 m block like a report, and nothing at all about you: no name, no account, no device. Anyone may post one about anywhere, and nobody is told who did.
There is no description box and no photograph — the list of kinds is the whole notice. That is deliberate: it is what keeps opinions about people out of it.
A notice ends by itself: a party after a day, ongoing work a few days after the last time someone said it was still happening. A responder or administrator can end one sooner, and can publish one with its own times, which emails the people who follow that area.

When you answer a call for comment

Investigators working a case can ask a neighbourhood about incidents in it. If one of your reports is among those they ask about, it is marked on your own list of reports, and nowhere else. Nobody else can see which reports they asked about. If you ignore it, nothing is recorded.
If you choose to answer, we keep the name, the way to reach you and the message you give. They are kept with the case — never with a report, and never with the keys your reports carry — so an answer does not say which report, if any, is yours.
You can withdraw an answer from the phone or browser you sent it from. We then erase your name, way to reach you and message, and keep only that an answer arrived and was withdrawn. We cannot undo anything investigators already did with it.

If you are listed in the directory of who to call

The directory lists offices and services — a councillor's office, a clinic, a place of worship — and, where it helps, the name of whoever holds the role now. Anyone can see it: it is there for people who need help.
A private person's own number is listed only with their consent. The responder or administrator who asked records how and when you agreed, so the listing can be shown to have been made properly. That record is never shown to anyone.
To come off it, tell the responder who listed you, or write to us. Removing an entry erases your name and contact details at once; we keep only that you had agreed, and when.

When you visit this website

This site sets no cookies and runs no analytics. The map on the front page is drawn by Google Maps, which means your browser fetches it from Google; Google's own privacy policy applies to that request. Nothing else on the site contacts anyone but us.

When you write to us

The contact form keeps your name, email and message so we can reply, together with a scrambled version of your internet address used only to stop automated spam.

Who can see what

Anyone: Every incident report from the last seven days: what happened, the description and photos, when, and the location to the nearest block. Any single report can be looked up at any age. This is the open record. Anyone can also see an open call for comment — what investigators are asking, and where and when, never which reports — any notice that is currently running, and the directory of who to call.
Residents with a free account: The same, looking back six months.
Neighbourhood watches and responders: The same public record, organised around the areas they cover — and, on the cases they work, the answers people choose to send to their calls for comment. Nothing more.
Administrators: Accounts — names, emails, roles — so they can help people who are stuck, and the answers sent to calls for comment on cases. They cannot see who reported what — nothing we store would let them — nor the exact location of any report, nor the areas you follow.
The law: We will disclose information, including an exact report location, when a court or authority lawfully requires it, and only then.

How long we keep things

[TO CONFIRM] Retention periods are a policy decision still to be made. The wording below describes what the system does today.

Incident reports stay in the public record. A report can be corrected by the person who made it for an hour after it was submitted.
Accounts are kept until you ask us to delete them. A deleted account cannot sign in and is hidden everywhere; it is removed for good after a second confirmation.
Contact messages are kept so we can follow up on them.
Answers to calls for comment are kept with their case until you withdraw them or the case is deleted for good.
Notices stop being shown when they end. They hold nothing about anyone, so there is nothing in one to delete on request.
Directory entries are shown until they are removed. A private person's details are erased the moment their entry is removed.

Your rights under POPIA

The Protection of Personal Information Act gives you rights over information about you. With Watchit you can:

See what we hold about you — ask us and we will tell you.
Correct it — your own reports for an hour after submitting them, your account details at any time, and anything else by asking.
Delete a report you made yourself, at any time, from the app or the dashboard — it leaves every map and list at once. To delete your account, write to us.
Object to how we use your information, and complain to the Information Regulator if you are not satisfied with our answer.

Information Officer: [TO CONFIRM: name, email and postal address of the registered Information Officer]
Information Regulator: Information Regulator (South Africa), inforegulator.org.za
PAIA manual: [TO CONFIRM: link to the Promotion of Access to Information Act manual]

Where your information lives

Watchit runs on Amazon Web Services in Cape Town, South Africa. Report photos and the database are stored there. [TO CONFIRM: the database is currently hosted by MongoDB Atlas — confirm its region, and whether any data leaves South Africa.]

Children

Watchit is not aimed at children. Anyone can see the public map, but you must be 18 or older to create an account. [TO CONFIRM]

Changes to this policy

If we change what we collect or what we do with it, we will update this page and say what changed at the top. We will not quietly widen anything the front page promises.