Privacy policy

Last updated: 22 September 2026 · Draft pending legal review

This policy explains what personal data Pesalock Africa Limited ("we") collects when you use Kitab, why, and what control you have. It is written to meet the requirements of Tanzania's Personal Data Protection Act, 2022 and the app stores' policies.

1. What we collect

• Identity — your name, phone number or email, and language, from your Pesalock sign-in.
• Finance entries — the accounts, transactions, bills, loans and goals you record. Kitab never connects to your bank or mobile-money account; every figure is one you typed or confirmed.
• Device and usage — device type, app version, push token, crash reports and which screens are used, so we can fix problems and improve the app.
• Billing — for Kitab Plus, the subscription status from Google Play, the App Store or Pesalock. We never see your card or mobile-money PIN.

2. Why we use it

To run Kitab (show your figures, send the reminders you turned on, sync between your phone and browser), to bill Plus, to keep the service secure, and to understand how it is used in aggregate. We do not sell personal data and do not use your finance entries for advertising.

3. Reminders and messages

Push notifications, SMS and email are sent only for reminders and account matters you opted into. You can turn each category off in Settings → Notifications.

4. Cookies

The website sets no cookie until you accept the notice on your first visit. After that it uses two: kitab_consent (records that you accepted) and kitab_lang (your language, so you land on the right page next time), each kept for a year. Your light/dark theme choice is stored in your browser only and never sent to us. There are no advertising or cross-site tracking cookies.

5. Where data lives

Your data is stored on servers we operate for Pesalock in Tanzania and is backed up daily in encrypted form. Data moves between the app and our servers over TLS.

6. Who else sees it

Providers that help us run Kitab — hosting, push delivery, SMS and email gateways, crash reporting — process data only on our instructions. We disclose data when the law requires it.

7. Your rights

You can see, correct, export and delete your data from within the app, or by writing to us. Deleting your account removes your data within 30 days except where the law requires longer retention. You can also withdraw consent to any optional message at any time.

8. Children

Kitab is not directed at children under 18.

9. Changes

We will announce material changes to this policy in the app before they take effect.

10. Contact

Data-protection questions: privacy@pesalock.co.tz, or Pesalock Africa Limited, Dar es Salaam, Tanzania.