1. Who controls your data
FRIENDS Kenya is the data controller for personal data processed through the FRIENDS app and this website. For privacy questions or requests, email support@friendskenya.com.
This policy is aligned with the Kenya Data Protection Act, 2019 (KDPA). It explains what we collect, why we collect it, who we share it with and how you can exercise your rights.
2. What we collect
Account data: email address, password hash (or Google sign-in identifier), date of birth, gender, display name and account status.
Profile data: photos, bio, interests, intents and preferences you choose to share.
Location data: your town or approximate area, and coordinates you allow so we can calculate distance. Other users see a distance, not your exact location.
Activity data: swipes, matches, messages, likes, reports and blocks.
Payment data: the item bought, amount, your M-Pesa phone number, payment status and receipt reference. We never receive your M-Pesa PIN.
Device and technical data: push notification token, app version, platform, language, and limited log data such as error events. We do not log message bodies, passwords or precise coordinates in analytics.
3. How we use your data
To create your account, build your profile and show you people nearby.
To run matches, chats, notifications, safety tools and account recovery.
To take payments and keep financial records.
To review reports, prevent abuse, enforce our rules and keep the service secure.
To respond to support and privacy requests, and to meet legal obligations.
To understand how the app is used in aggregate so we can improve it.
4. Our lawful bases
We rely on performance of our contract with you for the core service, consent for optional features (such as precise location and notifications), our legitimate interests in safety, security and improvement, and legal obligation for records such as payments and tax.
You can withdraw consent at any time in Settings, though some features may stop working if you do.
5. Who we share it with
We do not sell your personal data. We share it only with service providers who help us run FRIENDS, and where the law requires it.
Supabase — database, authentication, file storage and server functions.
IntaSend — M-Pesa payment processing and payment status.
Google — sign-in, if you choose to continue with Google.
Expo, Apple and Google — delivery of push notifications on your device.
Google AdMob — only on native builds where ads are enabled, and only after any consent required on your device. Web FRIENDS does not show third-party ads in this version.
Professional advisers, regulators or law enforcement — where required by law or to protect someone’s safety.
6. Transfers outside Kenya
Some of our providers process data outside Kenya. Where that happens, we rely on the safeguards required by the KDPA, such as contractual protections and provider security commitments, and we review them as part of our vendor process.
7. How long we keep it
While your account is active, we keep your profile, matches and chats so the service works.
Messages from unmatched pairs are deleted after 30 days. Swipe impressions are deleted after 14 days.
Report evidence may be kept for up to 90 days where needed to investigate safety issues.
Payment and financial records are kept for the period required by Kenyan tax and accounting law, with your user link anonymised after account deletion.
When you delete your account, we delete your profile, photos, location, preferences, matches and chats, and your authentication record. Limited backup copies may remain for a short period before they are rotated out. Hashed identifiers may be kept if an account was banned for serious abuse.
8. Your rights
Under the KDPA you can ask for access to your data, correction of inaccurate data, deletion, restriction of or objection to processing, portability of data you provided, and withdrawal of consent. You can also ask us to stop direct marketing.
Use Settings → Download my data to request a copy, Settings → Account → Delete account to delete your account, or email support@friendskenya.com. We may need to verify your identity. We aim to respond within 30 days.
If you are not satisfied, you can complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.
9. How we protect your data
We use encryption in transit, access controls, row-level security in our database, and least-privilege access for staff and services. No system is completely secure, so use a strong, unique password and tell us immediately if you suspect a problem.
10. Cookies and local storage
Our website uses browser storage that is necessary to keep you signed in and remember your theme choice. We do not use third-party advertising cookies on the web version. See our Cookie Notice for details and controls.
11. Children
FRIENDS is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we will remove it. If you believe a minor is using FRIENDS, contact support@friendskenya.com.
12. Changes
We may update this policy as the service or the law changes. Material changes will be notified in the app or by email, and the version and date at the top of this page will be updated.