Privacy policy
Raw lookup details are not saved in our application database. Security hashes, operational logs and administrative audit logs have separate retention periods.
The short version
We do not save raw ID numbers, cellphone numbers or status results in our application database. Keyed security hashes, request counters and operational logs are retained separately; see our data-handling explanation. Here is everything we do keep, in one list.
- We do not save raw ID numbers, cellphone numbers or status results in our application database. Keyed security hashes, request counters and operational logs are retained separately; see our data-handling explanation.
- Keyed, one-way hashes of the IP address and applicant ID, with request counters. Counters expire after 10 minutes; Firestore TTL deletion happens asynchronously after expiry. Google Cloud request and error logs can include IP address, request URL, time, status, latency and user agent. Our application does not log request bodies or status results. The default operational log bucket retains records for 30 days; separate administrative audit logs have a 400-day retention period.
- The default Google Cloud operational log bucket has 30-day retention; the separate administrative audit log bucket has 400-day retention.
- SassaCheck uses Google AdSense to display advertising. Google and its advertising partners may use cookies or similar technologies and process IP addresses, browser/device information and ad interactions for advertising, measurement and fraud prevention. We do not send status-form ID numbers, cellphone numbers or results to AdSense. We do not use a separate Google Analytics tag.
- Correspondence may be retained to handle your enquiry and meet applicable recordkeeping obligations. Contact hello@sassacheck.org.za to request access, correction or deletion; do not send ID numbers, OTPs or bank details.
- SassaCheck uses Google AdSense to display advertising. Google and its advertising partners may use cookies or similar technologies and process IP addresses, browser/device information and ad interactions for advertising, measurement and fraud prevention. We do not send status-form ID numbers, cellphone numbers or results to AdSense. We do not use a separate Google Analytics tag.
- You can ask us to delete anything you have sent us. See delete my data.
Learn how Google uses information and manage advertising choices: Google partner-site data use · Google My Ad Center
What happens when you check your status
Your ID number and cellphone number go to SASSA and the answer comes straight back to your screen. Security counters and hosting logs are retained separately; raw lookup details are not saved in the application database.
- You type your ID number and cellphone number into the form on our home page.
- Your browser sends them over an encrypted connection to
our Johannesburg-hosted Google Cloud Run API. - That service passes them to SASSA's public SRD status service, the same one behind srd.sassa.gov.za.
- SASSA's answer comes back to the service and straight to your screen.
- The form holds the result in the current page memory. It does not write the result to cookies, local storage or session storage. Reloading or closing the page clears that page state; browser history, autofill and device behaviour remain under your control.
- The home-page checker processes your ID number and cellphone number through our server to retrieve your result from SASSA. It does not save the raw ID, phone number or result in its application database. Separate security counters and hosting logs are retained as described in our privacy policy.
The form displays a consent notice. Pressing Check my status submits the details for that lookup; there is no consent checkbox.
The home-page checker processes your ID number and cellphone number through our server to retrieve your result from SASSA. It does not save the raw ID, phone number or result in its application database. Separate security counters and hosting logs are retained as described in our privacy policy.
What we do keep, and for how long
The table distinguishes security records from the raw status-check details.
| What we keep | Why | How long |
|---|---|---|
| Keyed, one-way hashes of the IP address and applicant ID, with request counters | Rate limiting, so nobody can use this tool to guess other people's ID numbers | Counters expire after 10 minutes; Firestore TTL deletion happens asynchronously after expiry. |
| Operational hosting logs, including connection metadata and IP addresses | Security and uptime | 30 days for the default operational log bucket |
| Administrative audit logs (Google Cloud) | Records of administrative actions, separate from status-result storage | 400 days in the required audit-log bucket |
| Anything you email us | Replying to you | For handling the enquiry and any applicable recordkeeping obligations; contact us to request deletion. |
The lookup does not save raw ID numbers, phone numbers or status results in the application database. Information you put in an email is handled separately. We never ask for your bank card number, your PIN, your password or an OTP, and no field on this site accepts one.
If you use a link in this policy, the page you land on is served by us and the same rules apply. If you click through to srd.sassa.gov.za, you are on SASSA's site and SASSA's rules apply, not ours.
Why we use your IP address
Your IP address is processed for rate limiting, network delivery and hosting security logs.
Every request to a server carries an IP address. Without limits, someone could use our proxy to try thousands of ID numbers and cellphone numbers and learn things about people. The rate limit is the control that stops that, and the rate limit needs your IP address to work.
Keyed, one-way hashes of the IP address and applicant ID, with request counters. Counters expire after 10 minutes; Firestore TTL deletion happens asynchronously after expiry. Google Cloud request and error logs can include IP address, request URL, time, status, latency and user agent. Our application does not log request bodies or status results. The default operational log bucket retains records for 30 days; separate administrative audit logs have a 400-day retention period.
The proxy also caps how many checks one IP address and one ID number can make. If you hit the limit, it stops and points you at srd.sassa.gov.za. That is the limit doing its job.
Analytics and advertising
SassaCheck uses Google AdSense to display advertising. Google and its advertising partners may use cookies or similar technologies and process IP addresses, browser/device information and ad interactions for advertising, measurement and fraud prevention. We do not send status-form ID numbers, cellphone numbers or results to AdSense. We do not use a separate Google Analytics tag.
We do not use an analytics provider. We do not show ads. We do not use tracking pixels, fingerprinting scripts or social media buttons that load from another company's server. We do not sell your personal information, and we do not share it with anyone to use for their own purposes.
Your rights under POPIA
POPIA gives you the right to know what personal information we hold about you, and to ask us to correct or delete it.
- Ask what we hold. Email us and we will tell you what is there. In most cases the answer is nothing.
- Ask us to correct it. If something we hold about you is wrong, tell us and we will fix it.
- Ask us to delete it. The route and the response time are on delete my data.
- Object to how we use it. Tell us what you object to and we will look at it.
- Complain to the Information Regulator of South Africa. You do not need our permission to do that.
Here is the lawful basis for each thing we do, in plain language and with the POPIA section.
| What we do | What it involves | Why we are allowed to |
|---|---|---|
| Check your SRD status | Your ID number and your cellphone number | You agree, per check, by pressing Check my status after reading the consent notice (POPIA s11(1)(a)) |
| Stop abuse | A salted, one-way hash of your IP address | Legitimate interest (POPIA s11(1)(f)) |
| Keep the site safe and running | Time, path, HTTP status, IP address | Legitimate interest (POPIA s11(1)(f)) |
| Reply to your email | Your email address and your message | You agree by emailing us (POPIA s11(1)(a)) |
You give consent for a status check by pressing Check my status after reading the consent notice on the form. If you do not want to give it, do not submit the form. You can check on srd.sassa.gov.za instead, without us. The full lawful basis table, the retention schedule, our sub-processors and our cross-border statement are on POPIA and the Information Regulator.
How to ask us to delete your data
Email hello@sassacheck.org.za and tell us what you want deleted. We reply within two business days.
Correspondence may be retained to handle your enquiry and meet applicable recordkeeping obligations. Contact hello@sassacheck.org.za to request access, correction or deletion; do not send ID numbers, OTPs or bank details.
We will tell you what we found, what we deleted, and what we could not delete and why. We will not quietly ignore a request. Delete my data has the full route.
Who runs SassaCheck
SassaCheck is an independent website. We are not SASSA and we are not a government body.
Operator, registration and Information Officer details are available on request. Contact us at hello@sassacheck.org.za.
We cannot approve, decline, suspend or change any grant. We cannot change your banking details. We cannot see inside SASSA's systems, and we cannot tell you why a status is what it is when SASSA does not publish a reason. If you want to deal with SASSA directly, the numbers, the WhatsApp line and the email address are on the SASSA contacts page on this site, with the date we last checked them.
If you think this site is impersonating SASSA, tell us at the address above. We will answer. You can also read who runs this site and why our domain contains "sassa".
Changes to this policy
We will update this page whenever what we do with your information changes, and the review date at the bottom will change with it.
We will not make a change to how your information is handled and leave this page describing the old version. If a change matters, it gets a line on corrections.
Questions people ask
These are the answers to the questions we get most about this page.
Do you store my ID number?
We do not save raw ID numbers, cellphone numbers or status results in our application database. Keyed security hashes, request counters and operational logs are retained separately; see our data-handling explanation. Browser developer tools show where requests go; they cannot establish what a server retains.
Can you see my status after I close the tab?
The form holds the result in the current page memory. It does not write the result to cookies, local storage or session storage. Reloading or closing the page clears that page state; browser history, autofill and device behaviour remain under your control.
Do you sell my information?
SassaCheck uses Google AdSense to display advertising. Google and its advertising partners may use cookies or similar technologies and process IP addresses, browser/device information and ad interactions for advertising, measurement and fraud prevention. We do not send status-form ID numbers, cellphone numbers or results to AdSense. We do not use a separate Google Analytics tag.
Do you use cookies?
The form holds the result in the current page memory. It does not write the result to cookies, local storage or session storage. Reloading or closing the page clears that page state; browser history, autofill and device behaviour remain under your control.
What if I emailed you?
Correspondence may be retained to handle your enquiry and meet applicable recordkeeping obligations. Contact hello@sassacheck.org.za to request access, correction or deletion; do not send ID numbers, OTPs or bank details.
What if I would rather not use SassaCheck at all?
Then use SASSA directly. The same check is at srd.sassa.gov.za (opens srd.sassa.gov.za in a new tab). It costs nothing and you do not need us.
Sources
This page describes what SassaCheck does. Where it refers to the law, it refers to the sources below.
- Protection of Personal Information Act (POPIA), section 11, lawful basis for processing. Information Regulator of South Africa. Checked 29 October 2026.
- SASSA SRD status service, srd.sassa.gov.za (opens in a new tab). Checked 29 October 2026.
- SassaCheck data flow and retention practice, described in full on how it works and POPIA and the Information Regulator. Checked 29 October 2026.
If any of these links no longer work, tell us and we will fix it.
Last reviewed: 29 October 2026
Status-check data and security records
Your ID number and cellphone number are sent over HTTPS through our server to SASSA to retrieve your status. Our checker does not save the raw ID number, cellphone number or result in its application database, and its application logging code does not record those values. The result is held in the current page memory, without saving it to cookies, localStorage or sessionStorage. For rate limiting, keyed hashes of your IP address and applicant ID are stored with request counters; their expiry is set to 10 minutes after an allowed request, and Firestore deletes expired records asynchronously. Google Cloud request logs can contain your IP address and connection metadata: the default operational log bucket retains records for 30 days, while the separate administrative audit log bucket retains records for 400 days. These audit logs are administrative records, not a 400-day database of status results. Google AdSense may use cookies and process IP, device and ad-interaction data; our code does not send status-form details or results to AdSense. We do not use a separate Google Analytics tag. See our Privacy Policy for details.
Keyed, one-way hashes of the IP address and applicant ID, with request counters. Counters expire after 10 minutes; Firestore TTL deletion happens asynchronously after expiry.
Google Cloud request and error logs can include IP address, request URL, time, status, latency and user agent. Our application does not log request bodies or status results. The default operational log bucket retains records for 30 days; separate administrative audit logs have a 400-day retention period.
The form holds the result in the current page memory. It does not write the result to cookies, local storage or session storage. Reloading or closing the page clears that page state; browser history, autofill and device behaviour remain under your control.
SassaCheck uses Google AdSense to display advertising. Google and its advertising partners may use cookies or similar technologies and process IP addresses, browser/device information and ad interactions for advertising, measurement and fraud prevention. We do not send status-form ID numbers, cellphone numbers or results to AdSense. We do not use a separate Google Analytics tag.