1. Who We Are
Twendetribe (“we”, “our”, or “us”) operates the Twendetribe mobile application and website (twendetribe.africa) — a platform that helps groups of people organise trips, split costs transparently, and capture shared memories.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the choices you have. By creating an account or using Twendetribe, you agree to the practices described here.
2. Information We Collect
2.1 Information you provide
- Account details — your name, email address, and phone number when you register.
- Profile — optional display name, profile photo, and home area.
- Trip content — trip title, destination, dates, description, cover photo, itinerary, cost line items, inclusions/exclusions, packing lists, policies, and other details you choose to add.
- Photos & journal entries — images and text you upload to a trip's shared album or journal.
- Messages — text you send in a trip's group chat.
- Payment references — paybill, till, or other collection details and account reference an organiser registers for a trip. We do not collect payment PINs, full card numbers, or bank credentials.
- Reviews — ratings and comments you leave after a trip.
- Support communications — messages you send us by email.
2.2 Information collected automatically
- Device & app data — device model, operating system version, app version, language, and time zone.
- Usage data — pages and features you access, timestamps, and actions taken (e.g. creating a trip, uploading a photo).
- FCM push token — a Firebase Cloud Messaging token to deliver push notifications to your device.
- IP address — logged by our server for security and abuse prevention.
2.3 Location data
When you add a meeting point or destination to a trip, you may optionally share geographic co-ordinates or a place identifier. We do not track your real-time location in the background.
2.4 Information from third parties
If you sign in with Google, we receive your Google account name and email address. We do not receive your Google password or payment methods.
3. How We Use Your Information
We use the information we collect to:
- Create and manage your account and authenticate you.
- Enable you to create, join, and manage group trips.
- Display trip details, cost splits, itineraries, and member lists to authorised trip members.
- Facilitate contribution tracking and cost-split calculations. (We display transaction data; we do not process or hold funds.)
- Send you notifications about trips you are involved in — changes to dates, new members, payment reminders, and similar updates — subject to your in-app preferences.
- Deliver transactional emails (OTP verification, password reset, reminders).
- Provide customer support.
- Detect and prevent fraud, abuse, and security incidents.
- Improve the platform, diagnose bugs, and understand feature usage.
- Comply with legal obligations.
We do not use your data to serve third-party advertising, build advertising profiles, or sell your information to any third party.
4. Sharing Your Information
4.1 With other trip members
Your name, profile photo, and phone number are visible to other confirmed members of trips you join. Trip content you create (photos, journal entries, chat messages, itinerary items) is visible to all confirmed members of that trip. Cost data (how much each person owes and has contributed) is visible to the trip organiser and co-organisers, and, in aggregate, to all members.
4.2 With circles
If a trip is linked to a Twendetribe “circle” (a recurring group of travellers), the circle owner and admins can see that the trip exists and its basic details. Trip-level financial data and member phone numbers are not shared with the wider circle.
4.3 Public discovery
If you mark a trip as Open and publish it to discovery, a limited preview (title, destination, dates, cover image, organiser first name, activity tags, price estimate, and available spots) becomes visible to any signed-in Twendetribe user browsing the discover feed. Your phone number and the member roster are never included in public previews.
4.4 Service providers
We share data with trusted processors who help us operate the platform:
- Google Firebase (FCM) — push notification delivery.
- Zoho Mail — transactional email delivery (OTP, password reset, reminders).
- VPS hosting provider — servers on which the application and database run.
- Amazon Web Services (S3) — optional cloud storage for uploaded media (when configured).
These providers are contractually prohibited from using your data for any purpose beyond providing their services to us.
4.5 Legal requirements
We may disclose your information if required by law, court order, or a valid government request, or to protect the rights, property, or safety of Twendetribe, its users, or the public.
4.6 Business transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.
5. Payments & Financial Data
Where a contribution is made via M-Pesa, that transaction is governed by Safaricom’s own terms and privacy policy. We encourage you to review those separately.
Contribution and disbursement records are retained for the life of the trip and a reasonable period thereafter to allow for dispute resolution, in accordance with applicable financial record-keeping requirements.
6. Photos, Memories & Media
Photos you upload (trip cover images, shared album photos, disbursement receipts) are stored on our servers or, if configured, in Amazon S3. They are accessible to confirmed members of the relevant trip.
We do not use your photos to train machine-learning or AI models. We do not perform facial recognition on uploaded images.
You retain ownership of photos you upload. By uploading, you grant Twendetribe a limited, non-exclusive licence to store, display, and transmit the photo within the platform solely for the purpose of operating the service. When you delete a photo or your account, we delete the file from our servers (subject to the backup retention period below).
7. Push Notifications
We use Firebase Cloud Messaging (FCM) to send push notifications to your device. These include: trip update alerts, new member notifications, payment reminders, and system messages from the platform.
You can disable push notifications at any time in your device settings or within the Twendetribe app under Notification Preferences. Disabling push notifications does not affect transactional emails (such as OTP codes and password resets).
Your FCM device token is stored on our servers and used solely to route notifications to your device. It is deleted when you sign out or delete your account.
8. Location Data
Twendetribe does not request continuous or background access to your device’s location.
Location information is only used when you voluntarily type or search for a meeting point, destination, or departure point for a trip. Any co-ordinates derived from a place search are stored as part of the trip record and are visible to confirmed members of that trip.
9. Data Retention
- Active account data is retained for as long as your account is active.
- Trip data (including messages, photos, financial records, and itineraries) is retained for the life of the trip plus a minimum of 12 months to support dispute resolution. Cancelled and completed trips are not automatically deleted; you may request deletion (see Section 11).
- Audit logs are retained for up to 36 months for security and compliance purposes.
- Backups are retained for up to 30 days, after which deleted data is purged from backup media.
- When you delete your account, your profile data is removed within 30 days. Content you contributed to shared trips (messages, photos) may be anonymised rather than deleted where required to preserve the integrity of the trip record for other members.
10. Security
We implement the following measures to protect your information:
- All data in transit is encrypted using TLS 1.2 or higher.
- Passwords are stored using a one-way cryptographic hash (Django’s PBKDF2-SHA256). We never store plaintext passwords.
- Authentication uses short-lived JWT access tokens and longer-lived refresh tokens.
- API endpoints are protected with rate limiting and permission checks.
- Database backups are encrypted at rest.
- We conduct periodic security reviews of our codebase and infrastructure.
No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at support@twendetribe.africa.
11. Your Rights & Choices
You have the following rights regarding your personal data:
Access
You can view your profile, trip history, and contribution history within the app at any time.
Correction
You can update your name, email, and phone number in the app’s account settings.
Deletion
You may delete your account from within the app or by emailing support@twendetribe.africa. We will process your request within 30 days. See Section 9 for details on what is retained for legal or operational reasons.
Notification preferences
You can manage push and email notification preferences per category (trip updates, payment reminders, etc.) in the Notification Preferences section of the app.
Withdraw consent for Google sign-in
You can revoke Twendetribe’s access to your Google account at any time via your Google account’s security settings. This does not delete your Twendetribe account; it only removes the Google sign-in link.
Data portability
To request a copy of your personal data in a machine-readable format, email support@twendetribe.africa.
Objection / restriction (EEA/UK users)
If you are located in the European Economic Area or the United Kingdom, you have the right to object to or request restriction of certain processing. Contact us at the address below.
12. Children’s Privacy
Twendetribe is not directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us with personal information, please contact us at support@twendetribe.africa and we will delete it promptly.
Some trips may set a minimum age requirement (e.g. 18+). Organisers are responsible for verifying the age eligibility of trip members.
13. Third-Party Services
The app integrates with the following third-party services. Their use of your data is governed by their own privacy policies:
- Google Firebase (FCM) — firebase.google.com/support/privacy
- Google Sign-In — policies.google.com/privacy
- Safaricom M-Pesa — safaricom.co.ke/personal/m-pesa/m-pesa-privacy-statement
- Zoho Mail — zoho.com/privacy.html
Twendetribe does not embed third-party tracking scripts, analytics SDKs, or advertising networks in the mobile application.
14. International Transfers
Twendetribe is based in Kenya. Our servers are located in [hosting region]. If you access the platform from outside Kenya, your information may be transferred to and processed in Kenya or another country where our service providers operate.
When we transfer data outside Kenya, we ensure appropriate safeguards are in place, consistent with the Kenya Data Protection Act, 2019.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by email at least 14 days before the change takes effect. The “Effective” date at the top of this page reflects when the current version came into force.
Continued use of Twendetribe after a policy update constitutes acceptance of the revised terms.
16. Contact Us
For any privacy-related questions, requests, or complaints, please contact:
- Email: support@twendetribe.africa
- Website: twendetribe.africa
We aim to respond to all privacy requests within 14 business days.
If you are a Kenya resident and believe we have not handled your complaint adequately, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.