Privacy Policy
Last updated: 7 September 2026
This policy explains what Escrofy ("Escrofy", "we") collects when you use the Escrofy mobile app and website (the "Service"), why, who we share it with, and the choices you have. It applies to buyers and sellers in every region we operate in (United States and Kenya).
1. What we collect
Account. Email address, name, phone number, your region and the username you choose. You sign in with a one-time email code or with Google; we never see or store a password. If you sign in with Google we receive your Google account email and name.
Orders. What you buy or sell, the recipient name, delivery address and phone number you enter at checkout, order status, delivery and inspection events, disputes and refunds.
Payments. Card payments are processed by Stripe and M-Pesa payments by Safaricom. We do not receive or store full card numbers. We receive payment status, amounts, currency, the payment method type and, for M-Pesa, the phone number you pay from.
Content you create. Messages you exchange with a buyer or seller inside an order, reviews you write, and products, photos and videos you list as a seller.
Device and usage. A push-notification token (Firebase Cloud Messaging) if you allow notifications; the Google Play install referrer, used once to attribute an install to a shared link; and playback diagnostics for videos in the feed (session identifiers, network tier, a coarse device-performance class, buffering and watch time). We do not collect advertising identifiers, precise location, contacts or your camera roll.
Shared links. When you open an escrofy.com/r/… link we record the click (link identifier, channel, coarse device class, country) and set a cookie (esc_vid) so repeat visits from the same browser are counted once.
2. Why we use it
- To run the marketplace: create your account, take payment, hold it until delivery is confirmed, pay sellers, handle refunds and disputes.
- To keep the Service safe: detect fraud and abuse, enforce our Terms, moderate listings and messages.
- To communicate: order updates, one-time sign-in codes, security notices and — only if you opt in — push notifications.
- To improve the Service: playback diagnostics tell us where video stalls so we can fix it.
- To meet legal duties: tax, accounting, anti-money-laundering and consumer-protection records.
Where the GDPR or the Kenya Data Protection Act 2019 applies, our legal bases are performance of a contract (running your orders), legitimate interests (safety, improvement), consent (push notifications, marketing) and legal obligation (records).
3. Who we share it with
Buyers and sellers see what they need to complete an order: a seller sees the delivery details for an order they are fulfilling; a buyer sees the seller's public profile. We share data with service providers acting on our instructions: Stripe and Safaricom (payments), Google (Firebase push notifications, Google sign-in, Google Play), Cloudflare (network and media delivery), our hosting providers, and Resend (email delivery). We disclose data when the law requires it, to protect our users or to defend our rights. We do not sell personal data and we do not share it for third-party advertising.
4. Where it is stored
Account and order data is stored in the region you registered in (United States or Kenya). Some providers listed above process data in other countries; where that involves a transfer out of your region we rely on the provider's contractual safeguards.
5. How long we keep it
Account data for as long as your account exists. Order, payment and dispute records for up to seven years after the order, because tax and financial-record laws require it. Messages for the life of the order plus the dispute period. Playback diagnostics and click records are aggregated or deleted within 13 months.
6. Your choices and rights
- Delete your account — see Delete your account. Records we must keep by law are retained for the period above and then deleted.
- Access, correct or export your data by writing to privacy@escrofy.com.
- Push notifications can be switched off in your device settings at any time.
- Where the law gives you the right to object, restrict processing or complain to a supervisory authority (for Kenya, the Office of the Data Protection Commissioner), you may do so.
7. Children
The Service is for adults. You must be at least 18 to open an account. We do not knowingly collect data from children; if you believe a child has an account, write to us and we will delete it.
8. Security
Sign-in tokens are stored in your device's secure storage. Data in transit is encrypted. Access to production data is restricted and logged. No system is perfectly secure; if we learn of a breach affecting you we will tell you as the law requires.
9. Changes
We will post changes here and update the date above. Material changes will be announced in the app before they take effect.
10. Contact
Escrofy
privacy@escrofy.com