Privacy notice
Last updated: 15 October 2026
Draft for the publisher: replace every bracketed contact detail and confirm this notice against the release build and enabled services before publication. Do not submit it to Google Play with placeholders.
This notice covers the PesaPlanner website and the PesaFlow Android money-management app. “We” means [PUBLISHER LEGAL NAME], the publisher. Privacy contact: [MONITORED PRIVACY / SUPPORT EMAIL].
Website
The website uses essential browser storage to remember your language choice. That value stays in your browser. Optional Google Analytics is not loaded unless you select “Allow analytics”; if allowed, Google Analytics can use cookies and similar identifiers to measure visits and page interactions. You can reject it or reopen Cookie settings at any time. Rejecting optional analytics does not affect the site.
The pages load fonts from Google Fonts. That causes your browser to contact Google to fetch those font files, which can expose technical request data such as your IP address and browser information to Google. The site is hosted by GitHub Pages; hosting infrastructure may process standard connection/security logs. See Cookie details.
If you submit a rating or optional review through the review form, the rating, review text (if provided), and form metadata are sent to FormSubmit for forwarding to the publisher by email. You do not need to provide your name or contact details. You may optionally leave an email address if you want a reply; it is included with the submission and used for that reply. FormSubmit states that it retains submissions for up to 30 days; once forwarded, the email may remain in the publisher's mailbox until deleted. Do not include sensitive financial information.
PesaFlow app: data on your phone
PesaFlow is designed to work offline for its core features. Transactions, budgets, savings goals, bills, debts, categories, and university-profile details are stored in a local Room database on your device. App preferences are also kept locally. The app does not currently use an account or cloud sync for these records. The database is not encrypted by an app-level database-encryption layer; Android’s application sandbox and device protections apply, but they are not a promise of encryption by PesaFlow. Do not treat an app PIN as database encryption.
M-Pesa SMS and notifications
If you choose the M-Pesa SMS import feature and grant Android’s SMS permission, PesaFlow queries SMS messages from shortcode 60000 (up to the requested import limit), parses matching M-Pesa messages on the device, and saves recognized transactions to the local database. Raw SMS message bodies are not sent to PesaFlow servers by this import flow. Android grants a sensitive inbox permission, so review the in-app explanation and use Android Settings to revoke it when you wish.
If you enable the optional notification-listener service, Android gives the app access to posted notifications. PesaFlow’s listener filters for the Safaricom M-Pesa app and tries to parse transaction text locally. Notification content is not uploaded by this feature. Disable access in Android notification-access settings at any time.
Files and exports
When you make a backup or CSV export, the app creates a readable file containing financial information. You choose whether to share it with another app or save it elsewhere. Anyone who receives or can access that file may read it; their handling is outside PesaFlow’s control. Keep exports in a secure location and delete copies you no longer need. Android automatic app backup is disabled in the current manifest, but this does not delete files you manually exported.
Optional subscriptions and payments
Paid subscriptions are not active until the publisher configures plans and service credentials. If enabled, the app sends a recovery-key value and the phone number entered for checkout to the PesaFlow subscription service over HTTPS. The service stores hashes of the recovery key and normalized phone number, plan and amount, payment state and timestamps, Daraja checkout identifiers, and (after successful payment) an M-Pesa receipt number. The service sends the checkout phone number and payment details to Safaricom Daraja to initiate and verify payment. Safaricom and infrastructure providers process data under their own terms. The subscription service does not receive your local transaction history, budgets, or SMS contents. The backend currently has no self-service account deletion route; subscription-data deletion requests must be sent to the privacy contact above. Payment/accounting records may need to be retained where law requires; the publisher must set and disclose a concrete retention schedule before enabling payments.
Sharing, international processing, and retention
We do not sell personal information. Data is shared only with service providers needed to host the site, provide analytics when you opt in, or operate a subscription/payment flow when enabled, and where law requires. These providers may process information outside Kenya; the publisher must assess applicable safeguards and cross-border-transfer duties before enabling a service. Local app data remains until you delete it, clear app storage, or uninstall the app. Exported copies remain wherever you or a recipient saved them. The backend payment records remain until deleted under the publisher’s retention process or retained as required by law.
Your choices and requests
You can reject or withdraw website analytics consent using Cookie settings. In the app, delete records through available app controls, or clear app storage/uninstall. This removes local app data but does not remove user-created export files or (if subscriptions are enabled) server-side payment records. Contact the privacy email above for access, correction, deletion, objection, or other privacy requests. We will verify requests reasonably before acting.
Children, security, and changes
PesaFlow is not designed for children under 13, and the publisher should confirm intended age groups in Play Console. We use HTTPS for configured subscription network calls and disable Android automatic backup and cleartext traffic in the current app manifest. These safeguards do not make the app or exported files risk-free; app-level database encryption and stronger PIN storage are release improvements still required. We will update this notice when data practices change.