Privacy Policy

Last updated: 15 October 2026

This policy explains how Efikas Finance Tracking (“we”, “us”, “the app”) handles your personal information when you use our website and Android app. We have tried to say plainly what we collect, why, who sees it, and what you can do about it.

1. Who we are

Efikas Finance Tracking is a personal finance app operated by Efikas (“Efikas”). For the information described in this policy, Efikas is the data controller: we decide why and how it is used. You can reach us at support@efikaserp.com.

2. The short version

You give us your account details and the financial records you choose to enter. We use them to run the app, show your reports and keep your account secure.
We do not sell your personal information, we do not show third-party ads, and we do not use your financial records for advertising or profiling.
We never see or store your card number or M-Pesa PIN. Payments are handled by Safaricom and Paystack.
You can delete your account and data yourself at any time. See how to delete your account.

3. Information we collect

3.1 Information you give us

What	Details	Why
Account details	First and last name, email address, phone number (optional), country, preferred currency and theme, and a password. The password is stored only as a one-way hash; we cannot read it.	To create your account, sign you in and display amounts in your currency.
Financial records	Accounts and balances, transactions (amount, date, name, notes, category, payee), transfers, budgets, goals, bills and due dates, assets and liabilities.	To provide the app, sync your data between devices and produce your reports.
Subscription and payments	The plan you choose, payment status and reference, and the phone number you enter for M-Pesa. Card details are typed on Paystack's page, not ours.	To take payment, activate your subscription and send confirmations and reminders.
Messages to us	Anything you send to our support email.	To reply and to improve the app.

3.2 Information collected automatically

What	Details	Why
Device and browser information	The browser or app identifier your device sends (the user agent), shortened to a device name such as the model or browser, and a one-way fingerprint of it.	To list your active sessions and warn you about a sign-in from a new device.
IP address	Your IP address when you sign in.	To limit repeated failed sign-ins and protect your account from guessing attacks.
Sign-in and security events	Sign-in times, failed attempts, password reset requests, and sessions you or we revoke.	Account security and abuse prevention.
Notification data	In-app notifications we create for you (for example bill and renewal reminders). If you turn on browser notifications, the push address your browser gives us.	To deliver the reminders you asked for.
Technical logs	Our servers record routine request and error logs (for example time, page and error type).	To keep the service running and fix faults.

3.3 Information from others

When you pay, Safaricom (M-Pesa) or Paystack tells us whether the payment succeeded, the amount and a transaction reference. We do not buy personal information about you from data brokers, and we do not link your account to social media.

3.4 What we do not collect

Your precise or background location, contacts, photos, microphone or camera data.
Your SMS messages or call history. The app does not read your M-Pesa messages; you enter your records yourself.
Your fingerprint or face data. Biometric unlock is performed by Android, which only tells the app whether the check passed.
Advertising identifiers.

4. How we use your information

Provide the service: store and sync your records, calculate balances, budgets, goals and projections, and generate reports you can print or save as PDF.
Keep your account secure: sign-in codes, password resets, new-device alerts, lockout after repeated failed sign-ins, and revoking sessions.
Process payments and manage your subscription: start an M-Pesa or card payment, confirm it, activate your plan, and remind you before your plan ends.
Send service messages: emails and SMS about your account security and subscription. We do not send marketing messages.
Remind you about bills: in-app and, if you enable them, browser or calendar reminders.
Maintain and improve the app: fix errors, prevent fraud and abuse, and understand problems you report.
Meet legal obligations such as accounting and responding to lawful requests.

Where the law requires a legal basis (for example the Kenya Data Protection Act, 2019, or similar laws where you live), we rely on: performing our contract with you (providing the app), our legitimate interests (security, fraud prevention, improving the service), compliance with legal obligations, and your consent for optional features such as notifications and calendar access, which you can withdraw at any time.

We share personal information only with service providers who process it for us, and only what they need to do their job:

Provider	What they do	Information involved
Safaricom (M-Pesa Daraja)	Sends the payment prompt to your phone and confirms payment.	Your M-Pesa phone number, amount and our reference.
Paystack	Processes card payments on its own checkout page.	Your email, amount and reference. Card details go to Paystack directly.
Brevo	Sends our emails (sign-in codes, security alerts, reminders).	Your name, email address and the message content.
TextSMS	Sends our SMS messages (for example password reset codes).	Your phone number and the message content.
Hosting and database providers	Run our servers and store the data.	All data you store in the app, processed on our behalf.

We may also disclose information if the law, a court or a competent authority requires it, or to protect the rights, safety and security of our users and the service. If we ever merge with or are acquired by another business, your information may transfer to it, and we will tell you before it becomes subject to a different policy.

We do not sell personal information and we do not share it for third-party advertising.

6. Permissions on Android

Permission	Required?	What it is for
Internet	Yes	To sign in, sync your data and process payments.
Calendar (read and write)	No, only if you use bill calendar reminders	To add a “Pay [bill]” reminder to your calendar and remove it later. The app only reads and changes events it created itself, and never uploads your calendar.
Biometrics	No, only if you turn on fingerprint or face unlock	To unlock the app. Android performs the check and returns only pass or fail.

You can change any permission at any time in your phone's settings. The app keeps working without the optional ones.

The Android app also keeps a copy of your records in a private database on your phone so it works offline. Other apps cannot read it, and it is removed when you uninstall the app or sign out and clear data.

7. Cookies and local storage

We use only what is needed to run the app. We do not use advertising or cross-site tracking cookies.

Name	Type	Purpose	Lifetime
at	Essential cookie (HTTP-only)	Keeps you signed in.	About 15 minutes, renewed while you are active
rt	Essential cookie (HTTP-only)	Lets you stay signed in only if you tick “Remember me”.	Up to 30 days
theme	Local storage	Remembers your light, dark or device theme.	Until you clear site data
Service worker	Browser feature	Delivers browser notifications if you turn them on.	Until you turn them off or clear site data

On Android, sign-in tokens are kept in Android's secure storage, and small preferences (theme and currency) in the app's private storage.

8. Where your data is processed

Our providers may process data on servers outside your country, including outside Kenya. Where that happens we use providers that apply appropriate safeguards, and we share only what is needed. By using the app you understand that your information may be processed in those locations.

9. How long we keep it

Account and financial records: for as long as your account exists.
After you delete your account: the account is blocked immediately and your data is permanently deleted after 30 days. Copies in backups may persist for a short further period until they are overwritten.
Payment records: we may keep a record of subscription payments for as long as the law requires for accounting and tax.
Sign-in attempt records: kept only briefly, for security.
Sessions: a session without “Remember me” ends within minutes; with it, after at most 30 days unless you sign out sooner.

10. How we protect it

All traffic between your device and our servers is encrypted with HTTPS.
Passwords are hashed and never stored in readable form; biometric unlock secrets are stored hashed and can be revoked.
Sign-in tokens are kept in HTTP-only cookies on the web and in Android secure storage on your phone.
Repeated failed sign-ins are rate-limited, and you can sign out of all devices.
Access to systems that hold personal data is limited to people and providers who need it.

No system is perfectly secure. Choose a strong, unique password and keep your phone locked. If we learn of a breach affecting your information we will notify you and the authorities as the law requires.

11. Your choices and rights

Depending on where you live (including under the Kenya Data Protection Act, 2019), you may have the right to:

Access the personal information we hold about you. Most of it is visible in the app, and you can print or save reports as PDF.
Correct inaccurate information. You can edit your profile and records in the app.
Delete your account and data (see below).
Object to or restrict certain processing, and withdraw consent for optional features such as notifications or calendar access.
Receive a copy of your data in a usable format. Email us and we will provide it.
Complain to your data protection authority. In Kenya this is the Office of the Data Protection Commissioner (ODPC). We would appreciate the chance to fix the problem first.

To use a right that you cannot exercise in the app, email support@efikaserp.com from the address on your account. We may need to confirm it is you, and we will reply within a reasonable time and in any case within the period the law requires.

12. Deleting your account and data

You can delete your account in the app (Profile, then Delete account) or on the web, after entering your password. The account is blocked and you are signed out everywhere straight away, and your data is permanently deleted after 30 days. Full steps and what is kept are on the account deletion page. If you cannot sign in, email us and we will do it for you.

13. Children

The app is meant for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the app or the law changes. We will change the date at the top and, for material changes, tell you in the app or by email before they take effect.

15. Contact us

Questions, requests or complaints about privacy: support@efikaserp.com. You can also read our Terms of Use.