The anonymous visitor cookie
The first time you affirm an entry or open the Elder chat, we set one cookie: a random, meaningless identifier with no name, email, or account attached to it, valid for a year. It exists only so the site can tell “the same browser affirmed this entry already” and so a chat conversation stays yours across a page reload. It cannot be used to identify you, and we never try.
What disputes and affirmations store
An affirmation(“yes, this is how we hold it”) stores the visitor cookie above, plus a same-day hash of your IP address (a scramble of the address and the date, so it cannot be reversed and cannot be linked to the same visitor a day later) as a second, lightweight check against abuse. Nothing else.
A dispute(“we do it differently”) stores the message you write and, only if you choose to leave one, a way to contact you back. The contact field is entirely optional and used only if a moderator needs to follow up on your correction; it is never published or shared.
Disputes themselves are never deleted, on purpose: disagreement is part of the record, not a support ticket to be closed and forgotten. What does go away is detailed below.
Search logging
When a search on the site returns nothing, we log the search term, how many results it returned, and which part of the site it happened on (the customs library, the name decoder, or the guide). No visitor cookie, no IP address, nothing that identifies who searched. This is purely how we find the gaps in the corpus worth researching next.
Retention: what goes away, and when
A monthly job enforces three rules, automatically:
- Search logs older than 18 months are deleted.
- A dispute’s optional contact detail is cleared 12 months after the dispute is resolved (the dispute’s own text stays, as explained above).
- Elder chat conversations with no activity for 12 months are deleted entirely.
The Android app
Everything above applies to the app too, and the app is deliberately quieter than the site. The whole library ships inside it, so browsing, reading and searching happen on your phone: no request goes out, and nothing you search for is sent anywhere or logged. There is no search logging from the app at all, because there is no search request. The Guide is the same. The countries and peoples you pick, and the occasion you say you are standing in, never leave the device; the ranking runs there.
The app reaches the network for four things and nothing else: to check which entries have earned a higher trust tier or been withdrawn, to load a photograph, to affirm or dispute an entry, and to ask the Elder. Those requests carry the same anonymous visitor cookie described above, kept by the phone instead of a browser, and everything said about affirmations, disputes and chats applies to them unchanged.
There is no account and no login, for the same reason there is none on the site. There is also no analytics, no advertising identifier, no crash reporter, and no third-party SDK of any kind in the app: not turned off, not present.
On heritage, culture, and what counts as personal information
South Africa’s POPIA treats a person’s race, ethnic origin, and beliefs as special personal information deserving extra care. It is worth being precise about what uVelaphi actually handles: the corpus itself is a public record of cultural practices and the meanings of names, sourced, cited, and corrected in the open, the same way an encyclopedia or a library catalogue is. It is not personal information about you. We do not ask which culture is yours, do not infer it from what you read, and do not attach any visitor’s identity to any entry, people, or tradition. Reading about a custom, or affirming that your family holds it a certain way, never becomes a record of your own heritage in our systems, only a record that an anonymous browser affirmed an entry.
Questions
If something here is unclear, the same “know better? put us right” invitation on every entry works for questions about this page too: dispute it, and a person will read it.