1. Who this policy covers
This Privacy Policy explains how KwayaPro collects, uses, shares, and protects personal data when you use the KwayaPro mobile application and any related services (together, the “Service”). KwayaPro is operated by Simon Peter Kyagulanyi, an individual developer based in Nansana, Uganda.
KwayaPro is a choir management platform for church choirs, primarily in Uganda and East Africa. It helps choirs manage membership, rehearsal scheduling, attendance, learning-track audio, song programs, choir chat, and (for choirs on the Pro plan) subscription billing via MTN Mobile Money.
This policy applies to:
- Choir Leaders, Directors, and Choristers who create accounts and use the Service.
- Guest Directors — individuals granted temporary, session-scoped access via an invite link, without a full ongoing membership.
- Anyone whose personal data a choir member enters into the Service on their behalf (see §3.5).
KwayaPro's user base today is Uganda only. If that changes, this policy will be updated accordingly.
2. Our role: data controller
For the personal data described in this policy, Simon Peter Kyagulanyi is the data controller — deciding what data is collected and why. Where third-party service providers (§6) process data on our behalf (Firebase/Google Cloud, MTN Mobile Money), those providers act as our data processors for that specific data.
No separate Data Protection Officer is currently appointed — as an individual developer operation, privacy inquiries are handled directly by Simon Peter Kyagulanyi at the email address above.
3. Information we collect
We collect the following categories of personal data. Each is tied to a specific feature — we do not collect data we don't have a concrete product reason to use.
3.1 Account and identity data
- Phone number — required for phone-based sign-in (OTP) and for MTN Mobile Money payment initiation.
- Name — the display name shown to other choir members.
- Email address — if you sign in via email/password or Google Sign-In instead of phone.
- Profile photo — optional, if you choose to upload one.
- Authentication identifiers — managed by Firebase Authentication (see §6.1); we do not see or store your password in plain text.
3.2 Choir membership data
- Which choir(s) you belong to, your role (Leader, Director, or Chorister), your voice part (Soprano/Alto/Tenor/Bass), and any granular permissions granted to you within a choir (e.g., being able to upload audio or manage the song program independent of your role).
- If you're granted temporary Director access for a single rehearsal (a "guest director" invite), the scope and expiry of that access.
3.3 Voice recordings (sensitive)
- Learning-track audio: voice-part recordings uploaded by a choir's Directors/Leaders/authorized choristers, used to teach other members their part for a song. These are audible recordings of a real person's singing voice.
- Studio recordings: audio you record directly in the app's practice studio and choose to upload as a learning track for others.
A recording of your singing voice is not the same as ordinary contact information — it can be used to identify you, and in some jurisdictions is treated similarly to biometric data. See §7 for exactly how consent works for this feature today. You can decline to have your voice recordings uploaded without losing access to the rest of the Service, though you may then rely on other members' recordings to learn your part instead.
3.4 Attendance and RSVP data
- Whether you RSVP'd "coming," "not coming," or "maybe" to a rehearsal, and whether you were marked as having attended.
- Any voice-part override recorded for you for a specific session (e.g., if a Director asks you to cover a different part for one rehearsal).
3.5 Data about you entered by other users
Choir Leaders/Directors may enter or reference information about you when scheduling rehearsals, marking attendance on your behalf, or messaging you in choir chat. If someone else in your choir enters data about you, this policy governs our handling of it the same way as data you enter yourself — but we are not able to verify its accuracy the way we can for self-reported data. Contact us (§14) if data about you entered by someone else is inaccurate.
3.6 Choir chat and communications
- Text messages, and any audio or image attachments, sent in a choir's chat.
- Announcement messages (a message type Directors/Leaders can use to notify a whole voice part or the whole choir).
3.7 Payment data (Pro plan only)
- Your phone number, used to initiate an MTN Mobile Money payment request ("STK push") for a Pro subscription.
- Transaction status and reference IDs returned by MTN.
- We do not collect, see, or store your MTN Mobile Money PIN, or any other MoMo account credentials — payment authorization happens entirely within MTN's own systems and app/USSD flow. See §6.2.
3.8 Technical and diagnostic data
- Crash and error reports (via Firebase Crashlytics) — device type, OS version, app version, and the technical details of what the app was doing when it crashed or hit an unexpected error. This does not include the content of your messages or recordings.
- Push notification token (FCM token) — a device-specific identifier used to deliver notifications (rehearsal reminders, chat messages, new learning tracks).
- Basic app usage signals inherent to operating the Service (e.g., that a request was made, for rate-limiting and abuse-prevention purposes — see §9).
3.9 Data we do not collect
For clarity: KwayaPro does not currently collect precise device location, does not use third-party advertising trackers, and does not sell personal data to third parties (see §6.4).
4. How we use your information
| Purpose | Data used | Legal basis (see §5) |
|---|---|---|
| Creating and securing your account | Phone/email, auth identifiers | Contract necessity |
| Operating choir membership, roles, and permissions | Membership data | Contract necessity |
| Letting you learn your voice part | Voice recordings | Consent (§7) |
| Scheduling and tracking rehearsals | Attendance/RSVP data | Contract necessity |
| Choir communication | Chat messages/attachments | Contract necessity |
| Processing Pro plan payments | Phone number, transaction data | Contract necessity |
| Sending you notifications you'd expect (reminders, messages) | FCM token, notification content | Contract necessity / consent (notification permission) |
| Diagnosing and fixing crashes | Crash/device diagnostics | Legitimate interest |
| Preventing abuse (e.g., invite-code brute-forcing, payment spam) | Request metadata, rate-limit counters | Legitimate interest (security) |
| Complying with legal obligations | As required | Legal obligation |
We do not use your data for automated decision-making that produces legal or similarly significant effects about you, and we do not use it to build advertising profiles.
5. Legal bases for processing
Depending on the data and purpose, we rely on:
- Performance of a contract — most of KwayaPro's core functionality (membership, attendance, chat, scheduling) is data processing necessary to provide the Service you or your choir signed up for.
- Consent — specifically for voice recordings (§7) and any purpose beyond what's needed to run the Service. You can withdraw consent at any time (§8); this doesn't affect processing already carried out under consent given before withdrawal.
- Legitimate interests — for security, fraud/abuse prevention, and diagnosing technical problems, balanced against your right not to have your data used in ways you wouldn't reasonably expect.
- Legal obligation — where a law (including Uganda's Data Protection and Privacy Act, 2019, or applicable tax/financial-recordkeeping law for Pro plan payments) requires us to retain or disclose specific data.
6. Who we share your information with
We do not sell your personal data. We share data only as follows:
6.1 Service providers (data processors)
We use Google Firebase / Google Cloud Platform to host and run KwayaPro's backend:
- Firebase Authentication — manages sign-in and credentials.
- Cloud Firestore — stores membership, attendance, chat, and program data.
- Cloudflare R2 / Cloud Functions — stores audio recordings and profile/cover photos, and runs server-side logic (payment processing, notifications, invite/role management).
- Firebase Cloud Messaging (FCM) — delivers push notifications.
- Firebase Crashlytics — collects crash/diagnostic reports.
These providers process this data on our behalf, under their own data processing terms, and we have configured access controls so that, for example, one choir cannot read another choir's data.
6.2 MTN Mobile Money
For Pro plan subscriptions, we send your phone number and the payment amount to MTN Uganda's Mobile Money Collections API to initiate a payment request. MTN then handles authorization directly with you (via their own app, USSD, or SIM toolkit flow) and returns a transaction result to us. MTN's own privacy practices govern their handling of this data during that process — see MTN Uganda's own privacy policy on their website.
6.3 International data transfers
Because our infrastructure runs on Google Cloud and Cloudflare, your data is processed outside
Uganda regardless of where our users are. Our Cloud Functions, and the Firestore instances
they read and write, run in Google Cloud's us-central1 region (Iowa, USA); audio
and image files are stored on Cloudflare's global network. We rely on our providers' own
contractual safeguards for cross-border data processing as part of our agreement with them.
6.4 What we don't do
- We do not sell personal data.
- We do not share your data with advertisers or data brokers.
- We do not share one choir's data with another choir, or with individual members outside your own choir(s), except where the Service's own design necessarily shows it to them (e.g., other choir members can see your name, voice part, and RSVP status, because that's how a choir roster works).
6.5 Legal disclosures
We may disclose personal data if required to by law, court order, or governmental request, or where necessary to protect the rights, property, or safety of KwayaPro, our users, or the public.
7. Voice recording consent
Because a voice recording is more sensitive than ordinary profile data, here is exactly what happens today when you use the Studio recording feature or upload a voice-part recording:
- Recording audio requires your device's own microphone permission, which Android/iOS will prompt you for the first time the app tries to record. No recording happens without this OS-level permission being granted.
- Choosing to record and upload a voice-part track is itself how you give consent for that recording to be used as a learning aid and shared with other members of your choir — there is not currently a separate in-app consent screen beyond this action and the OS permission prompt.
- Recordings are only accessible to members of the same choir, enforced by our server-side access rules — not publicly accessible.
- You (or, for a recording someone uploaded on your behalf as part of choir administration, your choir's Director/Leader) can delete an uploaded recording at any time. Withdrawing consent going forward means the recording is removed and no longer shared, though we can't retroactively erase a copy another member may have already listened to, downloaded, or cached locally before removal.
We may add a more explicit, separate consent step before recording in a future update; this section will be updated to match if we do.
8. Your rights
Depending on applicable law (including Uganda's Data Protection and Privacy Act, 2019), you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — ask us to delete your personal data, subject to §8.1 below.
- Restriction — ask us to limit how we use your data in certain circumstances.
- Objection — object to processing based on legitimate interests.
- Portability — request your data in a portable format, where technically feasible.
- Withdraw consent — for any processing based on consent (notably voice recordings, §7), at any time, without affecting the lawfulness of processing before withdrawal.
- Complain — lodge a complaint with Uganda's Personal Data Protection Office (PDPO), or the relevant supervisory authority in your jurisdiction, if you believe we've mishandled your data.
To exercise any of these rights, contact us at [email protected]. We will respond within a reasonable time, and in any event within the timeframe required by applicable law.
8.1 What "erasure" actually means for a shared choir record
When you request account deletion, in the app (Profile → Delete Account), we apply different handling depending on the kind of data involved, because some of it is shared with other choir members in ways that a blanket delete would silently break for them:
- Account and profile data — your login credentials, phone number, email, name, and profile photo are permanently and unconditionally deleted. This is not reversible.
- Voice recordings — any learning-track or studio recordings you uploaded are permanently deleted, consistent with §7's consent-driven model.
- Attendance and RSVP records — anonymized, not deleted. We remove every field that identifies you (your user ID, name) from these records, replacing your identity with a generic placeholder, while preserving the underlying "attended"/RSVP value itself, so a choir's historical attendance reporting stays accurate for the Directors who rely on it.
- Chat messages — anonymized, not deleted, the same way. The sender field on messages you sent is replaced with a generic "Former member" label; the message content itself remains, because removing your half of a group conversation would silently strip other members' context.
- Song programs, rehearsal templates, songs, score attachments, and rehearsal-session direction records — anonymized, not deleted, the same principle: the record of who created/uploaded/directed something is stripped, the record itself stays intact for the choir.
In short: data that is fundamentally about you and only you (your identity, your recorded voice) is deleted outright. Data that is a shared choir record you merely participated in has your personal identity stripped out but the record itself preserved for the choir's continuity. This deletion is a genuine, irreversible operation once triggered, and can only be initiated by you, authenticated as the account owner — not by anyone else on your behalf, including choir Leaders.
If you're a choir's Leader, account deletion is blocked until you transfer leadership to another member — a self-service in-app flow (Members & Roles → hand off leadership), since a choir needs someone able to manage billing, members, and roles at all times. Once a transfer is accepted, the former Leader's account deletion proceeds normally.
9. Data security
We use industry-standard measures appropriate to the sensitivity of the data involved, including:
- Server-side access rules that scope every read/write to your own choir membership and role, enforced on our backend — not just hidden in the app's interface.
- Server-side authentication verification (Firebase ID tokens) on every sensitive backend endpoint.
- Rate limiting on invite-code lookup and other endpoints vulnerable to guessing/brute-force.
No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify affected users and, where required by law, the relevant supervisory authority, without undue delay.
10. Children's data
KwayaPro is intended for use by adults only. You must be at least 18 years old to create an account or otherwise use the Service. We do not knowingly collect personal data from anyone under 18, including voice recordings. If we become aware that we've collected data from someone under 18, we will delete it.
This is a policy stance, not a technical age-verification mechanism — the Service does not currently ask for or confirm your age at signup. If you are a choir Leader considering onboarding members under 18 (e.g., a youth choir), the Service is not yet built for that and you should not add them as individual account holders under this policy.
11. Data retention
| Data category | Retention |
|---|---|
| Account/profile data | Until you request account deletion (§8.1), then permanently deleted |
| Choir membership records | Until you leave the choir or delete your account |
| Voice recordings | Until deleted by an authorized uploader, or permanently deleted upon your account deletion (§8.1) |
| Attendance/RSVP records | Retained for the life of the choir's account; anonymized upon your account deletion (§8.1) |
| Chat messages | Retained for the life of the choir's account; anonymized upon your account deletion (§8.1) |
| Payment/transaction records | Retained as required by applicable Ugandan tax and financial record-keeping law |
| Crash/diagnostic data | Per Firebase Crashlytics' default retention period (typically around 90 days) |
12. Cookies and similar technologies
KwayaPro is a mobile app, not a website with cookie-based tracking. We do not use advertising cookies or cross-app tracking. Our web pages at kwayapro.app (this policy and our invite-link landing pages) do not run any analytics or tracking scripts.
13. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via an in-app notice or push notification before the changes take effect, and update the "Last updated" date above. Continued use of the Service after changes take effect constitutes acceptance of the updated policy, except where a change requires fresh consent (e.g., a new use of voice recordings), in which case we will ask for it explicitly.
14. Contact us
Questions, requests, or complaints about this policy or our data practices:
If you're not satisfied with our response, Uganda's Personal Data Protection Office (PDPO) is the relevant supervisory authority for complaints about the handling of personal data in Uganda.