Privacy

Encrypted on your device: we cannot read these

• Every uploaded file, and its filename.
• Every reference number: passport, ID, policy and account numbers.
• What a health record says: the allergy, condition or medication, the notes and the clinic.

These are turned into ciphertext in your browser or on your phone, under a key derived from a passphrase that never reaches us. A copy of our database, or of a backup of it, does not contain them in readable form. Nobody who works on Musha can open them, and there is no reset that could.

Health records added before October 2026 were stored as readable text. They are converted the next time a parent opens the Health page with the vault unlocked.

Stored as readable data, protected by access rules, not by encryption

Be clear about this part. The following are ordinary database columns, so the app can sort, total and remind on them:

• Names, dates of birth, email addresses, phone numbers and profile photos.
• Document titles, categories, issue and expiry dates, and who a document is about, but not the document itself or its number.
• Budget figures, loans, subscriptions and savings goals.
• School results, teacher comments, activities and reference letters.
• The calendar, chores, lists and the noticeboard.
• The kind of each health record and its dates, not what it is. Two exceptions, both a parent’s choice: the family’s medical aid (scheme, plan, number and each person’s dependant code), kept readable so a child can answer a clinic desk, and the name of a record a parent has chosen to show a child on their own phone. Notes and the doctor stay encrypted.
• Goals for the year, timetables and study notes.
• Movement sessions: what kind, when, how long, how far and how much climb. We do not store the route of a run, heart rate or weight.

Inside the app, database rules decide who in your family can see each of these. But somebody who obtained a copy of the database itself could read them. Encrypting these too is planned work; this page will change in the same release that does it.

Children

A child’s profile can exist without a login, managed entirely by a parent. Where a child does sign in, their access is limited by database policy to their own records, the household calendar, their chores and any savings goal explicitly shared with them. A child cannot verify their own school results or approve their own chores, and cannot open health records. By adding a child, a parent or guardian is the person consenting to that child’s information being kept here. A child can sign in with a code shown on a parent’s screen: that login has no email address and no password until a parent adds an email, and a parent can reset it at any time.

Consent, and when someone dies

When a parent or guardian adds a child, Musha records that they agreed to keep that child’s information, with who and when. A consent can be withdrawn but never rewritten. If a death certificate is filed for an adult, they are told at once and have seven days to say it is a mistake; only then does anything open for the executor they chose.

Sharing outside the family

A portfolio link shows one child’s name and date of birth, school results, activities and the text of reference letters to anybody who has the link. Where the family chose to attach them, the link also offers downloadable copies of reports, certificates and letters. Those copies are kept readable so that the link can hand them over; they are not vault documents and are never encrypted. A parent decides per file, can remove a copy at any time, and can create a link without any files. The link expires, and a parent can revoke it sooner. No other family member appears on it.

An invitation link lets one person sign in as one profile. It works once, lasts seven days, and shows the family name and the invited person’s name to whoever opens it.

Snap it

When a parent switches it on, a photo of a timetable, a licence disc, a medical aid card or a till slip taken in Snap it is sent to an assistant (Claude, made by Anthropic) to be read, and the fields come back to the person who took it to check before anything is saved. Musha does not keep the photo, except a medical aid card when the person chooses to save it in the vault, where it is encrypted like every other document, and a till slip when the person chooses to keep it: a receipt is kept as an ordinary file in the family’s receipt storage, readable by the family’s parents only, not encrypted on the device and not written to the audit log, and the lines read off it (what was bought, for how much, and a plain food name for the cupboard list) are kept the same way. IDs, passports and birth certificates are never sent. A parent can switch the assistant off on the Security page at any time.

The to-do list

A to-do is plain text, kept with the family’s everyday rows under the same access rules. Each person sees their own list. A parent also sees a child’s list, and anything they handed to someone else. A teenager’s list is theirs alone.

Paying for Musha

Payments are taken by Paystack, a payment company in South Africa. When a parent chooses a plan, Paystack receives their name, email address and card, and keeps the card. Musha never sees the card. Musha keeps the plan chosen, the dates it runs between, a customer code and a subscription code that Paystack issues, and a record of each payment. A family that stops paying keeps everything it added; the free plan carries on with the basics.

Notifications

A notification on your lock screen says only what kind of thing happened, “Something needs attention”, unless you switch on details in your notification settings. The full text is kept in the app, behind your sign-in, for 90 days and is then deleted.

Where it is kept, and by whom

• Supabase holds the database, the encrypted files and the sign-in records, in Ireland (European Union).
• Vercel hosts the website. Pages are produced on its servers, which may be in the United States, so the readable data listed above passes through them on its way to your screen.
• Your phone maker’s notification service (Google, Apple or Mozilla) delivers push notifications. The content is encrypted for your device; they see that a notification was sent, not what it says.
• Musha’s assistant (Claude, made by Anthropic in the United States) reads a school report only when a parent chooses it for that report and has given consent for that child, and reads a Snap it photo only when a parent has switched Snap it on. The picture leaves South Africa to be read; Anthropic does not train its models on it. A report read on the device never leaves the phone.

There is no analytics script, no advertising pixel and no font service, and the site’s Content-Security-Policy forbids adding one without a code change.

Downloading and deleting

On your profile, under Your data, a parent can download everything Musha keeps for the family as one file, and the family’s owner can delete the family from Musha. Deleting removes every stored file first, then every record, for everyone in the family; only the fact that a family was deleted, and when, is kept. Archiving a single document hides it; it does not delete it.

Your rights, and who to write to

Musha’s Information Officer is Arnold Zumbika. Write from your profile, under Your data, “Write to the Information Officer”; you will be answered in the app within 30 days.

Under South Africa’s Protection of Personal Information Act you may ask what is held about you, have it corrected or deleted, and object to how it is used. If you are not satisfied with the answer you may complain to the Information Regulator (inforegulator.org.za).