Privacy Policy

The short version

FARAGHA is built so that we, CLICKMTAA, never see your M-PESA messages, your receipts, your balance, or your contribution records. All of that stays on your own device. The only information that ever reaches our servers relates strictly to paying for the optional Business tier subscription. This policy explains exactly what that means in detail.

1. Information we do NOT collect

To be specific, because this is the core of how FARAGHA is built:

• We do not receive, transmit, or store the content of any M-PESA message you paste or share into FARAGHA
• We do not receive, transmit, or store any receipt FARAGHA generates
• We do not know your M-PESA balance, ever, at any point
• We do not receive your tags, contribution records, or group report contents
• We have no user accounts, so we do not hold a general profile of you

All of the above is generated and stored only in your browser's local storage (IndexedDB), on your own device. There is no server-side database containing this information — not "we don't look at it," but "it is architecturally never sent to us at all."

2. Information we DO collect

Only in connection with an optional Business tier subscription payment:

• Your phone number, submitted by you when initiating an M-Pesa STK Push payment, and passed to Safaricom to process that payment
• Payment status records: a Safaricom-issued transaction reference (CheckoutRequestID), payment amount, and outcome (success/failed), stored temporarily (for about 24 hours) to complete the payment flow
• License records: a license key, its active/expired status, and expiry date, so we can confirm your subscription is valid. This is not linked to any receipt or transaction content.
• M-Pesa receipt number, if provided by Safaricom's payment callback, for your own payment record-keeping

We do not collect your name, email address, device identifiers, browsing history, or location.

3. How we use this information

Solely to: process your Business tier subscription payment, verify your subscription is active when the app checks, and resolve payment issues (for example, if Safaricom's payment confirmation is delayed, we may query Safaricom directly to confirm your payment went through, using only the transaction reference — never any receipt content, since we never have any).

We do not use this information for advertising, do not sell it, and do not share it with anyone except Safaricom, as necessary to process the payment itself.

4. Third parties

• Safaricom (M-Pesa Daraja API) — processes the actual payment when you subscribe to Business tier. Safaricom's own privacy practices govern how they handle your phone number and payment data on their end; see Safaricom's privacy policy for that.
• Cloudflare — hosts the FARAGHA application and the small backend that talks to Safaricom. Cloudflare may process technical data (like IP addresses) as part of ordinary web hosting, under their own privacy policy.

We do not use analytics, advertising, or tracking third parties.

5. Data stored on your own device

FARAGHA uses your browser's local storage mechanisms:

• IndexedDB — stores your receipts, tags, and license status. This is the bulk of FARAGHA's data and never leaves your device unless you explicitly export a backup file yourself.
• localStorage — stores minor UI preferences (like whether you've dismissed an install prompt). Contains nothing sensitive.

If you use FARAGHA's backup/export feature, the resulting file is saved directly by your browser to your own device — we have no visibility into or access to that file, where you save it, or where you send it.

Clearing your browser data, or uninstalling FARAGHA, will delete this locally stored information. We cannot recover it, because we never had a copy.

6. Data retention

• Payment status records: automatically deleted after approximately 24 hours, once no longer needed to complete a payment flow
• License records: retained for as long as needed to verify subscription status; not linked to any usage or transaction content
• Data on your device: retained until you delete it, clear your browser data, or uninstall the app

7. Your rights under Kenyan law

Under the Data Protection Act 2019, you have the right to:

• Be informed of how your data is used (this policy)
• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing of your data
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe we have mishandled your data

Because we hold so little data about you (see Section 2), most requests can be resolved simply by telling us your phone number and/or license key so we can locate and act on the relevant records. Contact us via WhatsApp (0118 058190) or [email protected] for any of the above.

8. Children's privacy

FARAGHA is not directed at children and we do not knowingly collect information from children.

9. Security

Because receipt and transaction content never reaches our servers, the most sensitive information about your finances is protected simply by never existing outside your own device. The limited payment/license data we do hold is stored using Cloudflare's Workers KV storage, accessed only by FARAGHA's own backend functions.

10. Changes to this policy

We may update this policy as FARAGHA changes. Material changes will be noted with an updated "Last updated" date above.

11. Contact

Questions about this policy, or to exercise any of the rights above: WhatsApp 0118 058190 or [email protected]