Privacy Policy

Last updated: 26 July 2026

1. Introduction & Scope

This Privacy Policy explains how The CBC ("we", "us", "our") collects, uses, shares, and protects information when you use our mobile application and any related websites or admin portals (together, the "Service"). It applies to registered users, group administrators, county revenue officers, and anyone who browses publicly-accessible pages such as this one. By creating an account or otherwise using the Service, you acknowledge that your information will be handled as described here.

2. Who We Are

The Service is operated by Exciteric Int, registered in KENYA ("we", "us"). For any privacy question or request, contact us using the details in Section 15.

3. Information We Collect

Account & profile information

• Name, username, email address, and password (stored only as a salted hash — we never store or can see your plain-text password)
• Date of birth (used solely to confirm you meet our minimum age requirement — see Section 10)
• Gender, bio, campus/college, county, year of joining, and an optional TikTok handle
• Profile photo / avatar

Financial & wallet information

• Your in-app wallet balance and transaction history (deposits, withdrawals, group subscription payments and earnings, boost purchases, contest winnings)
• The M-Pesa phone number you provide when depositing or withdrawing funds
• A 4-digit withdrawal PIN, stored only as a salted hash — we never store or can see your actual PIN
• We do not collect or store your M-Pesa PIN, full card numbers, or banking credentials — those are entered directly with Safaricom, never with us (see Section 5)

Location information

• Approximate coordinates you choose to share, used to power the "Comrades Nearby" feature (see Section 6)

Content you create

• Posts, photos, videos, reels, and stories you upload, including any caption, background color, or styling you apply
• Comments, reactions, reshares, group reviews, and direct messages you send
• Contest submissions (e.g. "Be the STAR" video entries) and any reports you file about other users' content

Technical & usage information

• A device push-notification token, if you enable notifications
• Basic request metadata (timestamps, the device/API version making a request) generated automatically as part of operating the Service

4. How We Use Your Information

We use the information above to:

• Create and secure your account, and verify you meet our minimum age requirement
• Operate core features: your feed, groups, reels, stories, messaging, events, and jobs board
• Process wallet deposits and withdrawals, group subscription payments, boosts, and contest prizes
• Show you "Comrades Nearby" and campus/county-relevant content, groups, and sponsored posts
• Send push notifications and transactional emails (e.g. a wallet PIN reset code)
• Moderate content, investigate reports, and enforce our Terms & Conditions
• Detect and prevent fraud, abuse, and unauthorized account access
• Comply with our legal and financial record-keeping obligations

5. M-Pesa & Payment Processing

Wallet deposits and withdrawals are processed through Safaricom's M-Pesa Daraja platform. When you deposit funds, we send an STK push request to your phone; you then enter your M-Pesa PIN directly with Safaricom — we never see or receive it. When you withdraw funds, we initiate a business-to-customer (B2C) payment to the phone number you provide. Safaricom independently processes these transactions and may retain its own records in accordance with its own privacy practices; we encourage you to review Safaricom's privacy policy as well.

A withdrawal service fee and applicable tax are deducted from each withdrawal, and a minimum withdrawal amount applies — see our Terms & Conditions for the current figures, since these are subject to change.

6. Location Data

If you allow the app to access your device's location, we use it to show you nearby users ("Comrades Nearby") and location-relevant content. You can decline location access entirely, and the rest of the Service will continue to work — you simply won't see location-based suggestions. You can also revoke location permission at any time through your device's settings.

7. How We Share Information

We share information only in the following circumstances:

• With other users — your profile, posts, and other public content are visible to other users per your privacy settings; a group's admin can see who has subscribed to their group; other members of a group you join can see your posts within that group.
• With county revenue officers — each county's revenue officer can see anonymized, aggregate subscription-commission figures for their county for reporting purposes; this does not include your wallet balance, password, or PIN.
• With service providers — Safaricom (M-Pesa payment processing), Expo (push notification delivery), and our email provider (transactional emails such as PIN reset codes). Each only receives the minimum information needed to perform its function.
• For legal reasons — if required by law, legal process, or to protect the rights, safety, or property of The CBC, our users, or the public.
• With your consent — in any other case where you've explicitly agreed to the sharing.

We do not sell your personal information to third parties.

8. Data Retention

We retain your account information for as long as your account is active. If you delete your account, we remove your profile, posts, messages, and other content you solely own. Financial records (wallet transaction history, county-commission records) are treated as audit history: identifying references to a deleted account are removed or anonymized, but the underlying financial record is preserved for accounting and legal compliance purposes, consistent with standard financial record-keeping requirements.

9. Your Rights & Choices

Depending on your jurisdiction (including under Kenya's Data Protection Act, 2019), you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate information (most profile fields are editable directly in the app)
• Delete your account and associated data, subject to Section 8's financial-record exception
• Object to or restrict certain processing, including hiding your wallet balance from your own profile view
• Withdraw location permission at any time via your device settings
• Lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or your local data protection authority

To exercise any of these rights, contact us using the details in Section 15.

10. Children's Privacy

The Service is not directed at children under 13, and we require a date of birth at signup to confirm this minimum age. If we learn that we've collected personal information from a child under 13, we will delete it promptly.

11. Security

We use industry-standard measures to protect your information, including salted password/PIN hashing, rate limiting on sensitive actions (login, wallet operations), automatic lockout after repeated incorrect PIN attempts, and role-based access controls for admin functions. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Cookies & Sessions

The mobile app authenticates using a securely stored session token on your device, not browser cookies. Our web-based admin and county-officer portals use an httpOnly session cookie solely to keep an authorized administrator or county officer logged in — these portals are not accessible to ordinary users and do not track visitors of this Privacy Policy or Terms & Conditions page.

13. International Data Transfers

Some of our service providers (for example, push-notification and cloud-infrastructure providers) may process data outside Kenya. Where this occurs, we take steps to ensure your information continues to receive an appropriate level of protection, consistent with applicable data protection law.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in-app. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.

15. Contact Us

Questions, requests, or concerns about this Privacy Policy or your personal data can be sent to privacy@campusbiasharaclub.com or by post to P O Box 97380 - 80112, Mombasa Kenya.