The short version. We collect what we need to help you meet people, keep the community safe and run Moyo+. Other members see your profile, never your email, phone number, birthdate or exact location. We do not sell your data. You can download it or delete your account any time from Settings.
1. Who we are
MoyoMatch ("we", "us") is based in Nairobi, Kenya. We are the data controller for the personal data in this policy, as defined in the Data Protection Act, 2019 (the "Act").
Data protection questions go to privacy@moyomatch.com.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored scrambled, we cannot read it), phone number if you add one, the date you joined | You |
| Profile | Display name, birthdate (others see only your age, and you can hide it), gender, who you want to see, modes (Date, Love, Friends), intentions, bio, job, school, height, interests, prompts, lifestyle basics such as languages, religion, drinking or children | You |
| Photos and media | Profile photos, intro video, stories, photos and voice notes in chats, verification selfies | You |
| Location | An approximate location rounded to about 100 metres, and the area and city we name from it. Others see a rounded distance, never your location | Your device, only when you allow it, or a place you pick |
| Activity | Likes and passes, matches, messages, moments and replies, profile views, blocks and reports, the safety check-ins you set up | You and the people you interact with |
| Payments | The M-Pesa phone number you pay from, amount, plan and M-Pesa transaction reference. Never your M-Pesa PIN | You, IntaSend and Safaricom |
| Technical | IP address, browser and device type, sign-in times, error logs, the push notification address your browser gives us if you turn notifications on | Your device |
| Support and safety | Emails you send us, reports about you, and our moderators' notes and decisions | You, other members and our team |
3. Sensitive personal data
Under the Act some data is sensitive personal data. On a dating app this can include information that reveals your sex life or sexual orientation (for example the gender you want to meet), your religious beliefs (if you add your religion) and your ethnic background (which photos or languages may suggest). We only process it because you choose to add it to your profile, which is your explicit consent, and only to show your profile and find people you might like. You can change or remove it at any time in Edit profile or Settings.
4. Why we use it, and our lawful basis
| Purpose | Lawful basis under the Act |
|---|---|
| Creating your account, showing your profile, suggesting people, matches and chat | Performing our contract with you |
| Sensitive personal data on your profile, precise location from your device, push notifications | Your consent, which you can withdraw at any time |
| Email about your account (verification, password reset, your data download) | Performing our contract with you |
| Email about new matches and unread messages | Our legitimate interest in keeping conversations going. You can turn these off in Settings or from any such email |
| Checking reports, verifying selfies, stopping scams, fake profiles and abuse | Our legitimate interest in a safe community, and protecting people's vital interests |
| Moyo+ payments and records | Performing our contract with you, and our legal obligations (including tax law) |
| Keeping the service secure, fixing errors, understanding which features work | Our legitimate interest in running a reliable service |
| Answering lawful requests from the police or courts | Legal obligation |
We rank profiles automatically (for example by distance, recent activity and shared interests). This decides the order you see people in. It does not produce legal effects about you, and you can always ask a person on our team to look at any decision about your account.
5. Who can see your data
- Other members see your profile: display name, age (unless hidden), photos, video, bio, prompts, interests, basics, area or rounded distance (unless hidden), verification badge and when you were last active. Your matches also see your messages, and the moments you share with them. If you turn on Incognito, only people you like can see your profile. If you pause your profile, new people cannot find you at all.
- Our team: a small number of moderators can see what they need to handle reports, verifications and support, and every action they take is logged.
- Service providers who process data for us under contract: Hetzner Online GmbH in Germany, which hosts our servers (including the one that sends our email), IntaSend, which sends the M-Pesa request for us, and Safaricom for M-Pesa payments, and your browser's push service (Google, Apple, Mozilla or Microsoft) if you turn on notifications.
- Authorities, when Kenyan law requires it or when someone's life or safety is at risk.
- If MoyoMatch is ever sold or merged, your data would move to the new owner under this policy, and we would tell you first.
We do not sell your personal data, and we do not share it with advertisers.
6. Data outside Kenya
Our servers are in Germany, in Hetzner Online's data centre in Falkenstein. Where personal data leaves Kenya we do so under sections 48 to 50 of the Act and the Data Protection (General) Regulations, 2021: we only use providers that give appropriate safeguards for your data, and sensitive personal data is transferred only with your consent, which you give when you add it to your profile.
7. How long we keep it
| Data | How long |
|---|---|
| Your account and profile | While your account is open. When you delete your account we delete your profile, photos, matches, messages, moments and swipes straight away |
| Backups | Deleted data can stay in our private server backups for up to 14 days, then it is gone |
| Stories | 24 hours, then deleted with their photos |
| Notifications in the app | 120 days |
| Your data download | The file is deleted 7 days after it is ready |
| Password reset links | 60 minutes |
| Reports, blocks and moderation records | 24 months after the report, even if an account is deleted, so we can keep people who were removed from coming back |
| Payment records | 5 years, as Kenyan tax law requires |
| Server and error logs | 14 days |
8. Your rights
Under section 26 of the Act you have the right to:
- be informed about how your data is used (this page);
- access your data: use Settings, Download my data for a copy by email, or write to us;
- correct it: edit your profile at any time, or ask us;
- delete it: use Settings, Delete account, or ask us;
- object to us using it, and withdraw consent at any time (this does not affect what we did before);
- data portability: your download is a standard JSON file you can take elsewhere;
- not be subject to a decision based only on automated processing that has legal or similar effects on you.
Email privacy@moyomatch.com to use any of these rights. We may ask you to confirm it is really you. We reply within 7 days. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
9. Keeping it safe
- Everything travels over encrypted connections (https).
- Passwords are stored as one-way hashes. Staff sign in with a password and a one-time code sent to their email.
- Your location is rounded before it is saved, and others only ever see a rounded distance.
- Access to personal data is limited to the people who need it, and moderator actions are logged.
If we ever have a data breach that is likely to put you at risk, we will tell the Data Commissioner within 72 hours and tell you without delay, as the Act requires.
10. Cookies and storage on your device
We only use cookies that MoyoMatch needs to work: one that keeps you signed in and one that protects forms from forgery. The app also saves a few preferences on your device (light or dark mode, card stack or Reels). We do not use advertising or tracking cookies.
11. Children
MoyoMatch is only for people aged 18 and over. We do not knowingly collect data about children. If we learn that an account belongs to someone under 18, we close it and delete its data. If you think a child is using MoyoMatch, please report the profile or email us.
12. Changes and contact
We will update this policy when the way we use data changes, and tell you in the app or by email about important changes.
Data controller: MoyoMatch, Nairobi, Kenya
Privacy questions: privacy@moyomatch.com
Everything else: hello@moyomatch.com