Privacy Policy

01 Interpretation and Definitions

• Personal Data — any information relating to an identified or identifiable individual.
• Transaction Data — M-Pesa SMS messages and the financial details extracted from them, including amounts, balances, transaction codes, phone numbers, merchant names, and timestamps.
• You — the individual using the App.
• Device — the Android smartphone on which the App is installed.

02 Data We Collect and How

SMS Messages (Transaction Data)

PesaSense requests permission to read SMS messages on your device. The App reads only SMS messages sent by Safaricom M-Pesa (identified by the sender ID "MPESA"). These messages contain:

• Transaction amounts and M-Pesa balance
• Transaction codes
• Sender or recipient names and phone numbers
• Merchant or business names (for till and paybill payments)
• Date and time of transactions
• Transaction fees

Categorisation and Notes

You may assign categories to transactions and add personal notes. This data is stored locally on your device.

Biometric Data

If you enable the biometric app lock feature, the App uses your device's biometric authentication system (fingerprint or face unlock). The App does not access, store, or transmit your biometric data. Authentication is handled entirely by your device's operating system.

Usage Data

The App does not collect analytics, crash reports, or usage telemetry by default. No IP addresses, device identifiers, or behavioral data are transmitted to us during normal use.

03 Optional Features That Involve Data Transmission

Community Learning (Opt-In)

If you choose to enable Community Learning in Settings, the App may upload anonymised categorisation patterns — such as which merchant names are associated with which spending categories — to improve category suggestions for all users.

Before any upload:

• Your transaction amounts, balances, phone numbers, and personal notes are never included
• Merchant names are generalised and stripped of personally identifying detail
• No data that could identify you or your transactions is transmitted

You can disable Community Learning at any time in Settings → Community Learning. Disabling it stops all future uploads immediately.

Remote Categorisation Rules (Automatic)

The App periodically fetches updated categorisation rules from our servers to improve automatic transaction categorisation. This is a one-way download — no personal or transaction data is sent to the server. The request includes only a version identifier to check whether updated rules are available.

Cloud Backup (Opt-In)

If you enable cloud backup, an encrypted copy of your transaction data is stored in your personal Google Drive account. This data is:

• Encrypted before leaving your device
• Stored in your own Google account, not on PesaSense servers
• Accessible only by you

04 Data We Do NOT Collect

• We do not collect your name, email address, or phone number
• We do not track your location
• We do not use advertising SDKs or share data with advertisers
• We do not sell your data
• We do not access SMS messages from senders other than M-Pesa
• We do not read call logs, contacts, or other device data
• We do not collect M-Pesa PINs, passwords, or authentication credentials

05 Permissions Used

The App requests only the permissions it needs. You may deny optional permissions and core functionality will continue to work.

06 How Your Data Is Used

Transaction Data processed by PesaSense is used solely to:

• Display your M-Pesa transaction history
• Calculate spending totals and balances
• Assign and suggest spending categories
• Generate analytics and spending insights visible only to you

07 Data Storage and Security

All Transaction Data is stored in a local database on your device (Room/SQLite). The App additionally supports:

• Biometric app lock — prevents unauthorised access to the App
• Encrypted preferences — sensitive settings stored in encrypted DataStore

We recommend keeping your device's screen lock enabled and your Android OS up to date.

08 Data Retention and Deletion

Your data remains on your device until you delete it. You can delete your data at any time:

• All transaction history: Settings → Clear History → Confirm

If you uninstall the App, all locally stored data is removed by Android automatically. If you enabled cloud backup, delete the backup file separately from your Google Drive.

09 Legal Compliance

Kenya Data Protection Act, 2019

We comply with the Kenya Data Protection Act, 2019:

• Lawful Processing — We process data for legitimate financial management purposes with your explicit permission
• Data Minimisation — We only collect data necessary for app functionality
• User Consent — We obtain proper permissions before accessing SMS data
• Data Security — We implement appropriate technical measures to protect your data
• User Rights — You may access, correct, or delete your data at any time within the App

10 Children's Privacy

The App is not directed at children under 13. We do not knowingly collect data from children. M-Pesa accounts require a minimum age of 18 under Safaricom's terms of service.

11 Changes to This Privacy Policy

We will update this policy when the App's data practices change. Changes will be announced via the What's New screen within the App. The "Last updated" date at the top of this policy reflects the most recent revision.

12 Contact

Questions about this Privacy Policy: