Privacy Policy

Effective 29 September 2026. Controller: Koda Digital Ltd, Nairobi, Kenya, and Koda Digital Inc, United States.

What we collect

Account: phone number, name, optional email, whether you pay by M-Pesa or card, sign-in codes (kept for 10 minutes).
Campaigns: titles, descriptions, an optional photo, goal, dates, and the payout number or account you give.
Contributions: amount, currency, time, the M-Pesa number or the card processor's reference, and any message you attach. We never see or store card numbers; Paystack and Stripe handle them.
Messages: group chat and guest book entries, with your name.
Device: a push notification token if you allow notifications, and your IP address in server logs for security and rate limiting.

What we do not collect

No contacts, no location, no advertising identifiers, no tracking across other apps or sites. Photos are only read when you choose one for a campaign.

Why we use it

To run campaigns, move money, show the group who gave, tell organisers about gifts and reports, keep the service secure, and meet legal obligations such as payment records. We do not sell personal data and we do not use it for advertising.

Who we share it with

Safaricom (M-Pesa), Paystack and Stripe to process payments; Expo to deliver push notifications; Africa's Talking to send sign-in codes by SMS; Railway, which hosts our servers. Each receives only what it needs. Other members of a campaign see your name and, unless the organiser hides amounts, what you gave. Guests with a campaign link see guest book messages.

Where it is kept and for how long

Data is stored on servers in the United States operated by Railway, and in Kenya with Safaricom. Payment records are kept for 7 years as the law requires. Everything else is deleted when you delete your account, except that your name on past gifts becomes "Deleted user".

Your choices

Delete your account in the app: Profile → Delete account. Or email [email protected] from the phone number's email and we do it within 30 days.
Notifications: turn them off in your phone's settings.
Anonymous giving: hide your name from the group when you contribute.
Access and correction: email us and we will send what we hold about you or fix it.

Children

mPawa is for adults. We do not knowingly collect data from anyone under 18.

Contact

[email protected]. Kenyan users may also complain to the Office of the Data Protection Commissioner.

This document is a draft prepared for legal review before launch.