⚠

Draft: pending legal review

This policy describes Sikivu as it works today, including the places where it does less than we intend. Our lawyer is reviewing it, and it may change when that review is complete.

Legal

Privacy Policy

Version 2026-09 · Last updated: 18 October 2026 · Effective: upon public launch

1. Who we are

Sikivu is a mental-wellness companion for people in Kenya and, in time, the wider East African region. It is operated by Sikivu Limited, a company incorporated in Kenya on 31 July 2026, registration number PVT-5M19MV8Z, with its registered office at Nyaura Estate, Menyinkwa–University Road, Kisii Central, Kisii County, and postal address P.O. Box 69, 40111 Pap-Onditi.

Sikivu Limited is the data controller for the personal data in this policy. Our privacy contact is privacy@sikivu.app. This policy covers the web app at app.sikivu.app, the public website at sikivu.app, and the Sikivu mobile app. It is written under Kenya's Data Protection Act, 2019 ("the Act").

2. The short version

·You sign in with your email address and a one-time code. There are no passwords.
·Sikivu processes mental-health data: mood entries, screening scores, conversations with the AI companion, and messages with peers. This is sensitive personal data.
·Your data is stored in the European Union. Some of it goes to providers in the United States as part of the service, most importantly your AI-companion conversation, which is sent to our AI provider to write each reply. Section 9 lists every provider.
·Software checks what you write for signs of crisis. If it finds them, you see crisis resources at once. If you have named emergency contacts, we alert each one automatically, without a person reviewing it first, unless you have turned that contact off. Section 6 explains this.
·Using your conversations to improve our AI is an optional item. Profile → Privacy shows whether it is on and lets you change it.
·You can ask for a copy of your data, and for your account to be deleted, in Profile → Your data on the web app. You can also write to privacy@sikivu.app.
·When your account is deleted, everything linked to it is deleted, including records of any crisis and of any payments. Section 10 has the details.

3. Who Sikivu is for

Sikivu is for adults aged 18 or older. We ask for your date of birth at sign-up, and our database refuses one under 18. We do not knowingly process a child's data. Section 13 says what we do if we learn that a user is under 18.

4. What we collect

We collect what you give us and what the app produces while you use it. We do not buy data about you or collect it from other companies.

Account and profileEmail address; phone number, if you verify one on the mobile app with an SMS code; full name; a display name shown to peers; occupation; county of residence; gender identity; date of birth and the age range derived from it; the areas you want support with; your communication preferences; the date and version of the Terms you accepted; your plan and daily usage counts.

Wellness dataMood entries with optional energy, anxiety and stress scores, emotion tags, activities, triggers and a note of up to 500 characters; wellness logs for sleep, exercise, meditation, goals and habits; and the labels our classifier attaches to an entry (an emotion, a risk category and a confidence score).

Screening resultsYour answers, total score and severity band on the PHQ-9 (depression) and GAD-7 (anxiety) questionnaires and our first screening. These are screening tools, not diagnoses.

Journal and AI analysisJournal entries you write. For each journal entry, mood note or Coach message we analyse we also keep the reflection written about it and the themes and feelings it picked out, each with a short quote from your text, along with a record of the analysis itself. Separately, a log of the time of each analysis you request, with no text from your entries, is kept for 2 days so we can limit how many requests one account makes.

Sikivu Coach conversationsEvery message you send to the AI companion and every reply, stored on every plan, including free. Your plan sets how many messages you may send each day and how far back the companion reads, not whether the conversation is stored.

Peer supportYour peer profile (display name, avatar, how much you choose to share, the support you want and your matching preferences); connection requests; messages of up to 1,000 characters; and the blocks, mutes and reports you make or that are made about you.

InvitesAn invite code of your own, created the first time you open the invite screen. If you join through someone else’s invite link, the code you used, so that we record that person as the one who invited you, and when. We do not record clicks, shares or who you send a link to. Until you sign in, the code from the link is held for up to 48 hours in a cookie on the web (Section 15) or in storage on your device in the mobile app, then deleted.

Safety informationEmergency contacts you add (name, relationship, phone number, optional email, preferred way to be contacted, when they may be contacted, quiet hours, and whether we may alert them in a crisis); your safety plan; and records of any crisis (Section 6).

Device dataPush-notification tokens; platform and app version; and, on the mobile app, a copy of your data kept on your device so the app works offline.

AnalyticsWhich screens and features you use, and when. These events are linked to a hashed form of your account identifier, not your name or email, except events sent from our servers, which use the identifier itself. Sign-in and sign-up events on the website and web app, and events on mobile, also carry the domain of your email address (for example, gmail.com). Some carry wellness information: a mood score, or a screening result with its severity band and whether it indicated thoughts of suicide. Session recording and automatic click capture are off. Google Analytics also records the pages you visit on the website and web app, with your IP address and browser and device details, and is not linked to your account.

Error reportsWhen something breaks, technical details of the error. Before a report leaves the web or mobile app, we remove fields that hold a name, email address, phone number or message text, and replace your account identifier with a hash. Reports from our servers are not yet filtered this way, so one could contain whatever the failing code was handling.

Payments and donationsFor web payments, the order and tracking references our payment provider returns and the payment method type. For mobile subscriptions, your subscription status and an app-specific identifier. For donations, your name, email, amount, optional message and newsletter choice. We never see or store card numbers.

Newsletter and waitlistEmail address, optional name and phone number, the consent wording you agreed to and when, and when you confirmed by the link we emailed you.

Survey responsesIf you answer one of our surveys, such as the East Africa Mental Health Community & Landscape Survey at sikivu.app/landscape-scan: your name, organisation, role, the county or region you work in, your answers, email address and phone number, and whether we may attribute your response in what we publish from it.

Contact and feedbackMessages through the contact form reach our inbox and are not stored in our database. In-app feedback, with any screenshot you attach, is stored so we can act on it.

5. What we use it for, and on what legal basis

The Act requires a lawful basis for each purpose. Your mental-health data is processed only on the bases the Act permits for sensitive personal data.

Core and optional. Sikivu is an AI-powered service, and some parts of it cannot work without processing your text. We call these the core of the product: Sikivu Coach, Circles, one-to-one peer chat, analysis of your journal entries, mood notes and Coach messages with the reflections and insights written from them, the use of the insights you keep to personalise later reflections, and your weekly reflection in the app. They are the service you accepted when you created your account. They have no switch, and the only way to stop them is to delete your account (Section 12). Where a core part sends your text to our AI provider, the table below says so. Everything else is optional: using your content to improve our AI and the email and text notices about your weekly reflection. Each optional item has its own switch in Profile → Privacy, which shows whether it is on, and you can change any of them at any time.

Your account and signing inPerformance of our contract with you.

Mood tracking, screening, insights and the AI companionYour explicit consent to the service, given when you create your account. You withdraw it by deleting your account (Section 12).

Sending your conversation to our AI provider to write a replyPerformance of our contract with you, and your consent to the service. This is a transfer outside Kenya (Section 9).

Weekly reflections from your mood entriesCore. Part of the service you accepted when you created your account, with no switch; you stop it by deleting your account (Section 12). Check-ins made before the point from which reflections apply to you, which is your agreement to them or the Product core notice, are not used. Sending the check-ins to our AI provider is a transfer outside Kenya (Section 9). The email and text notices about a reflection are optional and you can turn them off in Profile → Privacy.

AI analysis of your journal entries, mood notes and Coach messagesCore. Part of the service you accepted when you created your account, with no switch; you stop it by deleting your account (Section 12). We analyse your text only if you are 18 or over and have seen the Product core notice in the app. If an entry looks like it may put you at risk, because it matches a list of phrases or because the AI model flags it, we show you crisis contacts, write no reflection for it, and a member of our clinical team, such as our Clinical Advisor, may read that entry to decide whether to act. A review is not a promise that we will contact you or reply. Nobody reads entries as you write them, and Sikivu is not an emergency service. Sending your text to our AI provider is a transfer outside Kenya (Section 9). Text already sent for an analysis in progress cannot be recalled, and reflections and insights already saved stay until you remove them (Section 11) or we delete your account (Section 10).

Peer matching and private roomsPerformance of our contract with you.

Invite codes, and recording who invited whomLegitimate interests in knowing how people reach Sikivu and in telling the person who shared a link how many people joined through it. The record is made only when you join through a link, and only within 7 days of creating your account. The person who invited you sees a number, never who joined, and Sikivu does not tell you who invited you. Only our service can read the record. Deleting your account removes it (Section 10).

Detecting signs of crisis and showing crisis resourcesVital interests: to protect your life or someone else’s. It does not depend on your consent and cannot be switched off while you use Sikivu.

Alerting an emergency contact you namedYour consent for that contact, together with vital interests. Each contact is allowed unless you turn them off (Section 7).

Using your content to improve our AIOptional. Your consent, which you can give or withdraw in Profile → Privacy (Section 7).

Community mood trendsLegitimate interests. Every user’s mood entries are counted in anonymous community trends, shown only for groups of at least 10 people.

Screening messages for profanity and personal details before they are sentLegitimate interests in keeping peer spaces safe. We store the outcome of the check, not the message.

Analytics and error reportingLegitimate interests in keeping the product working, and your consent to the service for the events that include wellness information.

Payments and donations, and the records the law requiresPerformance of our contract with you; compliance with a legal obligation.

Product updates by emailYour consent: the switch is on when you finish sign-up, and the subscription starts only when you click the link we email you to confirm it. Withdraw it in Profile → Privacy, with the link in any email, or at sikivu.app/email-preferences.

Survey responses: compiling published findings, such as the East Africa mental health landscape map and gap report, and contacting respondents about themYour consent. Answering a survey is voluntary, and you choose on the form whether your response is attributed to you, shared anonymously, or left out of what we publish. You may withdraw your response at any time by emailing privacy@sikivu.app. Withdrawal stops future use: we delete your response and leave it out of anything we publish afterwards. It cannot undo what has already been published or sent. Once findings such as the landscape map and gap report have gone out, copies that include or reflect your response, attributed or anonymous, stay with the people who received them.

Answering your requests and complaints, and lawful demands from authoritiesCompliance with a legal obligation; performance of our contract with you.

We do not sell personal data and we do not show advertising. We do not share mental-health data with employers, insurers or governments unless the law compels us.

6. Automated crisis detection

What runs. On the web app, a small machine-learning model runs on your own device and labels each message and mood note with an emotion, a risk category and a confidence score. On the mobile app this happens on our servers, because the on-device model is not yet available there.

What happens. If the risk label indicates suicidality and the confidence is above our clinical threshold, the app shows you crisis resources straight away: the emergency number 999; Befrienders Kenya, whose number the app shows while the line is open (Mon–Sun 09:00–17:00 EAT); and Childline Kenya (for minors) on 116. On the web app this works without a network connection. The AI companion also receives the labels so it can respond with care.

What is recorded. A crisis record: when it happened, where (the companion, a peer room or a screening questionnaire), its severity, the classifier's labels and how it was handled.

Who sees your messages. No Sikivu staff tool shows a flagged Coach conversation or a one-to-one peer message. When small-group Circles open, a trained Steward will be able to see a flagged Circle message with the two messages before it and the three after, and every such view is recorded in an audit log.

Alerts to your emergency contacts. A crisis record, or a PHQ-9 or GAD-7 result in the highest-risk band, sends a text message or email to each emergency contact you have allowed us to alert. This is automatic: no person reviews it first. A contact we have already reached is not messaged again within two hours. The alert asks them to reach out to you and never includes anything you wrote. Section 7 explains how to choose who is alerted.

Its limits. Automated detection can miss a crisis, and it can flag one that is not there. It is not an emergency service. If you are in immediate danger, call 999.

7. Choices you make

Improving our AI. On when you join, unless you turn it off at onboarding or at any time in Profile → Privacy. While it is on, we may use your conversations, peer messages and mood notes, with names and contact details removed, to train and test the models Sikivu uses. If you turn it off, we stop using your content in any future training, but we cannot remove it from a model already trained on it. Each change is recorded with its date and the wording you saw, and your data copy includes that history.

Each emergency contact. When you add a contact, they are allowed to receive crisis alerts unless you turn that off. You can turn it off for any contact in emergency-contact settings, and turn off alerts to all your contacts in notification settings. The quiet hours you set for a contact are stored, but alerts do not yet respect them.

Product updates by email. On when you finish sign-up, and you can turn it off there or later in Profile → Privacy. We send nothing until you click the link in the confirmation email we send you. Accounts that already existed are not subscribed.

Weekly reflections and reminders. The weekly reflection in the app is part of the core of Sikivu (Section 5) and has no switch. The email saying a reflection is ready, and the text reminder alongside it, are optional: on when you join, and each can be turned off in Profile → Privacy. We never send messages about your absence or inactivity.

8. Who we share data with

·Other users. In a peer room, the person you are matched with sees your display name, avatar, what you share in your peer profile, and what you write. We ask them to keep it confidential and can act against a member who does not, but we cannot guarantee what another person does with what they have read.
·Our service providers, listed in Section 9.
·Your emergency contacts, as described in Section 6.
·Authorities. We disclose personal data to a court, regulator or law-enforcement body only under a lawful demand. We disclose no more than it requires and tell you unless the law forbids it.
·Professionals. Sikivu does not refer users to therapists or counsellors. If it ever does, nothing will be shared with them without your specific consent at the time.
·A new owner. If Sikivu Limited is acquired or merges, your data may pass to the successor, bound by this policy. We would tell you first.

9. Where your data goes

Your data is stored in the European Union, in our database provider's Ireland region. It leaves Kenya as a normal part of the service, and some of it leaves the EU. We rely on the transfer being necessary to perform our contract with you. We have a signed data-processing agreement with PostHog and are putting one in place with each other provider.

SupabaseDatabase, sign-in and file storage. Receives all the data in Section 4. European Union (Ireland).

AnthropicWrites Sikivu Coach replies on every plan, including free, and your weekly reflections. Receives your conversation and the classifier labels, and the week’s mood entries including notes. It also writes a reflection on each journal entry, mood note or Coach message we analyse and receives that text, plus the labels of insights you have already kept or left standing, not the ones you removed. Your name, email and profile are not sent. We do not use your data to train Anthropic’s models. United States.

ResendSign-in codes, account emails, emergency-contact alert emails, and newsletter confirmations. Receives email addresses and names where given. United States.

BrevoSends our newsletter to confirmed subscribers. Receives email address and optional name. France.

Africa's TalkingText messages: phone verification codes on the mobile app, the optional weekly-reflection reminder, and emergency-contact alerts. Receives your phone number, and your contacts’ numbers with the alert text. Phone numbers are not used for sign-in. Kenya.

PesapalWeb payments and donations (M-Pesa, cards). Receives name, email, phone, amount and payment reference. Kenya.

RevenueCatMobile subscription status. Receives an app-specific identifier and subscription status. United States.

Apple and GoogleBilling for mobile subscriptions, under their own terms.

ExpoDelivers push notifications to your phone. Receives your push token and the notification text. Crisis alerts are never sent this way. United States.

PostHogProduct analytics, as described in Section 4. European Union.

SentryError reports, as described in Section 4. Errors from the web app are processed in Germany.

Google AnalyticsWebsite analytics on sikivu.app and the web app. Receives the pages you visit, your IP address, and browser and device details. United States.

TallySurvey forms, including the East Africa Mental Health Community & Landscape Survey. Collects and holds your answers, name, organisation, email address and phone number for us. Tally says form data is stored in Europe. Belgium.

CloudflareHosts the website and web app and stores feedback screenshots. Receives connection data such as your IP address, and screenshots you attach. Global network.

We will tell you before a new provider starts receiving mental-health data.

10. How long we keep your data

Everything linked to your accountKept while your account exists. When you ask us to delete it, we wait 30 days in case you change your mind, then delete it. That includes your profile, wellness data, screening results, conversations, peer messages, safety plan, emergency contacts, reflections, feedback, and records of any crisis or payment.

Records of a repeated pattern in peer roomsMarked to expire after 30 days, and deleted by a job that runs every hour.

AI analyses of your entriesKept with the journal entry, mood note or Coach message they describe, and deleted with it. You can also remove any of them yourself at any time (Section 11).

Log of your analysis requests2 days. It is deleted automatically each day, and with your account.

Invite codes and who invited whomKept while the accounts exist. When an account is deleted, its invite code is deleted, and so is any record that names that person as the one who invited someone or as the one who was invited.

In-app notifications30 days.

Data-copy filesThe download link works for 7 days, after which the file is deleted.

Analytics and error reportsKept by PostHog, Google Analytics and Sentry under our settings with them. Deleting your Sikivu account does not yet delete them.

Donation recordsNot linked to an account. We have not yet set an end date; our lawyer is advising on the period tax law requires.

Newsletter and waitlistUntil you unsubscribe. After that we keep your email address marked as unsubscribed, so we never email you again by mistake.

Survey responsesKept indefinitely, unless you withdraw your response (Section 5).

Contact-form messagesIn our inbox until we delete them.

The copy on your phoneOn the mobile app, until you delete the app.

Anonymous community trendsIndefinitely. They count groups of at least 10 people and cannot be linked to you.

11. Your rights

Use the screens named below, or write to privacy@sikivu.app, to use any of these rights. We answer a written request within 30 days, never charge for a first request, and may ask you to confirm who you are.

·Access and portability. Ask for a copy in Profile → Your data on the web app. We prepare it as a JSON file, and the link appears on that screen when it is ready and works for 7 days. If it has not appeared, write to privacy@sikivu.app and we will send it. It includes your profile, mood and wellness entries, screening results, emergency contacts, notification preferences, onboarding record, the history of your AI-training choice, the record of when you accepted our Terms and this Policy and which version, your journal entries, the AI analyses written about them and the log of your last two days of analysis requests, and your Coach conversations in the order they happened. The file does not yet include your weekly reflections or safety plan; ask and we will send them separately. It does not include peer-room messages, because they also hold another person's words; ask and we will send your own messages with the other person's removed.
·Rectification. Correct your profile in the app, or ask us. In Journal → What I've noticed you can correct or remove each theme or feeling the AI analysis picked out about you.
·Erasure. Delete your account in Profile → Your data on the web app, or ask us. We delete it 30 days later, as Section 10 describes, and you can cancel on the same screen before then. To remove AI analyses without deleting your account, use Journal → What I've noticed: you can delete them all at once, and your journal entries stay.
·Restriction and objection. Ask us to pause processing while a dispute is resolved, or object to processing based on our legitimate interests. We stop unless we have a compelling reason we can show you.
·Withdrawing consent. Turn off any optional item, including AI training, in Profile → Privacy, or alerts to a contact in emergency-contact settings. The core of Sikivu (Section 5), including analysis of your entries, cannot be switched off; to stop it, delete your account. To withdraw a survey response, write to privacy@sikivu.app (Section 5). Withdrawal does not affect what was done before it.
·Automated decisions. Alerts to your emergency contacts are sent automatically (Section 6). You can stop them for any contact at any time, and you can ask us to review any alert or crisis record.
·Complaints. Write to us first if you wish. You may also complain to the Office of the Data Protection Commissioner in Kenya.

12. Consent to the service

Sikivu cannot provide mood tracking, screening or an AI companion without processing your mental-health data. You accept that when you create your account, and you may end it at any time by deleting your account. The optional items in Section 7, such as AI training, are separate and do not affect your use of Sikivu either way.

13. Children

Sikivu is for adults. If we learn that a user is under 18, we pause the account without deleting it straight away, because a young person who has come to Sikivu may be at risk. We refer them to Childline Kenya (for minors) on 116, keep only what that referral and their safety need, and delete the rest once the concern is resolved or handed over. If you believe a child has an account, tell us at privacy@sikivu.app.

14. Security

·Encryption at rest (via our hosting infrastructure) and in transit (TLS 1.2 or higher)
·Row-level security, so each account can read only its own rows
·Sign-in by short-lived one-time codes, with no passwords to steal
·Role-based access for staff, Stewards and our Clinical Advisor, with access through our staff tools recorded in an audit log

Encryption does not mean we cannot read your data. Our systems and our AI provider process your conversation in order to provide the service.

If you share a device with someone you do not trust, be aware that Sikivu shows your mood history, conversations and safety plan to whoever is signed in on it. Sign out when you finish, and think carefully before naming an emergency contact who lives with you.

If a breach is likely to put your rights at risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and notify you without undue delay.

15. Cookies and local storage

The website and web app use local storage and analytics cookies that recognise your browser between visits: one set by PostHog, and two set by Google Analytics (_ga and one beginning _ga_). They set no advertising cookies. If you open an invite link, the website also sets a cookie named sikivu_ref that holds the invite code and nothing else, so the code can be applied after you sign in at app.sikivu.app. It expires after 48 hours and is deleted once it has been used. The mobile app uses no cookies; it keeps a database on your device so it works offline.

16. Changes to this policy

We post changes here with a new version and date, and tell you in the app or by email before a material change takes effect. Continued use of Sikivu after a change takes effect constitutes acceptance of the updated policy. Where a change needs your consent, we ask for it.

17. Contact

Privacy and rights requests: privacy@sikivu.app. Legal: legal@sikivu.app. Post: Sikivu Limited, P.O. Box 69, 40111 Pap-Onditi, Kenya. You can also use our contact form.