Chukua is an app for giving away things you don't need to people nearby in Nairobi. This policy says what we collect, why, who else handles it, and how you control it. It is written to meet the Kenya Data Protection Act, 2019.
What we collect
- Account: your email address. If you sign in with Google, we receive your Google account's email, name and profile photo, and nothing else. We never see your Google password.
- Profile: the name you choose, an optional profile photo, and the phone number you add for pickups.
- Location: when you allow it, your phone's location, used to show items near you and to set the pickup spot of things you list. We don't track you in the background or keep a location history.
- Listings: the photos, descriptions and pickup spot of the things you give away.
- Claims and chat: what you claim, its status (including "on my way"), the M-Pesa confirmation code when a fee applies, and the messages you exchange with the other person about a pickup.
- Notifications: if you turn on alerts, a push token for your phone and the area and radius you want alerts for.
- Safety: reports you file, and missed pickups, which can pause claiming for a while.
- Early access: if you join the test list, your email address and your consent to receive Chukua testing updates.
Who sees what
- On your listings, other people see your first name, profile photo, the month you joined, and the area, never your email.
- The exact pickup spot and your pickup phone number are shown only to the person whose claim on that item is confirmed. Everyone else sees an approximate area (about 500 m).
- Chat messages are visible only to the giver and taker of that claim.
Why we use it
To run the service you asked for: signing you in, showing nearby items, letting you list and claim, arranging pickups, sending alerts you turned on, and keeping the community safe (claim limits, missed-pickup pauses, reports). We do not sell your data, show ads, or use it to profile you for anyone else.
Who processes it for us
- Supabase (database, sign-in and photo storage; servers in Frankfurt, Germany).
- Google (Google sign-in if you use it, and Firebase Cloud Messaging to deliver notifications).
- Gmail (sends your 6-digit sign-in code).
- OpenStreetMap (map images; your phone requests them directly, with no account).
- Cloudflare and GitHub (host this website and the app download).
- FormSubmit (sends early access signups to our contact inbox and keeps submissions in its archive for up to 30 days).
Some of these are outside Kenya. We use them under their standard data protection terms.
How long we keep it
App data is kept as long as your account exists. Listings expire on the date you set. When you delete your account, your profile, photos, listings and push tokens are deleted, and your claims and messages are removed from your account. Early access emails are kept in our contact inbox until you opt out or ask us to delete them; FormSubmit keeps its submission archive for up to 30 days. Records we must keep for fraud or legal reasons (for example M-Pesa payment references) are kept only as long as required.
Your rights and controls
- See and download your data: Profile → Data & privacy → Download your data.
- Correct it: Profile → Personal info.
- Delete your account: Profile → Data & privacy → Delete account. It takes effect immediately.
- Turn off location or alerts at any time in the app or your phone's settings.
- Opt out of early access emails or request deletion: email e4ruthless@gmail.com.
- You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).
Children
Chukua is not for anyone under 18.
Changes
If we change this policy in a way that matters, we'll say so in the app before it takes effect.
Contact
Questions or requests: e4ruthless@gmail.com.