Policies / Privacy Policy
Privacy Policy
Effective: [EFFECTIVE DATE]
24 Frames is a video, music, short-clip ("Shorts") and live-streaming service run from Botswana by [COMPANY LEGAL NAME]. This policy explains what we collect when you use the 24 Frames app, the website at 24frames.co and the creator studio, why we collect it, who sees it, how long we keep it and what you can do about it. The short version: we collect what we need to sign you in, play you things, remember where you were and let you publish. We do not sell your information, we use no ad networks or analytics companies, and we do not store your IP address. If you want your account removed, email us and we will do it.
1. Who we are
24 Frames is operated by [COMPANY LEGAL NAME], company registration number [COMPANY REGISTRATION NUMBER], registered office [REGISTERED ADDRESS]. We are the "data controller": we decide what is collected and why, and we are responsible for looking after it.
- Privacy questions and data requests: [PRIVACY CONTACT EMAIL]
- Data protection contact: [DATA PROTECTION OFFICER]
- Registration with the Information and Data Protection Commission: [IDPC REGISTRATION STATUS]
- General help: [SUPPORT EMAIL]
We follow Botswana's Data Protection Act 2024. If you are outside Botswana, your own country's laws may give you extra rights, and we will respect them where they apply. The service is offered in [COUNTRIES WHERE THE SERVICE IS OFFERED].
2. What this policy covers
The 24 Frames app, the website at 24frames.co including watch pages, the creator studio, and live streams and replays. It applies whether you watch, publish or just visit. It works alongside our Terms of Service, Community Guidelines, Creator Terms, Children and Age, Cookies and Device Identifiers, Data Retention Schedule, SMS Messaging Terms and Security.
3. What we collect, feature by feature
Signing in
You can sign in with a phone number or a verified email address and password. For phone sign-in, we record the number, its country or region, a hash of the one-time code, attempts and expiry. For email sign-up, linking and password recovery, we record your normalized email address, verification status, a hash of the email code, attempts and expiry. We store passwords as one-way hashes, not readable passwords. Email sign-in does not require a phone number. Older accounts may also retain a username. Expired verification records are removed by routine maintenance after one day.
Setting up your account
During onboarding you give us your full name, gender, age range (which can be "under 18") and up to eight interests. Interests shape your home screen. Your age range is the signal we use to decide whether you see titles marked "adults only" or any advertising; we are bringing our systems into line with that rule, as Children and Age explains.
Your profile
Your display name, a short bio and an avatar. Your display name appears on your profile and, if you are a creator, on your channel.
Watching
- Watch progress and history: where you are in each title and whether you finished it. You can clear this at any time.
- Library: the titles you like or save.
- Follows and blocks: which channels you follow and which you have blocked.
Recommendation events
Each time you play, finish or are shown a title, the app tells our servers which title, what happened, how many seconds you watched, the title's length, where in the app it happened (for example home or search) and a session identifier. Events are tied to your account when you are signed in and to an anonymous device identifier when you are not (section 4). They power "Continue watching", "Up next" and your home screen rails.
Live reactions
Hearts sent during a live stream are counted as totals, not tied to you.
Reports
Who reported what, the reason you picked, any note you wrote, who reviewed it and the outcome.
Publishing (creators)
The media you upload, its title, description or caption, category, visibility, your four declarations ("made for kids", "adults only", synthetic media, paid promotion), any edit recipe and any voiceover audio. Going live produces a raw recording that becomes a replay.
Ads
Ads on 24 Frames are our own, served by our own servers. When one is shown we record the title it played against, the placement, the playback session, a short-lived ad session identifier and what happened (impression, how far it played, click, skip). Ads are decided only for signed-in viewers. Section 6 explains how.
Search
Your search words go to our servers to find results. The app keeps your last eight searches on your phone.
Sharing
Sharing a title creates a short link, and we count how often it is opened. The count is a number; it does not tell us who opened it.
Your devices and sessions
Each sign-in records your device's model name (the manufacturer's name, not the personal name you gave your phone), which app you used, a hashed sign-in token and when the session was last used. You can see and revoke sessions under "Your devices".
Update check
If you installed the app directly rather than from an app store, it checks our servers for newer versions, sending its build number and the usual identity headers.
What we do not collect
- IP addresses. We do not store them. Our servers hold them in memory briefly to limit abusive traffic, then forget them.
- Precise location, contacts, payment details, government ID numbers or biometrics.
- Anything from analytics, crash-reporting or advertising software. The app contains none.
- Your phone's advertising identifier. We never ask for it.
4. The anonymous device identifier
When you use the app without signing in, it sends a header called X-Viewer-Id with each request. It is a random identifier the app creates and keeps on your phone. It is not your phone number, your name or your phone's advertising identifier. We use it to make your home screen and search a little more relevant, and to count plays honestly, before you sign in. It stays on your phone until you uninstall the app. We do not share it. Once you sign in, requests are tied to your account instead.
5. Why we use your information, and on what basis
| What we do | What we use | Why we are allowed to |
|---|---|---|
| Sign you in and keep you signed in | Phone number, code hash, sessions | You asked us to provide the service |
| Play titles and remember your place | Watch progress, recommendation events | You asked us to provide the service |
| Personalise home and search | Interests, history, likes, follows, blocks, events, device identifier | Our legitimate interest in a service worth using; you can clear history and block channels |
| Show ads to keep the service free | Placement, content category, frequency caps, ad events | Our legitimate interest in funding the service; never your personal details |
| Let you react, follow and share | The ids involved | You asked us to provide the service |
| Let creators publish and see performance | Uploads, declarations, aggregate counts | You asked us to; creators accept the Creator Terms |
| Keep the service safe and fair | Reports, audit log, rate limits | Our legitimate interest in preventing abuse, and our legal duties |
| Send you one-time codes | Phone number, message text | You asked us to text you |
| Answer requests and complaints | Whatever you send us | Our legal duties and your rights |
"Legitimate interest" means we have a real reason, we have weighed it against your rights, and we have kept the effect on you as small as we can.
6. Advertising
- All ads are first-party: titles uploaded to our platform and marked as ad creatives by our staff. There is no ad network, ad exchange or tracking pixel.
- An ad is chosen by three things only: the category of the title you are watching, the placement (for example before a film) and frequency caps so you do not see the same ad too often.
- Ads are never chosen from your name, gender, age, phone number, interests, watch history or any profile of you. We do not profile you for advertising.
- Ads are not served on titles marked "made for kids".
- We record ad events so we can report campaign totals to advertisers. Advertisers see totals, never who you are.
- We do not sell your personal information, and we do not share it with advertisers or anyone else for their own marketing.
7. Who we share information with
A small number of companies and people help us run 24 Frames. Each receives only what its job needs.
| Who | What they receive | Why | Where |
|---|---|---|---|
| Bunny CDN (Bunny Net) | When your device fetches video, audio, artwork or an avatar, Bunny's edge servers see your IP address and the file path. The signed links we give your device are not tied to you. | Delivering media | Stored in Johannesburg, South Africa; served from Bunny's worldwide edge |
| Resend | Recipient email address, subject and message containing a verification or password-recovery code | Transactional account email; open and click tracking are disabled | Processing locations subject to Resend's service terms; to be confirmed in the final policy |
| Mobile network operators | Your phone number and the one-time code, as an ordinary SMS | Delivering sign-in codes | [SMS SENDING COUNTRY AND OPERATORS] |
| Our own gateway phones | Your number and the code while sending; the phone's journal keeps the job id, the number and a masked outcome | Sending codes from our own SIM cards | Held by our staff |
| Our own servers | Everything in section 3, media files and live ingest | Running the service | [SERVER HOSTING REGION] |
| Backups | A full copy of the database every night | Recovering from failure | Same host, kept 14 days |
| Apple and Google | Nothing from us; the stores process what they process for any app | Distribution | Not applicable |
We do not share your information with advertisers, data brokers, analytics companies or social networks. We will disclose information if the law requires it, for example under a court order or a lawful request from a Botswana authority, or where we reasonably believe it is needed to protect someone's safety or enforce our terms. We will tell you when we are allowed to.
8. International transfers
Most of your information stays on our servers in [SERVER HOSTING REGION]. Two things leave: media delivery through Bunny CDN (storage in South Africa, edge servers worldwide), which sees your IP address and the file path but not your account; and email for legacy username accounts through Resend in the United States. In both cases we send the minimum, never your account record, and rely on the recipient's contractual commitments. South Africa has its own data protection law. The United States has no single national privacy law, so for Resend we rely on our contract and send only what an email needs. Ask [PRIVACY CONTACT EMAIL] for more about any transfer.
9. How long we keep it
We keep information as long as we need it for the purpose we collected it, then delete or anonymise it. The full schedule is at Data Retention Schedule. In short: your account and what hangs off it (profile, library, follows, history) stays while your account exists; one-time code challenges go one day after expiry; sessions go seven days after expiry or revocation, though a viewer session stays active until you revoke it; recommendation and ad events are kept 13 months then reduced to totals; reports two years after resolution; backups roll over after 14 days; uploads stay until you delete the title. Some of these periods are targets we are bringing our systems into line with; the schedule says which.
10. Security
- Encryption in transit. Every connection uses TLS; the apps refuse unencrypted connections.
- Hashed credentials. Passwords are hashed with BCrypt; sign-in tokens and one-time codes are stored only as hashes. Nobody at 24 Frames can read your code or password.
- Encrypted code messages. A sign-in SMS is encrypted while it waits to be sent and wiped once it has gone.
- Encrypted downloads and cache, playable only inside the app.
- Screen-capture blocking on Android; playback pauses if recording starts on iOS.
- Rate limits on sign-in, code requests, reports and uploads.
- Short-lived access tokens: 15 minutes for viewers, 10 for staff.
- Audit logging of staff actions in the studio and of sign-ins.
We do not currently encrypt our database, stored media or backups at rest; they sit on servers only staff who need them can reach. We say this plainly so you can judge for yourself.
No system is perfectly secure. If a breach puts you at risk we will tell the Information and Data Protection Commission within 72 hours and tell you as soon as we can, by SMS or, for username accounts, by email. Found a security problem? Read Security.
11. Your choices and controls in the app
Without asking us, you can: clear your watch history; delete downloads (which removes them and their keys); block a channel; revoke devices under "Your devices", including a lost one; edit your display name, bio and avatar; unlike, unsave or unfollow; delete your own videos and Shorts; change notification and autoplay settings; and sign out, which clears your token, roles, name and cached library from the phone.
12. Your rights and how to make a request
Under Botswana's Data Protection Act 2024 you have rights over your personal information, including to:
- access it: ask what we hold and get a copy;
- correct it if it is wrong or incomplete;
- delete it, subject to what we must keep by law;
- object to how we use it, including for personalisation;
- complain to the Information and Data Protection Commission if you think we have got it wrong.
The Commission can tell you exactly how each right works. Outside Botswana you may have similar or extra rights under your own laws, and you can use them with us the same way.
There is no button in the app yet to delete your account or download your data. To use any right, email [PRIVACY CONTACT EMAIL] with the phone number on your account and what you want. For account deletion, Delete Your Account walks you through the same email route. We will check the request really comes from you, usually by sending a code to that number, and answer within [DATA REQUEST RESPONSE PERIOD]. It is free. If we cannot do all you ask, we will say why.
Deleting your account removes your profile, phone number, library, follows, history and the link between you and your events. Backups roll over after 14 days. Reports and audit entries stay for the periods in the Data Retention Schedule, but no longer link to a name or number.
13. Children
You must be at least [MINIMUM AGE] to hold an account. 24 Frames is not directed at children and we never knowingly create an account for anyone under 13. Parents or guardians who believe a child has an account can email [PRIVACY CONTACT EMAIL] to have it removed. Our full approach, including "made for kids" and "adults only" titles, is in Children and Age.
14. What stays on your phone after you sign out
Signing out removes your token, roles, name, cached library and ad session. It does not remove downloads and their keys, the encrypted streaming cache (up to 2 GiB), your last eight searches, publishing drafts and copies of media you picked to publish, or app settings. Delete downloads in the app before signing out to remove them. Uninstalling the app removes everything. If you are lending or selling your phone, uninstall first.
15. Creators
If you register a channel we hold your titles, declarations and share links, and show you analytics. Analytics are aggregates: distinct viewers a day, how much was watched, how often a link was opened. You never see who a viewer is; viewers never see your phone number. Your channel name, avatar and bio are public. Uploads are removed when you delete the title.
16. Staff access
Our staff (administrators, moderators, operations and publishers) use the studio to review reports, manage titles and campaigns and help with support, seeing what their role needs. Their studio actions are written to an audit log: who did what, to what, when. Staff running our SMS gateway phones can see numbers and codes passing through while messages are sent. All staff are bound by confidentiality duties.
17. Changes to this policy
We update this policy when the service changes. Small changes take effect when posted. For changes that affect your rights or what we collect, we will tell you in the app or by SMS first, and the date at the top will move. Earlier versions are available from [PRIVACY CONTACT EMAIL].
18. Contact
- Privacy questions and requests: [PRIVACY CONTACT EMAIL]
- Data protection contact: [DATA PROTECTION OFFICER]
- Support: [SUPPORT EMAIL]
- Post: [COMPANY LEGAL NAME], [REGISTERED ADDRESS]
- Supervisory authority: the Information and Data Protection Commission of Botswana