Privacy Policy

Last updated: 20 September 2026

This policy explains what Nairobi Socials collects, why, and what you can do about it. It covers the Nairobi Socials mobile app and this website. We are based in Nairobi, Kenya. For anything in this policy, contact djdonnaccia@gmail.com.

Nairobi Socials is an 18+ service. We do not knowingly collect data from anyone under 18.

1. What we collect

Account

A username, an email address, and a password (stored only as a salted PBKDF2-HMAC-SHA256 hash — we never store or see your actual password). Optionally a display name, a profile photo, and your Instagram or TikTok handle if you choose to add them.

If you sign in with Google

We receive your verified email address, your name, your profile picture, and your Google account identifier. We use the email to find or create your account, and we never overwrite a display name or photo you already set. We do not receive your Google password, and we request no access to your Gmail, Drive, contacts, or any other Google service — only openid, email and profile.

Location

The app requests your location so it can sort venues and events by distance, show you on the map, check you in to a venue, and record a route if you use the Bender Tracker. This is precise location and it is only collected while you are using those features. You can refuse the permission — the app falls back to a default Nairobi city-centre position and everything else keeps working.

Check-in coordinates are not stored. When you check in, your position is compared against the venue's position to confirm you are actually there, and then discarded. What we keep is the fact of the visit and how long it lasted.

Venue busyness (“presence”) is stored as an aggregate count per venue. It is not linked to you in anything we publish, and entries expire automatically.

Content you create

Reviews, star ratings, review photos, reactions, crew messages, crew membership, saved and interested events, night plans, venue and DJ suggestions, and venue check-ins.

Reviews, ratings, photos and reactions are public once posted. A review's private note is visible only to you and to our moderators — it is never shown publicly. Crew messages are visible to the members of that crew.

Bender Tracker

If you use the optional Bender Tracker, we store what you log: drinks, step count from your phone's pedometer, the GPS route of that night, venues visited, the amount you tell us you spent, and an end-of-night recap. This is personal and sometimes sensitive information about your habits. You choose to start each session, and you can delete a session.

Device and technical

A Firebase push notification token and the topics you are subscribed to (venues you follow, the weekend recap). Approximate IP address and request timing, used for rate limiting and abuse prevention. App version and build flavour, used for update checks.

Spotify

If you connect Spotify, the authorisation happens on your device and the resulting tokens are stored in your device's secure keystore only. They are never sent to our servers. We cannot see your Spotify account, listening history, or playlists. Disconnecting, or revoking access from Spotify, removes them.

2. What we do not do

  • We do not sell your personal data. Ever, to anyone.
  • We do not run advertising or ad-tracking SDKs.
  • We do not scrape or access your Instagram, TikTok, or any other social account. Handles you add are stored as plain text links.
  • We do not track your location in the background when you are not using a feature that needs it.

3. Why we are allowed to hold it

Depending on the data, our lawful basis is: performing the service you asked for (your account, your saved events, your crews), your consent (location, push notifications, Bender Tracker, Spotify — each granted separately and revocable), or our legitimate interest in keeping the service working and free of abuse (rate limiting, moderation, security logs).

4. Who else sees it

We use a small number of third-party services. Each receives only what that feature needs:

  • Google Firebase Cloud Messaging — delivers push notifications. Receives a device token and the message.
  • Google Maps Platform — renders the map and supplies venue data. Subject to Google's own privacy policy.
  • Google Sign-In — only if you use it.
  • OpenStreetMap / OpenFreeMap — map tiles for parts of the app.
  • Radio Browser — resolves radio station streams. Receives no personal data.
  • Spotify — only if you connect it, and only from your device.
  • Ticketing sites (Hustlesasa, Mookh, M-Ticket, Turn App) — we link out to them. Once you follow a link you are on their site under their policy.

We may disclose data if we are legally required to, or where it is necessary to protect someone's safety.

5. Where it is held

Our application servers run on infrastructure we operate ourselves in Kenya. Some of the third-party services listed above process data outside Kenya, including in the United States and the European Union. Where that happens we rely on those providers' own standard data protection commitments.

6. How long we keep it

  • Account data — until you ask us to delete it.
  • Reviews and public content — until you delete them, or we remove them for breaching our terms.
  • Check-in and presence records — presence entries expire within hours; visit records are kept while they are relevant to a review.
  • Login sessions — expire automatically and are swept daily.
  • Password reset codes — 15 minutes.
  • Bender Tracker sessions — until you delete them.

7. Your rights

Under Kenya's Data Protection Act, 2019 — and, if you are in the EU or UK, under the GDPR — you have the right to access a copy of your data, correct it, delete it, object to or restrict how we use it, withdraw a consent you previously gave, and complain to a regulator.

In the app you can already: edit your profile, delete your own reviews and photos, delete Bender Tracker sessions, turn off weekend recap push, unfollow venues, and disconnect Spotify. Revoking the location permission in your phone's settings stops all location collection immediately.

To delete your account entirely, email djdonnaccia@gmail.com from the address on the account. We will confirm, then delete your account, sessions, crew memberships and personal records. Reviews may be retained in anonymised form where removing them would distort a venue's rating; tell us if you want them removed too and we will remove them.

Kenyan users may also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

8. Security

Passwords are hashed, never stored in readable form. Traffic between the app and our servers is encrypted in transit. Admin access is separately authenticated and audit-logged. No system is perfectly secure, and we will tell affected users promptly if we become aware of a breach that puts their data at risk.

9. Changes

If we change this policy we will update the date at the top. For a change that materially affects you, we will tell you in the app before it takes effect.

10. Contact

Nairobi Socials — djdonnaccia@gmail.com