Principles
Principles
Five commitments decide what a Nzinga screen may ask for, what it must explain and what it must never do. Each one is already enforced somewhere in the code; where it is not yet true, this page says so.
Privacy by Design
packages/core/src/consent.ts consent/v1.md apps/mobile/app/screens/privacy.tsx packages/core/src/contacts.ts apps/api/src/store.ts
Members decide, recording by recording, who can use their voice. The design makes that choice visible everywhere, easy to change and impossible to bury.
Consent for Every Recording
- Every person whose voice is in a recording has their own consent record. A choice applies only to the member's own voice; anyone else in the recording makes their own choice for theirs.
- Records are never edited. A change or a withdrawal adds a new record, so the history is kept and shown in order on Recording Detail.
- Every consent names the exact text the member was shown, by version and SHA-256 hash.
- A whole conversation is used only if every speaker allows it. Anyone who has not consented is excluded, never overridden.
The Four Choices
The choices are always these four, in this order, with these exact names. Each wider choice includes every narrower one.
| Choice | Who can use it | Pay |
|---|---|---|
| Only me | Never used for training. | Not paid |
| Nzinga's models | Teaches Nzinga your language. | Paid |
| Nzinga and approved partners | Also licensed to researchers. | Paid + share |
| Everyone | Released as open data. | Paid |
Words from apps/mobile/lib/consent-copy.ts. "Nzinga's models" is the suggested starting choice.
Who can use this recording?
Withdraw Any Time
Any recording can be withdrawn from its own page, or every recording at once under Consent and Privacy. Withdrawing is never more than two taps away.
"Your voice is removed from all future training and licensing. Models already trained cannot forget it. You keep what you were paid."
The real sheet on Recording Detail. It says what happens, what cannot be undone, and what the member keeps.
"Are you sure? Withdrawing may affect your earnings and your standing."
Vague, and it uses fear to keep sharing switched on.
Contacts Are Hashed, Never Stored
- Contacts are read only if the member allows it. Each number is put in international form and turned into a one-way code (SHA-256) on the phone.
- Only the codes are sent. The server answers with the codes that belong to members and keeps none of the codes it receives.
- Each request is capped at 2,000 contacts, and matching is rate-limited.
- The app never messages contacts. Invites go out through the phone's own share sheet, sent by the member.
Said plainly in the code: a plain hash of a phone number can be reversed by trying every number, so hashing limits casual exposure rather than guaranteeing secrecy. The protections that matter are not storing the hashes, rate limits and the cap on each request. Never describe hashing as making numbers secret.
What Is Stored, and What Is Not
On the server
- Your phone number, to sign you in, and its hash, so friends who have your number can find you.
- Your profile: name, main language, other languages, and optional dialect, region (free text, never a precise location), age band and gender, each with its reason shown.
- For each recording: language, length, date, review status and every consent record.
- Earnings and invites: ledger entries, invite codes and who used them.
- Sign-in: session tokens and one-time codes are kept only as hashes; codes expire after 10 minutes.
Never on the server
- The audio, today. It stays on the phone; upload to encrypted storage is not built yet.
- Your contacts, or the codes made from them.
- Sensitive categories. The profile schema rejects ethnicity, health, religion and anything else it does not list.
- Payout methods and requests. Kept on the phone until the server has a payout endpoint.
- Your number in any dataset, or sold with your contacts or name.
Audio stays on the phone today. Only the details are sent: language, length and the member's choice. Every screen that plays audio says so when the file is not on this phone. When upload is built, the plan is encrypted storage with keys per member (SPEC.md).
Export and Delete
All four live on Profile, Consent and Privacy (app/screens/privacy.tsx).
Sovereignty by Design
african-tokenizer/SOVEREIGNTY.md african-tokenizer/README.md SPEC.md
Nzinga's purpose is sovereignty, not only better models: African control of the tokenizer, the data it is built from, the standard it is measured against and the infrastructure it runs on. The app is the data engine of that stack. Its library trains the speech and language models built on the Nzinga tokenizer.
Your language, your voice, your terms.The stance behind the name. Njinga Mbande, Luanda, 1622.
The Member Owns Their Voice
- The member decides who can use each recording, can change it on any recording, and can withdraw at any time.
- Members are paid only for their own voice, and only when they chose to share it.
- Copy says "your recordings" and "you decide". It never implies that Nzinga owns a voice it has been allowed to use.
Language Communities
- Collective benefit follows the CARE Principles for community data: Collective benefit, Authority to control, Responsibility, Ethics. Communities that join together can hold a shared agreement and a shared benefit.
- Ideas to record are designed to fill gaps in the library: under-represented languages, dialects, topics and speakers.
- No language is given a special place. Pickers sort the list alphabetically and put the member's own languages first.
Four Layers of Control
The wider project measures sovereignty layer by layer and keeps the layers separate rather than combining them into one score. Today's figures, as recorded in the scorecard:
| Layer | Today | Target |
|---|---|---|
| Tokenizer | 10.9% of the vocabulary (32,000 of 294,145 tokens) is designed from Nzinga's own corpus; the rest is Gemma 3's. 21.7% of the tokens used on text in the 12 priority languages come from Nzinga's own vocabulary. | An own base vocabulary, free to modify, redistribute and sell. |
| Data | 0% of training text comes with community consent or from African partners. All 12 priority languages have training text, from open web and research data. | A majority with community consent or from African partners. |
| Standard | Token premium against English averages 1.55x; 6 of 12 languages are within the 1.3x to 1.5x target. The accuracy gap with English is not yet measured. | 1.3x to 1.5x on all 12, and the gap closed. |
| Infrastructure | GitHub, Hugging Face, Modal and Cloudflare. None hosted in Africa. | Training data and production serving in Africa. |
| People and benefit | No native-speaker reviewer yet for any of the 12 languages. No benefit-sharing agreement yet. | Reviewers for all 12, and a written agreement. |
Honest About What Is Not Yet True
Do not claim, in the app or anywhere else, that Nzinga data is hosted in Africa, that communities have signed agreements, or that the library has a governing body. None of these is true yet.
Before any public launch the spec requires a published data-use and licensing policy, benefit-sharing terms for contributors and communities, and legal and security reviews. Who governs the library (a trust, a cooperative or a foundation) is an open decision.
"Recordings you share help train speech and language models for your language. You decide who can use each one."
"Your data stays in Africa, governed by your community."
A promise the infrastructure and governance do not keep yet.
Social by Design
packages/core/src/invites.ts SPEC.md apps/mobile/app/(tabs)/circle.tsx apps/api/src/app.ts
Trust travels through invitations. Nzinga grows through circles of people who know each other, and the design keeps those circles private and fair.
Members join only with an invite code from an existing member; a few founder numbers seed the network. Members start with three invites, earn one more for every accepted hour, and hold at most ten unused at once.
Codes are eight characters without I, L, O or U, so they are easy to read aloud and type. Each code works once.
The person who invites someone stands behind them. If an invitee is confirmed as fraudulent, the inviter loses three invites.
An invite bonus is paid when someone you invited has a first recording accepted. It goes to you only, never further up the chain, so nobody earns from the people others bring in. The programme cannot become a multi-level scheme.
There are no member profiles to browse. Friends on Nzinga shows names from your own contacts. No part of the API returns another member's phone number; matching returns member ids only, so other members never see your number.
"Invite someone you know. Each code works once."
"Invite ten friends and earn from everyone they bring in."
Untrue by design, and the language of a pyramid scheme.
Community benefit is part of the same idea: the CARE Principles in Language Communities let communities that join together hold a shared agreement and a shared benefit.
Culture
docs/logo/index.html apps/mobile/lib/languages.ts apps/mobile/lib/sessions.ts apps/mobile/app/(join)/welcome.tsx
Naming
The brand is Nzinga; the product line is Nzinga Network. Never "Nzinga Voice" in anything a member, partner or the public reads. The wordmark is drawn, never typed (see Logo).
Njinga refused the lower seat.Luanda, 1622. Sent to negotiate with the Portuguese governor, Njinga Mbande found no chair set for her. She had an attendant kneel, sat at the governor's eye level, and negotiated as an equal. The stance behind the words: your language, your voice, your terms.
The historical figure is written Njinga Mbande; the brand keeps the spelling Nzinga.
The Cowrie
Cowries were everyday currency across West, Central and East Africa for centuries, and the Akan word for cowrie, sedie, gave Ghana's cedi its name. The shell's opening has always been read as a mouth. Nzinga pays people for their voice, so the mark holds both halves of that sentence: payment and speech.
Greetings in the Member's Language
Home greets each member in their main language, from the list in languages.ts. The greeting is the member's, not a decoration.
Imagery
The app has no stock photography. Colour panels, the cowrie and the member's own photo carry the visual weight, and the six guided sessions are everyday life: Greetings and Introductions, Market Day, Numbers and Prices, Family Stories, Weather and Seasons, Health Visit. Earlier decorative marks (a woven lusona, a talking drum) were withdrawn in favour of one clear idea.
Show members as people with something to say: at home, at the market, with family. Use their own photo, or none.
Safari scenes, "tribal" patterns, map silhouettes of the continent, or anyone posed as exotic.
Exoticism turns members into subjects. The brand is about people speaking for themselves.
Respect for Elders and What Is Not Ours to Record
- Prompts ask the member to speak as they would at home: "Greet an elder you respect, the way you were taught." They describe the member's own life, never someone else's secrets.
- Nobody is recorded without their agreement, and each person in a recording chooses for their own voice. A recording of an elder needs the elder's own consent.
- "Only me" is always one tap away for anything private, sacred or not the member's to share. Prompts never ask for ritual, sacred or restricted knowledge.
Fair Pay
packages/core/src/ledger.ts apps/mobile/app/screens/how-paid.tsx apps/mobile/lib/payouts.ts SPEC.md
Money is shown plainly, in the member's currency, with nothing rounded in Nzinga's favour and nothing promised that the ledger does not hold.
Amounts are kept as whole minor units (cents and the like), so totals never drift through rounding, and are shown with formatMoney(minor, currency) in the server's currency.
In a conversation each person is paid only for their own speech, and only if they agreed. "Only me" is never paid and never used.
When a partner licenses recordings that include yours, part of what they pay comes back to you in proportion to your accepted minutes. It is shown separately and starts when the first licence is signed.
Rates and Minimums
| What | Development value | Rule |
|---|---|---|
| Per accepted minute | $0.20 | Rounded down to whole minor units. |
| Invite bonus | $1.00 | To the direct inviter, when an invitee's first recording is accepted. |
| Minimum payout | $5.00 | A payout can never take a balance below zero. |
These are placeholder rates for development only. Real rates are set per market before launch, and the app always shows the rate from the server rather than a number written into a screen.
Timing
Payouts through a payment partner are not built yet. The payout flow is complete on the phone, and every screen that touches a payout method or request says it is kept on this phone.