Klub Kitanda — Privacy Policy
Last updated: 27 July 2026 · Version 1.0 (draft)
> Status: solid draft, not a lawyer's review. Everything below is written to be *true about
> the app as built*, and the Kenyan law references were checked against the Act and the ODPC's
> own guidance (sources at the bottom). It has not been reviewed by an advocate. Do that before
> the app goes to the stores — an hour of a Kenyan data-protection lawyer's time on this
> document is the cheapest insurance in the project.
The short version
Klub Kitanda has no accounts, no login, and no sign-up. We never ask you for your name,
your phone number, your email or your location.
The only thing we do collect is a **random number that identifies your installation of the
app** — not you — attached to a count of which events got tapped. We use it to tell an
organiser "your event got 340 views and 41 booking taps this week." That's the whole business
reason it exists, and it is the only thing this policy is really about.
Everything else — your saved events, your recent searches, your settings — stays on your phone
and never reaches us.
1. Who we are
Klub Kitanda is a curated events-discovery service for Nairobi.
- Data controller: «TODO: registered legal entity name and, once registered, the ODPC
registration number. Until the business is registered, this is the founder as a sole trader —
name and postal address go here.»
- Contact: hello@klubkitanda.app «TODO: confirm once the domain is bought — the app already
points its "report a problem" and "contact us" actions at this address, so it must exist on
day one.»
- Instagram: @klubkitanda
If you are in Kenya, this policy is written against the **Data Protection Act, 2019 (No. 24 of
2019)** and the regulations made under it.
2. What stays on your device and never reaches us
These are stored in the app's own storage on your phone. They are not uploaded, not backed up
to us, and not readable by us:
| What | Where it lives |
|---|---|
| Events you save | `kk.favorites.v1` on your device |
| Your recent searches | `kk.recent-searches.v1` on your device |
| The cached copy of the events list (so the app opens offline) | `kk.catalog.v1` on your device |
Deleting the app deletes all of it. There is nothing on our side to delete, because there
was never anything on our side.
3. The one identifier we do collect — and what it actually is
When you first open Klub Kitanda, the app generates a random UUID (a 36-character random
string) and stores it on your device as your install ID. It looks like
`f47ac10b-58cc-4372-a567-0e02b2c3d479`.
We are calling this what it is: pseudonymous personal data, not anonymous data.
That distinction matters and we would rather over-disclose it than hide behind the word
"anonymous". Under the Data Protection Act, 2019, "personal data" includes data that can
identify a person indirectly. A random per-install identifier does not name you, but it does
single out one device consistently over time — so Kenyan law treats it as personal data, and so
do we. Calling it "anonymous" would be legally wrong, and we would rather say so plainly in our
own policy than be corrected later.
What is true about it:
- It is random. It is not derived from your phone, your SIM, your Google/Apple account, or
any hardware identifier. It is generated on your device the first time the app runs.
- It is linked to nothing personal. We hold no name, no email, no phone number, no account
— there is nothing on our side for it to be joined to.
- It is not an advertising ID. We do not read the Android Advertising ID or Apple's IDFA,
and we do not ask for tracking permission because we do not track across apps.
- Reinstalling the app resets it. Delete and reinstall Klub Kitanda and you get a fresh
random ID; the old one is orphaned and will never be connected to the new one.
What it is for, honestly: counting people rather than taps. Without it we cannot tell
whether 300 booking taps came from 300 people or from one person tapping 300 times — which
means we cannot tell an organiser anything trustworthy, and organiser reports are how a free
curated listing service survives. It also caps a single device's contribution to any one
event's numbers, so nobody can inflate their own report.
4. What we record alongside it
One table. Every row is one tap, and every row looks like this:
| Field | Example | Note |
|---|---|---|
| what happened | `book` | from a fixed list, below |
| which event | `kitanda-nights-2026-08-01` | our event, not you |
| where from | `app` or `web` | the app, or a shared event web page |
| install ID | `f47ac10b-…` | section 3 above |
| when | `2026-08-01T19:41:02Z` | |
| a little context | `{"source":"app"}` | e.g. which share sheet, or a search term |
The fixed list of things we record: opening the app (`app_open`), viewing an event (`view`),
tapping Book (`book`), tapping through to WhatsApp (`whatsapp`), tapping Directions (`maps`),
tapping Share (`share`), saving or unsaving an event (`save` / `unsave`), submitting a search
(`search_submit` — the words you searched for are recorded, which is how we find out what
Nairobi wants that we aren't listing), viewing a shared event page on the web (`page_view`), and
tapping an app-store badge on that page (`store_badge`).
Searches: we record the search text. Please don't type anything personal into it — it is a
venue-and-vibe search box, and we treat what's in it as a signal about the city, not about you.
5. What we deliberately do not collect
This list is enforced by those columns not existing in our database, not by a promise:
- No IP addresses. Not stored on our side.
- No device fingerprint — no model, OS version, screen size, locale, carrier, timezone.
- No advertising identifiers (no IDFA, no GAID, no tracking prompt).
- No location. The app never requests location permission. "Directions" hands the venue
address to your own maps app; whatever happens after that is between you and Google.
- No contacts, photos, camera, microphone, or calendar read access. "Add to calendar" opens
a pre-filled Google Calendar page in your browser — we never read your calendar.
- No third-party analytics SDK. No Google Analytics, no Firebase, no Mixpanel, no
Amplitude, no Meta SDK, no attribution SDK. Nothing on your phone is reporting to anyone but
the one table described above.
- **No accounts, no profiles, no cross-device linking, no data sold or shared for advertising.
Ever.** Selling user data is explicitly outside the business model.
6. Why we're allowed to process this
Under section 30 of the Data Protection Act, 2019 we rely on legitimate interests — running
and improving a curated listings service, and reporting aggregate interest back to the
organisers whose events we list. We think this is proportionate because the data is minimal, it
is pseudonymous, it is not used to profile or target you, and the alternative (a consent wall on
first open for a counter) would be worse for you than the processing itself.
If the ODPC or our own review concludes an in-app consent step is required for this identifier,
we will add one rather than argue about it. «TODO: raise this specific question in the legal
review — it is the one live question in this document.»
7. Where the data is stored, and that it leaves Kenya
We use two service providers, and both of them host data outside Kenya:
| Provider | What they hold | Where |
|---|---|---|
| Supabase (database + images) | the events catalogue, the taps table in section 4, organiser contact details in section 9 | «TODO: name the exact region once the Supabase project is created — choose it deliberately, closest to Nairobi, and write it here. eu-central-1 (Frankfurt) is the current default candidate.» |
| Vercel (the shared event web pages at `/e/…`) | serves pages; edge logs may briefly hold request data | global edge network, outside Kenya |
Sections 48 and 49 of the Data Protection Act, 2019 govern transferring personal data out of
Kenya. Our position: the transfer is necessary to provide the service you opened the app to
use, the data is limited to the pseudonymous records described above, no sensitive personal data
is involved, and both providers offer contractual data-protection terms.
«TODO: sign each provider's Data Processing Addendum and file the countersigned copy — that
signed DPA is what "proof of appropriate safeguards" means when the Commissioner asks.»
8. How long we keep it
- Tap records (section 4): kept while they are useful for organiser reporting and trend
analysis. «TODO: set and state a real retention period — 24 months is the proposed default,
after which rows are either deleted or stripped of the install ID and kept only as counts.»
- On-device data (section 2): until you delete it or delete the app. We can't touch it.
- Organiser records (section 9): while the organiser relationship is live, plus a short
period afterwards for the record of what was published.
9. Organisers — this part is about a different set of people
If you send us an event, we hold what you sent: your name or your organisation's name, your
WhatsApp number, your Instagram handle, your email if you used it, the poster, and our internal
notes about the listing. That is real personal data and we treat it as such.
- It is used for one thing: verifying and publishing your event, and talking to you about it.
- It is never published beyond what you asked us to publish (typically your event credit and
your public IG handle).
- It is never sold, and never used to market anything unrelated to your listing.
- Ask us to delete it and we will, subject to keeping the minimum record of what we published
and when.
- Once the structured submission form goes live, Tally becomes an additional processor
holding submitted event data and posters. «TODO: state this properly, with Tally's region,
when that form ships — and not before, so this policy stays true.»
10. Children
Klub Kitanda is not directed at children. Listings carry an age restriction where the organiser
sets one («TODO: store age rating — the daytime pivot reopens it»). We do not knowingly
collect data from children, and since we collect no personal data from any user, there is
nothing child-specific to collect. Under section 33 of the Act, processing a child's data needs
consent from a parent or guardian — if you believe a child has been using the app in a way that
concerns you, write to us.
11. Crash reporting — not yet, and it will be disclosed when it is
We do not currently run any crash-reporting service. Sentry is planned so that a crash on a
mid-range Android handset reaches us instead of silently costing a user their evening.
When it lands, this policy will be updated before it ships, and the update will say plainly
what Sentry receives: at minimum a stack trace, app version, OS version and device model — which
is exactly the device information section 5 currently promises we do not collect. **That is a
real change to our posture, not a footnote.** «TODO at P4: reconcile these two sections
honestly. Configure Sentry with `sendDefaultPii: false`, no IP capture, no breadcrumbs
containing search text or the install ID, and narrow section 5 to say what remains true.»
12. Your rights under the Data Protection Act, 2019
Whether or not you use the app, if we hold personal data about you, you have the right to:
- be told what we hold and what we're doing with it (section 26 — this policy is our
standing answer);
- access a copy of it (sections 26 and 27);
- object to the processing;
- have false or misleading data corrected or deleted (section 26);
- have data erased where the grounds in section 40 apply.
The practical difficulty, stated honestly: because we hold no name, email or account, we
usually cannot find your records from a description of you. For app users the only key is your
install ID. If you want your tap history deleted:
- Fastest, and it needs nobody's help: delete the app. The install ID goes with it and the
orphaned rows can never be re-associated with your new install.
- If you want the historical rows removed too: email hello@klubkitanda.app with your
install ID and we will delete every row carrying it. «TODO: the app has no screen that shows
the install ID — a "copy my install ID" row in the You tab is the honest way to make this
right actionable. Add it before the store submission, or state here that route 1 is the only
route.»
We respond to requests within 7 days wherever we can, and in any case within the timeframe
the Act requires. There is no charge.
If we get it wrong, you can complain to the Office of the Data Protection Commissioner:
complaint@odpc.go.ke · www.odpc.go.ke · Britam Towers, 12th Floor, Hospital Road, Upperhill,
Nairobi. You do not need to come to us first, though we would like the chance to fix it.
13. Security and breaches
The events catalogue is served to the app through a restricted database view — the app's public
key can read the published listings and write taps, and can read nothing else. It cannot read
the taps table back, cannot see draft events, cannot see organiser contact details, and cannot
see our internal notes. That is enforced by database row-level security, not by app code.
If a breach affecting personal data occurs, we will notify the ODPC in line with section 43 of
the Act (within 72 hours where the Act requires it) and tell affected people directly where
there is a real risk to them.
14. Changes to this policy
We will post the new version here with a new date at the top, and we will not quietly widen what
we collect. Any change that adds a new category of data — Sentry being the known example —
ships after the policy that describes it, not before.
Sources checked while drafting
- Data Protection Act, No. 24 of 2019 — Kenya Law
- Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (LN 265/2021) — ODPC copy
- ODPC FAQs and contact details — odpc.go.ke/faqs
- Cross-border transfer, sections 48–49 — CMS, Transfer of Personal Data Outside Kenya
Klub Kitanda lists events. We do not sell tickets and we are not the organiser — booking, entry and refunds are between you and whoever sold you the ticket.
Poster artwork belongs to the organiser and is shown with credit. If you hold the rights and want it removed, email hello@klubkitanda.co.ke and it comes down.