Lamp313

Draft. This policy is still being reviewed and may change before the app is released. Parts in [brackets] are not settled yet.

App privacy policy

For the Lamp313 Android and Windows apps and partner page. The website lamp313.com has its own privacy notice.

Last updated: [date of publication]

The short version

• You install Lamp313 on your own phone or Windows PC, by your own choice, to share an honest record of how you use it with partners you choose.
• It takes screenshots and records which apps or programs you use and when. Before you agree, nothing leaves your device.
• You agree to each part separately, and we keep a record of what you agreed to and send you a copy. Recording the websites you visit in private browsing is optional.
• Screenshots are locked on your device before they're sent, so only you and your partners can open them. Not even we can. Text on your screen is covered before a screenshot leaves your device, unless you turn that off.
• Only partners you invite see your record, only from the moment they accept, and they agree to keep it private. You can end a partnership at any time.
• Your record is deleted after 30 days. You can delete your account at any time, and everything goes with it (billing records are kept for 5 years, as tax law requires).
• We don't sell your information, show adverts, send marketing, or use your record for anything except showing it to you and your partners.
• Lamp313 is for adults (18 and over) only.

Who we are

Lamp313 is run by Lamp313 (Pty) Ltd, a company registered in South Africa (registration number 2026/877495/07). It is the responsible party for your information under the Protection of Personal Information Act (POPIA). Postal address: [postal address].

Information Officer: Stephen Mew, director, registered with the Information Regulator (registration number 2026-071172). Privacy questions and requests: privacy@lamp313.com. Anything else: support@lamp313.com. Our PAIA manual explains how to ask for records we hold: [link to the PAIA manual].

What you agree to, and how to change it

Nothing about your device is recorded until you agree, in the app or in the PC's sign-in window. You agree to each part on its own:

• We keep a record of each agreement: what you agreed to (the version of the words you saw), on which device, when, and when you withdrew it. Only you can see your records of this.
• We email you a copy each time you agree to something or turn it off. A username account (no email) sees it in the app.
• Changing your mind: switch monitoring off in your device's settings, or sign out on a PC, to stop everything (your partners see that it stopped). Turn off the websites in private browsing at any time in Settings › Privacy (your partners see that you did). Withdrawing doesn't affect what was recorded before.
• New wording: if we change what's recorded, the app asks you to agree again before anything new is collected.

What we collect, and why

Your account

• Your email address, a display name you choose, and your password (stored only as a hash by our sign-in provider; we never see it). Partners see your display name and email address, and you see theirs.
• No email of your own? You can join a household with a code and sign in with a username. We keep your username and a scrambled form (hash) of your recovery code, never the code itself.
• That you confirmed you're 18 or older, and when.
• Why: to sign you in and to provide the service you signed up for.

Your phone or PC

• Its make and model, Android or Windows version, the app version, the name you give it, and when it last contacted us. Why: so you and your partners know which device a record comes from and whether it's still reporting.

Your record (only after you agree)

• Screenshots at random moments while your device is unlocked (roughly every 1 to 3 minutes) and shortly after you switch apps or programs, each with its time, the app on screen and whether the capture worked. Until you or a partner has a viewing key, no screenshots are taken; the record says so instead.
• Banking and password apps and banking websites are never captured or read. The record says only that a screenshot was skipped there, with the app (never the website address).
• Which apps or programs you use and when, and when your screen was on, off or unlocked (on a phone, from Android's own usage record, the "Usage access" permission).
• Monitoring status: monitoring started or stopped and why (for example the phone maker's battery saving, a crash, a restart), permissions switched off, uploads delayed, your privacy settings and every change to them. If your phone hasn't reported for 30 minutes, our server sends it a silent message (at most every 6 hours) so the app can check itself.
• A score worked out on your device: a small program on your phone or PC gives each screenshot a score from 0 to 1 for how likely it is to show explicit content, so your partner can see where to look first. No screenshot is sent to any AI service. The score is locked with the screenshot's other details (below), so only you and your partners can read it. It is only a hint, and never a judgement about you.
• Checking searches and AI prompts, on your device: what you type as a web search (in the browser's address bar or an app's own search box) and in an AI tool's prompt box is checked against a list of explicit phrases, and the address bar against a list of adult websites. When something matches and stays a few seconds, a screenshot is taken, framed so your partner can see what was found. Only the kind of match is sent (for example "explicit search") and, for an adult website, its name (never the full address). The words themselves are never kept, logged or sent. A search for help (such as "how to stop…") never counts. Messages, posts and other text on screen aren't checked.
• "Needs your review": while something matched is still on screen, a screenshot is taken every 15 seconds (at most 30 extra an hour). If the checks keep finding something for a while, that stretch of time is marked for your partners to review, and they get a notification that says only that something needs review. Private browsing (an incognito window) for more than a few seconds is marked the same way, without a notification unless something else is found with it. You can add a note for your partners; it's locked on your phone, so only you and your partners can read it (we see only that there is a note, and when you wrote it).
• Websites in private browsing (optional): if you agree to it, the names of the websites shown in a private window's address bar (for example "booking.com", never the page or what you searched for) are recorded for your partners, at most 20 each time. They're locked on your device so only you and your partners can read them (we can't), and never shown in emails. If you don't agree, private browsing is still recorded as private browsing, with its times, but not its websites.
• Why: this is the record you choose to share, so your partners can support you. A gap is shown as a gap or "unknown", never as proof of anything.

Text on your screen is covered (Hide text)

• Hide text is on from the start. Before a screenshot is saved or sent, the device finds where text is on screen and covers it with soft bars. What a check found stays visible, with the line above and below, so your partner can see what it was. The text itself is never kept or sent.
• Text inside pictures and videos isn't covered. If the device can't tell where the text is, the whole screenshot is blurred instead. You can also choose a blur (None, Light or Medium).
• You can turn Hide text off in Settings › Privacy, for closer accountability. Your partners see your settings, every change, and what was applied to each screenshot. With Hide text off, the text of notifications that pop up over other apps is still covered.

Your screenshots are locked (end-to-end encryption)

• Before a screenshot leaves your device, it's locked with a new key made for that image, and that key is locked for you and for each partner you had when it was taken, with each person's own viewing key. We and our providers store only the locked image and locked keys: none of us can open your screenshots, and nobody can be added to older ones afterwards.
• Your viewing key is made on your own device and stays there. You're shown six words once: they unlock your key on a new device. We keep a copy of your key locked with those words, which we can't open.
• Also locked: what a check found (the kind of match, also behind an episode, and an adult website's name), each screenshot's score, your notes (on a stretch marked for review, and with a request for support) and a partner's reason for deleting a screenshot. They're locked on your device, or your partner's, with a key for that device and day, so only you and your partners can read them; we see only that something was found, that a screenshot was scored, and that there is a note. Each is padded to whole blocks first, so its length shows at most roughly how long a note (or a very long website name) is, never what kind of thing was found.
• What we can still see: the other details stored with each screenshot: its time, the app, why it was taken (at random, after you switched apps, because something was found on screen, or a follow-up every 15 seconds while something stood out), whether it was scored and with which program, and the privacy settings applied. We need these to run the record, and they don't say what was on the screen.
• Scores and notes are locked from [the date this ships]. The readable ones from before were deleted that day; old copies in our database's own records and backups go within about 7 days [Assumption, to confirm for the production plan]. Older screenshots show their score as unknown, and an older note as "The note from before isn't kept".

What partners do with your record

• A partner can flag a screenshot to "check in about", mark weeks and days as reviewed, answer a "Needs your review" or a gap, hide a screenshot from themselves, or delete one for everyone (with a reason; it can't be undone). Only that partner sees their own flags, reviews and hides.
• When a partner deletes a screenshot, the picture is removed at once, your record keeps a line saying it was deleted, why and by whom (you can see who; other partners can't), and your other partners are told a partner deleted it, without their name. You aren't sent a message about it.
• A partner may choose to blur screenshots that are very likely explicit, for themselves only. You aren't told, and nothing changes for you or your other partners.

Requests for support

• When you ask your partners for prayer, a check-in or a call, we keep what you asked for, the short note you add if any (locked on your phone, so only you and your partners can read it; we see only that there is one), and when. Your partners get an email and a notification saying who asked and what for; your note isn't in the email or notification, they read it in the app or on the partner page. Only the partners you chose see the request. Their answers are kept with the request. Requests are deleted after 30 days.

Reports you choose to send to Lamp313 support

• If something isn't working, you can send us a report from Troubleshooting (phone) or Settings (PC). It contains your device's monitoring records from the last 14 days: when monitoring started and stopped and why, its settings, gaps, and how many screenshots failed (on a PC, also Windows' own records of restarts, sleep and updates, as kinds and times only). It never contains screenshots, the apps, programs or websites you used, or anything you typed. You see exactly what will be sent before you send it. The note you write with it isn't locked: it is for us, so we read it. Please don't describe what was on your screen. Kept for 30 days.

Emails and notifications

• Emails we send: confirming your address and resetting your password, partnership confirmations, "a device was added to your account", report emails (counts only, never screenshots or the names of apps or websites; you choose how often or turn them off), requests for support, a partner deleting a screenshot (to other partners), and copies of what you agreed to. Someone without a partner yet gets up to three reminders (one click stops them).
• When you invite someone to be your partner or to join your household, we email them once, at your request, with fixed wording and your name.
• Notifications go to phones through Google's service: a notification token links your phone to your account, is removed when you sign out, and is deleted with your account.
• We don't send marketing, and we don't share your email address with anyone for marketing.

Technical logs

• Our providers keep short-term technical logs (for example internet addresses and request times) for security and to keep the service running. Our own code logs only status codes and short error reasons, never your screenshots, your record or your sign-in tokens. [To confirm: how long Supabase and Cloudflare keep these logs on the production plans.]
• To stop repeated guessing of household, recovery or discount codes, we keep a scrambled form of the internet address for up to one day.

Paying for a household

• The person who pays gives their card to Paystack, never to us. We keep what Paystack tells us (amounts, dates, the card's brand, last 4 digits, expiry and issuing country), how many devices the household has, and any church or group discount code used. A code can show which church someone belongs to, so it's seen only by the people who run the service, never by anyone in the household or partners, and the church is never told who used it.

What we don't do

• We don't keep or send the text on your screen (only screenshots, with text covered unless you turn that off, and the kind of a match), and we don't record your typing, your location, your contacts, your microphone or your camera.
• The app never taps, types or acts for you, and never hides.
• No advertising or analytics trackers in the app or on the partner page; the partner page sets no cookies.

Sensitive information

• Because of what Lamp313 is for, your record may reveal very personal things, including your religious beliefs and your sex life. Under POPIA these are special personal information (sections 26 and 27).
• We process them only with your explicit consent, given on the consent screens, where they're named, and you can withdraw it at any time (see "What you agree to"). The websites in private browsing, which can reveal things such as your health, have their own optional consent.

Other people in your screenshots

• A screenshot can show other people's details: a message someone sent you, a name, a photo. They haven't agreed to anything, so we keep this to a minimum:
  • Text on screen is covered from the start (Hide text), including notifications that pop up over other apps.
  • Messages and posts aren't checked for words.
  • Banking and password apps and banking websites are never captured.
  • Screenshots are locked so only you and your partners can open them, and deleted after 30 days. A partner can delete one for everyone at once.
• We process what remains only as part of your own record, because it's needed to show your partners an honest record you asked them to see (POPIA section 11(1)(f), a legitimate interest), with the safeguards above.
• Please help: if you turn Hide text off, keep in mind that others' messages may be visible to your partners. Don't use Lamp313 to collect or share other people's information (our terms of use, clause 7).

Who can see your record

• You, in the app.
• Partners you invite, from the moment they accept, never anything from before. Before their first look they agree to keep it private and use it only to support you. When a partnership ends, the partner loses access at once; you both still see that it existed.
• No one else. Our database checks this on every request. We can't open your screenshots or read what was found, their scores or your notes, and we don't look at your record.
• App health, for us: to fix devices that stop reporting, our team sees quiet devices and why monitoring stopped (a short device id, maker, model, app version, how long, the kind of stop), never names, email addresses, screenshots or activity. Only if you ask us in writing to look into a fault may our director look at what that fault needs, and we note when and why.
• Our operators (below) store and send data for us under contract, and may not use it for anything else.
• We disclose information to authorities only where the law requires it.

Where your information is stored

Because some of it is stored or sent outside South Africa, POPIA section 72 applies. We keep the record itself in the European Union, whose data protection law gives protection substantially similar to POPIA; for the providers in the United States, our agreements with them include the European Commission's standard contractual clauses. [To confirm with the attorney, with each provider's agreement.] Everything is sent encrypted (HTTPS).

How long we keep it

Backups: [To confirm for the production plan: on Supabase's paid plan, daily database backups are kept for 7 days. Deleted data (not images) can stay in them until they expire, and is never restored except to recover from a disaster. Images have no backups.]

Deleting your account

• In the app: Settings › Delete account. On the partner page: Delete account. You type DELETE to confirm. To keep a copy, use "Download your data first" there before you delete.
• We then delete, straight away, all your screenshot images, your account, your devices and your whole record, and the app deletes what it kept on your device. Your partners see that the partnership ended because the account was deleted, nothing else. Billing records are kept for 5 years, as tax law requires.

Your rights, and how to use them

Under POPIA you may:

• see what we hold about you, and get a copy. "Download my data" gives you everything we keep about you as one file: in the app (Settings › More › Privacy and your data) and on the partner page (Your data). It's free, once a day. "Download my screenshots" gives you your screenshots too, a day at a time. We keep a record of each download (when, and how big it was) for 1 year;
• ask us to correct or delete it (or delete your account yourself);
• object to our processing it, and withdraw your consent at any time (see "What you agree to");
• complain to the Information Regulator (South Africa): inforegulator.org.za, POPIAComplaints@inforegulator.org.za, 010 023 5200.

To use any of these, email privacy@lamp313.com from your account's address (or, for a username account, ask in the app). We check that the request comes from you, and answer within 30 days, free of charge. If we can't do what you ask, we say why. A request for records under PAIA is explained in our PAIA manual.

Security

• Access is checked by the database on every request, not only by the app. Screenshots are locked on your device (end-to-end encryption), stored privately, and served only to you or one of your partners. No storage keys are built into the app.
• We keep our providers' agreements [To sign], review their security, and keep our own access to the minimum.
• If your information is compromised, we'll tell the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires, with what happened and what you can do. Nothing in our terms limits these duties.

Children

Lamp313 is for adults (18 and over). Everyone confirms this when creating an account and again when agreeing on a device. We don't knowingly collect information from anyone younger; if you think a child is using it, tell us and we'll delete the account.

Changes

If we change this policy, we update the date above. If a change affects what we collect or who can see it, the app asks you to agree again before anything new is collected.