This policy explains what Mechi collects, why, who it is shared with, and the rights you have under Kenya's Data Protection Act, 2019. We do not sell your personal data or use advertising trackers.
Who we are
Mechi is a dating app for adults in Kenya, run by Muskari IT Solutions ("Mechi", "we", "us"). We decide how your personal data is used, which makes us the data controller under the Data Protection Act, 2019.
- Privacy questions and requestsprivacy@mechyapp.com
- Postal addressRiver Road, Nairobi, Kenya
What we collect
We collect only what Mechi needs to work.
| Type | What exactly | Where it comes from |
|---|---|---|
| Account | First name, surname, email address, password (stored only in scrambled form), date of birth, whether your email is verified | You, at sign-up |
| Profile | Gender, who you want to see, bio, up to 6 photos | You |
| Location | Your phone's location when you open Discover | Your phone, with your permission |
| Activity | Who you liked or passed on, your matches, how many likes you used today | Your use of the app |
| Messages | Chats with your matches, and when they were read | You and your matches |
| Safety | People you block, reports you make, reports made about you, with any note added | You and other users |
| Payments | Amount, M-Pesa receipt code, date, Premium end date | IntaSend and Safaricom M-Pesa, after you pay |
| Device | A login token stored in encrypted storage on your phone | Created when you log in |
Sensitive information. Your gender and the gender you want to see may reveal your sexual orientation, which the Data Protection Act treats as sensitive personal data. We collect it only because matching cannot work without it, and only with your consent at sign-up.
Photos. When you upload a photo, we remove hidden data stored inside it, including the GPS location where it was taken, before saving it.
Phone number. When you pay for Premium, your M-Pesa number is sent to our payment provider, IntaSend, and to Safaricom to start the payment. We do not store it.
This website does not use cookies, analytics or advertising trackers.
How we use it
| Purpose | Information used | Legal basis |
|---|---|---|
| Create and secure your account, and confirm your email | Account details | Contract |
| Confirm you are 18 or older | Date of birth | Legal obligation and contract |
| Show you people nearby, and show you to them | Profile, location, who you want to see | Contract, and your consent for location and sensitive data |
| Matching and chat | Activity, messages | Contract |
| Daily like limit and Premium | Activity, payments | Contract |
| Process Premium payments | Payments; your M-Pesa number, passed to IntaSend and Safaricom | Contract |
| Keep people safe: blocking, reviewing reports, removing accounts that break our rules | Safety information, and the profile and messages involved in a report | Legitimate interest in a safe service, and legal obligation |
| Respond to lawful requests | Whatever the request lawfully covers | Legal obligation |
We do not make automated decisions that have legal or similarly significant effects on you. People appear in Discover in order of distance only.
You can withdraw consent for location at any time in your phone's settings. Discover does not work without it.
What other users can see
- People nearby see your first name, age, gender, bio, photos, and your distance from them rounded to the nearest kilometre.
- Only your matches see the messages you exchange with each of them.
- Nobody else ever sees your surname, email address, exact date of birth, exact location, who you liked or passed on, who you blocked, reports you made, or your payment details.
People you block, and people who block you, stop seeing each other anywhere in the app. Nobody is told when you block, report or pass on them. Anything you send in a chat can be seen, copied or shared by the person you send it to, so share personal details with care.
Who we share it with
We share personal data only with the service providers below, who process it on our instructions to run Mechi, and only as much as each one needs.
| Provider | What they do for Mechi | Data they handle |
|---|---|---|
| Supabase | Hosts our database and stores profile photos | The information listed above, except your M-Pesa number |
| Render | Runs the Mechi server the app talks to | Information passing between the app and the database |
| IntaSend | Licensed payment provider that collects Premium payments through M-Pesa | Your M-Pesa number, first name, email address, the amount and the payment result |
| Safaricom (M-Pesa) | Sends the payment prompt to your phone and moves the money | Your M-Pesa number and the amount |
| Brevo | Sends account emails such as verification codes | Your email address and first name |
| Expo | Builds and delivers the Mechi app | Technical app information; no profile or chat content |
We may also disclose information when the law requires it, such as a valid court order, or when needed to protect someone from serious harm. If Mechi is sold or merged, your information may pass to the new owner, who must continue to honour this policy.
Where your data is stored
Your data is stored outside Kenya, in the European Union: our database and photos in Ireland, and our server in Germany. Both are covered by the EU's General Data Protection Regulation. We transfer data there under the safeguards the Data Protection Act requires, relying on our providers' data processing agreements and security measures.
How long we keep it
We keep your information while your account exists. You can delete your account at any time in the app under Profile, Settings, Delete my account, or by following the steps on our account deletion page.
When you delete your account, we immediately and permanently delete your profile, photos, location, likes and passes, matches, the messages in your chats (for both people), blocks, reports linked to you, and your Premium payment records. Copies in our providers' backups may remain for up to 30 days before they are overwritten.
- Unmatching deletes that conversation for both people.
- Blocking or reporting hides the conversation from both people but keeps it, so a report can be reviewed. It is deleted when either account is deleted.
- Removing a photo deletes the photo file.
- Unverified sign-ups, where the email was never confirmed, may be deleted after one day if someone else signs up with that email address.
How we protect it
- All data travels between the app and our server over encrypted connections (HTTPS).
- Passwords and email codes are stored only in scrambled form, so we cannot read them.
- Your login is kept in your phone's encrypted storage.
- Only you can change your own profile, photos and chats, and only matched people can message each other.
- Our database is closed to direct public access; only the Mechi server can read it.
No system is perfectly secure. If a breach puts your data at real risk, we will notify you and the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as the law requires.
Your rights
Under the Data Protection Act you have the right to:
- be informed about how your data is used;
- access the personal data we hold about you;
- correct data that is wrong or misleading (you can edit your bio, photos and preferences in the app);
- delete your data (you can delete your whole account in the app);
- object to how we use your data, and withdraw consent, for example for location;
- move your data, by asking for a copy in a common format.
To use any of these rights, email privacy@mechyapp.com from the address on your account. We will reply within the time the law requires and may ask you to confirm your identity first. If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner.
Adults only
Mechi is only for people aged 18 and over. We check your date of birth at sign-up and do not knowingly collect data from anyone younger. If we learn that a user is under 18, we delete the account. Read our child safety standards.
Changes to this policy
If we make important changes, we will tell you in the app before they take effect. The effective date at the top of this page always shows the current version.
Contact us
Questions about this policy or your data: privacy@mechyapp.com, or write to Muskari IT Solutions, River Road, Nairobi, Kenya.