Security & Data Protection Policy

Part I — Security Policy

This policy explains how Concept Initiative Uganda ("we", "us") secures VCNT, Two-Way Broadcaster and this website. It applies to the VCNT Android application, the Two-Way Broadcaster application for Windows, and all pages served on getvcnt.com. We design our products so that your events, media and personal data stay under your control.

1. Local-Network-First Architecture

VCNT and Two-Way Broadcaster are built on a LAN-first (local area network) architecture. Live video, presentations and screen content are exchanged directly between the broadcaster's computer and viewers' devices over the event's own Wi-Fi or wired network — they do not pass through our servers or the public internet. Two-Way Broadcaster runs its own embedded streaming server on the presenter's machine, so there is no cloud media relay to compromise, and broadcasts continue working even with no internet connectivity.

2. Signed Service Discovery

To help viewer devices find the broadcaster automatically, Two-Way Broadcaster announces itself on the local network using UDP broadcast beacons. Every beacon is cryptographically signed with HMAC-SHA256 using a per-installation key and carries a timestamp. VCNT verifies each beacon's signature and timestamp freshness before accepting it, and discards unsigned, malformed, stale or replayed beacons as a security alert. This prevents rogue devices from impersonating a broadcaster on the venue network.

3. Hardened Session Token Service

Viewers join a broadcast using short-lived access tokens issued by the broadcaster's built-in token service, which enforces the following protections:

• Rate limiting per device to prevent token-request flooding.
• Requests are only accepted from private (LAN) network origins.
• The broadcaster's own session identity is reserved and can never be claimed by a viewer, protecting the presenter against session hijacking.
• Viewer identities are strictly validated and generated to be collision-free, so one viewer can never disconnect or impersonate another.
• An HTTPS-capable mode is available for deployments that require encrypted token exchange.

4. Platform Hardening

We apply platform-level security controls to each product:

• VCNT (Android): sensitive values are stored in Android's encrypted, Keystore-backed storage; the app's network security configuration blocks unencrypted traffic; app data is excluded from device cloud backups; and permissions (storage, microphone, recording) are requested at runtime only when you use the related feature.
• Two-Way Broadcaster (Windows): the app runs with Electron's security sandbox enabled, context isolation on, Node.js integration disabled in renderer pages, and web security enforced. Logs are written locally on the operator's machine only.
• getvcnt.com: the site is served over HTTPS, and downloadable installers are delivered with forced-download and MIME-sniffing protection headers.

5. Account Security

VCNT accounts are managed through Firebase Authentication, supporting email/password, phone number verification (one-time PIN) and Google Sign-In. Password resets are only sent to the verified email address on the account. Application logs automatically mask personal identifiers (email addresses, phone numbers and user IDs) before being written, so support and diagnostic logs never contain your full personal details.

6. Payment Security

We never collect or store card numbers. Google Play purchases are processed entirely by Google Play Billing, and mobile money payments for subscriptions are processed by PawaPay, our licensed payment partner. Payment requests from the app are authenticated with short-lived identity tokens and carry idempotency keys, which prevent accidental duplicate charges.

7. Secure Software Updates

VCNT updates are distributed through Google Play. Two-Way Broadcaster checks for updates only over an HTTPS connection to getvcnt.com, and Microsoft Store builds are updated through the Store's own signed update channel. We recommend always keeping both apps updated to receive the latest security improvements.

8. Reporting Security Vulnerabilities

We welcome responsible disclosure of security issues. If you believe you have found a vulnerability in VCNT, Two-Way Broadcaster or this website, please report it to admin@getvcnt.com with enough detail for us to reproduce and investigate. Please give us a reasonable opportunity to fix the issue before public disclosure. We do not pursue legal action against good-faith researchers who respect user privacy and avoid service disruption.

Part II — Data Protection Policy

This policy explains what personal data our products process, why, how it is protected, and the rights you have. It is prepared in alignment with the Data Protection and Privacy Act, 2019 (Uganda).

1. Data We Process

• Accounts: if you create a VCNT account, we process your email address or phone number, your display name, and a random user identifier assigned by Firebase Authentication.
• Subscriptions and payments: to activate a subscription we process your subscription status and expiry date. For mobile money payments, your phone number and payment amount are passed to PawaPay solely to initiate the charge you requested. Google Play purchases are verified with Google; we do not see your payment credentials.
• Product analytics: we collect anonymized usage events (for example, feature use and app performance) through Firebase Analytics to improve the product. These events are not tied to your broadcast content.
• Website: getvcnt.com uses Firebase Analytics. If you submit an account deletion request or contact message, we receive the details you provide in the form. Download pages may determine your country (at country level only, never your precise location) to provide the correct installer and compile aggregate download statistics.
• Your media: screenshots and recordings you capture in VCNT are saved directly to your device's own storage. They are never uploaded to us.
• Broadcast content: the video, slides and screen content you broadcast stay on your local network. We cannot see, record or access them.

2. What We Never Do

• We never sell, rent or trade your personal data.
• We never use your personal data for third-party advertising or profiling.
• We never access your screenshots, recordings or broadcast content.

3. Data Minimization and Purpose Limitation

Our products are designed to work offline and on local networks, so by design they collect as little data as possible. We only process personal data for the specific purposes described in this policy — providing the service you requested, processing payments you initiate, securing our systems, and improving the product. We do not repurpose your data for unrelated uses.

4. Storage and Security of Personal Data

Account data is stored by Google Firebase in its protected infrastructure, protected by access controls and encryption in transit and at rest. Sensitive values on your device (such as your saved username) are held in Android's Keystore-backed encrypted storage and are excluded from device cloud backups. Payment records held by our payment partners are protected under their own security programs. Broadcast logs remain on the broadcaster's local machine, under the operator's control.

5. Third-Party Processors

We rely on a small number of reputable processors, each bound by their own privacy and security terms:

• Google (Firebase): authentication, analytics, and storage of account deletion requests.
• Google Play Billing: processing of in-app purchases and subscriptions on Android.
• PawaPay: processing of mobile money subscription payments.
• Web3Forms: delivery of website form submissions to our team.
• Netlify: hosting of getvcnt.com.
• Microsoft Store: distribution and updating of Two-Way Broadcaster.

6. Data Retention

We keep account data for as long as your account is active. Payment and subscription records are retained for as long as required for accounting and to honour subscription entitlements. Analytics events are retained according to our Firebase retention settings. Account deletion requests are kept only to verify and process your request. Local logs on your device or broadcaster machine remain until you or the operator delete them.

7. Your Rights

You have the right to access, correct and delete your personal data, and to withdraw consent at any time. You can request account deletion at any time through the Account page on this website or from within the app, or by contacting us. Deleting your account removes your profile data; content already saved on your device remains yours to keep or delete. To exercise any other right, contact us at conceptinitiative1@gmail.com and we will respond within a reasonable period.

8. Children

Our products are intended for general audiences at events and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

9. Data Breach Notification

If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify affected users and the relevant authorities as required by applicable law, and will take reasonable steps to contain and remediate the breach.

10. Changes to This Policy

We may update this policy from time to time to reflect changes in our products or legal requirements. The latest version is always available on this page, and material changes will be highlighted in the app or on this website.

11. Contact

Questions about this Security & Data Protection Policy can be sent to admin@getvcnt.com or through our contact page. Concept Initiative Uganda, Kampala, Uganda.