Privacy Policy

1Who we are

SikaNest is a personal budgeting and money-tracking app operated by Wallflake, a company registered at Accra, Ghana.

For the purposes of Ghana's Data Protection Act, 2012 (Act 843) and the EU/UK General Data Protection Regulation, we are the data controller for the personal data described here — except for wallet susu payments, where Moolre Limited is a controller in its own right for the payment data it processes under its licence.

Privacy questions and everything else: sikanest@gmail.com. We aim to answer privacy requests within 30 days, and we will tell you if we need longer.

The same policy is in the app and at sikanest.com/privacy.

2What this policy covers

This policy covers the SikaNest app on iOS, Android and the web — whether you use it with an account or as a guest — our website at sikanest.com, and the emails, text messages and push notifications we send you.

It does not cover what other companies do with data you give them directly. If you buy SikaNest Plus, Apple, Paystack or Stripe handles your card. If you pay into a wallet susu circle, your mobile money provider and Moolre handle the payment. Those companies have their own privacy policies, and the section on who else sees your data names them.

3Our principles

Four commitments sit behind every decision below. If anything here appears to contradict them, treat these as what we meant:

• Your data is not the product. We make money from subscriptions and advertising space, never from selling or brokering your information.
• Local first. What you enter is written to your device and works offline. Sync exists so you can restore your own records, not so we can accumulate them.
• Collect the minimum. Every field below exists because a feature stops working without it. If we stop needing something, we stop keeping it.
• No surprises. If we change how we handle your data in a way that affects you, we tell you in the app before it takes effect — not by quietly editing this page.

4Using SikaNest as a guest

If you use SikaNest without an account, your money records stay on your device and we do not receive them. Guests cannot use features that need our servers, such as Sika Coach, receipt scanning, sync, susu circles and budget groups.

The app still contacts a few services while you are a guest: it fetches our privacy policy, terms and tax tables without identifying you, shows Unity Ads banner ads (see the section on advertising), starts RevenueCat, our subscription provider, with a random identifier, and, if the app crashes, sends a crash report to Sentry that does not identify you.

The one thing a guest can deliberately send us is feedback. If you use Send feedback on the More tab, we receive your message, the email address you type so we can reply, and your app version and phone model. Nothing else leaves your device, and you are never required to send it.

If you create an account or sign in, your guest records are added to that account and are handled as this policy describes from then on.

5What we collect

We keep this to what the app needs to work for you.

• Your account: your email address and when it was verified, and a password stored only as a bcrypt hash — we never hold, and cannot recover, your actual password. Password reset tokens and one-time codes are kept only in hashed form, and only while they are valid.
• Sign-in with Google or Apple, if you use it: a stable identifier and your email address from them. Never your password, and never access to anything else in those accounts.
• Your profile: your full name, and a photo if you add one.
• Identity verification, only if you choose to do it: your Ghana Card number, a photo of the front and the back of the card, and a selfie you take in the app at that moment. It is optional — you can create, join, pay into and collect from circles without it. Our review team compares the card with the selfie and with the name on your account, and records the decision, who made it and when. We do not run face recognition on the selfie and we do not create a biometric template from it.
• Your phone number, if you give it to us to turn on two-factor authentication by SMS or to verify a mobile money wallet, and your two-factor settings, such as which channel you chose.
• Your locale: the country, currency and currency symbol you pick, because the coach and the receipt and voice parsers have to know which money they are reading.
• Your money data: transactions, budgets, goals, bills, debts and debt payments, accounts, savings, holdings, business entries and tracked subscriptions, with the notes and categories you attach, and the income, pay frequency and goals you tell the app about.
• For each device that receives notifications: its timezone, a push token, a device identifier and the app version — so bill alerts arrive in your morning rather than at a fixed UTC hour — plus your notification preferences and quiet hours. A push token is registered when you allow notifications and revoked when you sign out.
• Susu circles: which circles you belong to, your turns and collection position, your contributions, payouts and debts, your approval votes and any reasons you give, which version of the terms you accepted for a wallet circle, and your Susu Score and its history.
• Wallet susu circles: the mobile money numbers and bank accounts you add, their network or bank, the name each is registered under as reported by Moolre, whether and how each was verified, and the phone number and name attached to each payment. We never see or store your mobile money PIN.
• Budget groups you join: the name you use in the group, your role, and the expenses, contributions, approvals and settle-ups you and other members record there.
• Partner sharing: your invite, the relationship label you choose, whether it was accepted, and the rule results you share.
• Your Plus status and purchase history. App Store purchases reach us through RevenueCat; Android purchases through Paystack or Stripe, which tell us whether a payment succeeded. Card details go to them, never to us.
• Session records, one per sign-in: the surface it was issued to (app or admin dashboard), your device's user-agent and model name, the IP address it came from, and when it was created, last used and revoked. This is what lets you see your signed-in devices and sign them out.
• Security events: sign-ins, failed attempts and sign-outs, lockouts, email and phone verification, password, two-factor and name changes, extra verification checks, rejected breached passwords, linked sign-in providers, and deletion requests, with the email address they concerned.
• Sika Coach: a copy of your recent coach messages and the coach's replies, kept on our servers for safety review, and the AI insight cards we generate for you.
• Service usage: one row per day your account was active — the day, not what you did — and for each coach answer, receipt scan, voice entry or insight, which feature ran it, its size in tokens or seconds of audio, and what it cost us. This is how we watch our own spend and enforce free-tier limits. It never records the content.
• Figures the app works out on your device and reports back — your health score, safe-to-spend, top leaks and milestones — so a notification can quote the same number you see on screen.
• Ad events: impressions and clicks on our own sponsorships, and requests and impressions for full-screen ads, with the placement and your account id where you are signed in, so we can report to sponsors and respect frequency limits.
• Messages: the notifications, text messages and emails we send you, whether our emails were delivered, opened and clicked, the emails you send us and our replies, and your address if you joined the early-access list on our website.
• Feedback you send from the app: your message, the email address you give us to reply to, and your app version, platform and phone model, so a bug you report can be reproduced. If you were signed in we record which account sent it and reply to that account's own address; if you were not, we reply to the address you typed. Our replies are kept with it.
• Crash reports, if the app crashes or hits an error it cannot recover from: what went wrong in the code, the screens and server requests (their address and result, never their content) that led up to it, technical details of your phone (its model, operating system, language, time zone, memory, storage, battery and network connection), the app version, and a random identifier for this installation of the app. They never include your name, email address, account id or money data, and the app removes email addresses, phone and account numbers from the error text before sending. Sentry sees the network (IP) address a report comes from, as any server does, and is set not to store it.

6What we never collect

We do not collect your precise location, your contacts, your calendar, your photo library beyond the single image you pick (identity verification photos are taken with the camera, never chosen from your library), or your browsing activity in other apps. We do not read your text messages: the app only reads an alert you paste into it.

We do not link your bank accounts and we do not read a bank feed. There is no account aggregator in this app.

7Where your information comes from

• From you — almost everything. What you type, scan, dictate, paste or import.
• From your device, with your permission — camera and photo library for receipts and your profile photo, the camera for identity verification if you choose it, microphone for voice entries, notification permission for reminders and biometrics for the app lock. The app-lock biometric check happens on your device; we never receive your fingerprint or the face data your phone uses to unlock. The one picture of your face we do receive is the identity verification selfie, and only if you send it: it is a photo that a person on our team looks at, not biometric data we process by machine.
• From other people — members of your circles and groups record things that involve you, such as a payment you made or an expense you share.
• From our partners — the name an account is registered under and the result of each payment from Moolre, your purchase status from RevenueCat, Paystack and Stripe, delivery and open events for our emails from Resend, and your email and identifier from Google or Apple if you sign in that way.

8How we use it, and our legal basis

Under the GDPR we must name a lawful basis for each purpose, and under Ghana's Act 843 we must process fairly and for a stated purpose. Both are set out here.

• Running your account, storing and syncing your records, and producing your budgets, insights, forecasts and coach answers — to perform our contract with you.
• Reading the receipts and voice notes you submit — to perform our contract, at your request.
• Running susu circles, budget groups and partner sharing, and verifying that a wallet is yours — to perform our contract, and to meet our legal obligations under payments and anti-money-laundering law.
• Sending the notifications and text messages you have switched on — your consent, which you can withdraw in Settings.
• Billing and entitling Plus — to perform our contract.
• Keeping accounts secure, investigating abuse and reviewing coach conversations for safety — our legitimate interest in protecting users, and our legal obligations.
• Answering support requests, including looking at and correcting your records when you ask — to perform our contract, and our legitimate interest in running the service.
• Showing ads on the free tier — our legitimate interest in funding a free tier — and personalising them on Android, only with your consent (see the advertising section below).
• Understanding and improving the service from usage counts — our legitimate interest in operating and sizing it.
• Finding and fixing crashes from crash reports — our legitimate interest in keeping the app working.
• Emailing account holders about the service, with news, tips and offers, and seeing whether those emails are opened — our legitimate interest in telling you about SikaNest, which you can stop with the unsubscribe link in any message.
• Sending launch email to the early-access list — your consent, withdrawable in every message.
• Meeting legal and accounting duties, including susu payment records — our legal obligations.

9Legitimate interests and automated decisions

Where we rely on legitimate interests, we have weighed our interest against your privacy and limited the processing to what a reasonable user would expect from a budgeting app. You can object — see your rights below.

We do not use your data to make automated decisions that have a legal effect on you. Your Susu Score affects only which circles you may join and what members of your own circles can see about your reliability. It never determines credit, and we never sell it or share it outside the circles you are in.

10Where your data lives

SikaNest is local-first. Everything you enter is written to your device immediately and works offline.

If you have an account, the app syncs your financial records to it when you are online so you can restore them on a new phone. Deletions sync too — if you delete a transaction on one device, it is marked deleted everywhere. As a guest, nothing is synced.

Data travels between the app and our servers over encrypted (TLS) connections. On iPhone and Android your session token is held in the device's secure keychain; in a web browser it is kept in the browser's storage. The records on your device are protected by your device's own lock.

11Receipts, voice notes and SMS

Scanning a receipt or recording a voice entry sends that image or audio to our server, which passes it to OpenAI, acting as our processor, to extract the amount, merchant, date and category. We use the result to create a draft transaction for you to confirm, and we do not keep the raw image or recording afterwards. OpenAI may keep what it receives for a limited period to detect abuse, under its API terms.

SikaNest can also turn a mobile money or bank alert that you paste in into a draft transaction. The message text never leaves your device: parsing happens locally, the result is always a draft you confirm rather than an automatic entry, and the module that does it is built so that it cannot make a network request at all.

12Sika Coach and AI

When you ask the coach a question, we send OpenAI your question, your recent messages and the summary of your finances the coach needs to answer: your first name, income and pay frequency, goals, account names and balances, budgets, business totals if you use them, and your five most recent transactions. AI insights are built from a similar summary.

Your conversation is kept on your device so you can read it back, and clearing it removes it there. We also keep a copy of your most recent coach messages and replies on our servers so that authorised staff can review the coach's answers for safety and abuse. That copy is deleted when your account is.

Your content is not training data. Our agreement with OpenAI is on API terms, under which submitted content is not used to train their models, and we do not train models on your financial records either.

The coach gives educational guidance produced from the figures you entered. It is not licensed financial advice, and it can be wrong.

13Susu circles and wallet payments

Classic susu circles are record-keeping only. Money changes hands outside the app and never passes through us or anyone we work with. What we hold is the record the circle keeps together.

If your circle uses the wallet, contributions are collected and held by Moolre Limited, a payment service provider licensed by the Bank of Ghana, in wallets it operates for SikaNest circles. SikaNest never takes possession of your money — custody is Moolre's, and allocating each circle's pot in our ledger is ours.

To verify a mobile money wallet, we text a code to that number. To verify a bank account, we send its number to Moolre and receive back the name it is registered under, which we compare with the full name on your profile. Before a mobile money payment prompt, we look up the name registered to the paying wallet and show it to you. We keep the numbers you add, the registered names and the result of each check, and other people only ever see account numbers masked.

Contributions, payouts, fees and receipts in a circle are part of its shared ledger and are visible to its members — that openness is the point of susu. Members of a circle you share also see your full name, the last four digits of your phone number, your photo, your Susu Score and tier, whether you are verified, your count of on-time, late and overdue payments, the masked number of the account your payout went to, and any reason you give for declining a payout. They cannot see your email address, your full account numbers, or anything about your money outside that circle.

Anyone with a circle's invite link can see its name, description, amount, schedule, member count, joining and payout rules, and the organiser's full name. A personal pay link we text you shows your name and what you owe to whoever opens it.

Text messages about your circles — reminders, receipts and payout notices — are sent through Arkesel and can include the circle's name, amounts, the name of the member being paid and a pay link.

Payment intents, transfers, ledger entries and fee records are financial records. Because they evidence money moving through a licensed provider, they are kept for the statutory period even if you delete your account — together with the name, email address, phone number and, where verified, Ghana Card number of the account they name, so that the records can be traced to a person (see Deleting your account).

14Budget groups

A budget group is shared by design. Everyone in it sees the name you use there, your role, and what is recorded in the group: expenses with their amounts, payees, notes and each person's share, contributions with the account labels attached, approvals, settle-ups and the activity feed. Your personal transactions outside the group stay yours.

Anyone with a group's invite link can see its name, how many members it has and its join code.

If you leave a group, your past entries stay in it. If you delete your account, your entries are removed from the groups you were in, and a group you own is deleted for all of its members.

15Sharing with a partner

SikaNest lets you invite one partner — a spouse, family member or accountability buddy — to see a summary of how your month is going: your full name, and the results and streaks of the rules you set, whose titles can include budget or goal names and amounts. You choose to create the invite, you choose the relationship label, and you can revoke it at any time from the app, which immediately stops the sharing.

The invite link is what grants access, so treat it like a password: anyone who has it can open your summary, and it keeps working until you revoke it. Your partner does not see your transaction list.

16Advertising and your choices

The free tier is funded by advertising, and two kinds appear in the app: our own sponsorships, and ads from one ad network, Unity Ads.

• House sponsorships that we sell and serve ourselves. Sponsors never receive your personal or financial data: placements are chosen by screen location, never by profiling your transactions, balances or budgets, and we report only aggregate view and tap counts. A sponsor's button may open its own website.
• Network ads from Unity Ads, which fill space we have not sold, as banners and occasional full-screen ads. Unity Technologies serves them, through its Unity LevelPlay platform, and processes technical data about your device to do so, under its own privacy policy.
• On Android, ads are personalised only if you say yes. The app asks once, with its own screen: if you allow personalised ads, Unity may use your device's advertising identifier and technical data about your device to choose ads it expects to interest you, which some US state laws treat as sharing your data for advertising. Until you answer, and if you say no, every ad request tells Unity not to personalise the ad, not to sell or share your data, and not to use your device's advertising identifier.
• On iPhone and iPad, ads are never personalised, and every request carries those same instructions.
• Ads are suitable for teenagers. People from 13 can use SikaNest and we never learn anyone's age, so we ask Unity to limit ads to content suitable for teenagers, whether or not they are personalised.
• Rewarded ads are ones you choose to watch for extra uses of a feature. To pay the reward, Unity confirms the view to our server directly, identified by a one-off reward code and a random identifier for your device — never your name, email address or account id.
• You can change your answer at any time in Settings → Ad privacy; it applies from the next time you open the app. You can also reset or delete your advertising identifier, or opt out of ads personalisation, in your Android settings. Saying no never stops you using the app.
• On iOS the app does not ask for App Tracking Transparency permission, so your device's advertising identifier is never available to us or to Unity.
• SikaNest Plus stops ads being requested.

17Who else sees your data

Apart from the people you share with in circles, groups and partner sharing, we share personal data only with the companies that make the service work, and only what each one needs. Every processor is bound by contract to use it solely on our instructions. This is the full list as at the date of this policy:

• Moolre Limited — the mobile money numbers and bank accounts you add, their network or bank, and payment and payout amounts, to collect, hold and pay out wallet susu funds and to tell us the name an account is registered under. A licensed controller in its own right.
• Arkesel — your phone number and the text of the message, to send sign-in and verification codes and susu text messages.
• OpenAI — receipt images, voice recordings, coach questions and the financial summary described above, to read them and generate answers and insights. Our processor, and not used for training.
• Unity Technologies (Unity Ads, through Unity LevelPlay) — device data, a random identifier for your device, and on Android your advertising identifier if you allow personalised ads, to serve network ads on the free tier and to confirm rewarded ads.
• Apple (App Store) — your Plus purchase on iPhone and iPad. Apple holds your card; we never see it.
• Paystack and Stripe — your email address, your account id and your payment, to take Plus payments on Android. They hold your card or mobile money details; we never see them.
• RevenueCat — your account id, or a random id before you sign in, and your purchase status, to track whether Plus is active.
• Expo — your push token and the notification content, to deliver notifications to your device.
• Sentry (Functional Software, Inc.) — crash reports as described above, to find and fix crashes. Stored in Sentry's EU region, in Germany.
• Resend — your email address and the message, to send verification, security, deletion and product email and to tell us whether it was delivered, opened or clicked.
• Have I Been Pwned — the first five characters of a one-way hash of a new password, never the password itself, to check whether it has appeared in a known data breach.
• Google and Apple (sign-in) — nothing from us; they give us an identifier and your email if you sign in that way.
• Replit — everything we store, as the host of our application and database and the service through which we connect to Resend.

18When else we might disclose

Beyond that list, we disclose personal data only to our professional advisers under confidentiality, where we are legally required to such as a valid court order or regulatory demand, to establish or defend legal claims, and to a buyer if the business is ever sold — in which case we will tell you first, and this policy keeps applying until it is replaced by one no less protective.

19What we never do

• We do not sell your personal data. Not to anyone, for any price.
• We do not share your financial records with advertisers, data brokers, lenders or credit bureaus.
• We do not use your transactions, balances or budgets to target advertising.
• We do not post anything on your behalf. Sharing a Wrapped card is always something you do yourself.
• We do not ask for your mobile money PIN, your banking credentials or your one-time codes. Nobody from SikaNest will ever ask you for them.

20International transfers

Our hosting provider and several of our processors — OpenAI, Google, Unity, RevenueCat, Expo, Resend, Stripe and Sentry among them — are based in the United States, so using SikaNest involves transferring your personal data outside Ghana, and outside the EEA and UK.

Where we transfer data out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where relevant, or on the recipient's certification under an approved adequacy framework, together with encryption in transit. Where we transfer data out of Ghana we do so on the basis of your contract with us and safeguards equivalent to those Act 843 requires.

Ask us and we will tell you which safeguards apply to a particular transfer.

21How long we keep it

• Your account and money data — while your account is open, then deleted when it is purged or closed.
• Guest records — on your device only, until you erase them, delete the app, or add them to an account.
• A deletion request — a 30-day grace period from when you ask, during which the account stays usable so you can keep it.
• Receipt images and voice recordings — not retained by us; discarded once the draft transaction is created.
• Identity verification documents (card number, card photos and selfie) — if approved, kept while your account is open so the verified mark can be stood behind, and deleted when your account is purged. If your account is closed because susu money moved through it, the card photos and selfie are deleted then, and the card number alone is kept with the closed account for the period below. If rejected, deleted as soon as you send a new attempt, and in any case 30 days after the decision; the decision and its reason are kept so you can see them. They are encrypted before they are stored, so our own backups hold no readable copy; they are shown only to our review team, and every time a staff member opens one it is logged.
• Coach conversations — on your device until you clear them; our server copy of your most recent messages until your account is deleted.
• AI insight cards — up to seven days.
• Crash reports — deleted automatically by Sentry within 90 days.
• Feedback you sent from the app — deleted with your account if you sent it while signed in. Feedback sent without an account has no account to delete with it, so we keep it for up to 24 months and then remove it.
• Session records — deleted 30 days after the session expires or is signed out.
• Security and audit events — retained for security investigation, with the link to your account removed on deletion and only an email snapshot left.
• Susu wallet payment and ledger records — kept for the statutory financial-records period under payments and anti-money-laundering law, even after account deletion. Our ledger is append-only: corrections are posted as offsetting entries, never by editing history.
• A closed account's identity — where those records name you, your name, email address, phone number, country and Ghana Card number are kept with the closed account for six years from the day it closed, then removed, leaving the records pointing at an anonymised account (see Deleting your account).
• Deletion request records — kept after the account is gone as proof of when you asked, when we deleted, and that we told you.
• Push tokens and records of the messages we sent you — kept as delivery history.
• The marketing list — until you unsubscribe, plus a suppression record so we do not email you again by accident.
• Aggregate usage statistics — indefinitely, in a form that cannot identify you.

22How we protect it

• Passwords stored only as bcrypt hashes, with a policy that blocks weak passwords and checks new ones against known breaches.
• Revocable sessions: every sign-in has a server-side record, so signing out or resetting your password kills the token immediately rather than leaving it valid until it expires.
• Two-factor authentication by email or SMS, a fresh code before sensitive changes such as adding a payout account, and a biometric app lock on your device.
• Encryption in transit, with your session token in the device keychain on iPhone and Android.
• Minimised payment data — no mobile money PINs, no card details, no banking credentials, and account numbers masked wherever other people see them.
• Administrative access limited to staff with an admin role. They can see account, circle and financial records when they need to — for support, fraud checks, payment reviews or a legal duty — and changes they make are written to an audit log.
• Rate limiting and lockouts on sign-in, password reset and other sensitive endpoints.

23If something goes wrong

No system is perfectly secure. If a breach of your personal data occurs and it is likely to present a risk to you, we will notify you and the relevant regulator without undue delay, and within 72 hours where the GDPR requires it.

Your part matters too: use a password you use nowhere else, turn on two-factor authentication, keep your device locked, and never share a one-time code, a pay link or an invite link with someone you do not trust.

24Your rights and how to use them

Most of these you can exercise yourself, immediately, without contacting us.

• Access — everything we hold about your money is visible in the app. For a copy of the rest, including any feedback you have sent us and our replies, email us.
• Portability — Settings, then Export my data, as JSON or CSV, for the records kept on your device. For your susu, group and coach records, email us.
• Correction — edit any record in the app, or your profile in Settings.
• Erasure — Settings, then Delete account. As a guest, Settings, then Erase this phone's data.
• Withdraw consent — notifications and susu text messages in Settings, personalised ads on Android in Settings → Ad privacy, product email via the unsubscribe link in any message.
• Object to processing we base on legitimate interests — email sikanest@gmail.com and tell us what you object to.
• Restrict processing — email us, and we will limit processing while a dispute is resolved.
• Complain — to us first, and then to your regulator.

25The limits on those rights

We will not charge you for exercising a right, and we will never make the service worse for you because you did. We may need to verify who you are before acting on a request sent by email — that protection exists for you.

Some requests have limits we will always explain: we cannot erase a susu payment record we are legally required to keep, and we cannot remove your contributions from a circle's shared ledger while other members' entitlements depend on it.

26Deleting your account

You can delete your account from Settings, without asking us and without explaining why. If you signed up with Google or Apple and never set a password, you will need to set one first. What happens then:

• We open a 30-day grace period and email you to confirm, with a reminder before it ends. Your account stays fully usable throughout — that is the point, so a mistaken or coerced deletion can be undone.
• To keep your account, sign in at any time in those 30 days and choose Keep my account.
• When the period elapses, your account and its records are purged from our servers and we email you to confirm it is done. Your entries are removed from budget groups you were in, and any budget group or classic susu circle you own is deleted for its members.
• If susu money has moved through your account — a wallet payment, payout, USSD payment or ledger entry names you, or you owe a circle a shortfall — those records must be kept, and they must be traceable to a person if a dispute, a fraud investigation or a regulator ever requires it. So your account is closed rather than erased: everything listed above is still deleted, but we keep your name, email address, phone number, country and, if you verified your identity, your Ghana Card number, together with the susu records themselves. Our legal basis is the record-keeping obligation that applies to those payments. What is kept is seen by SikaNest staff only, is never used to contact you or for marketing, and is removed six years after the account closed, after which only an anonymised account remains behind the records. A closed account cannot be signed in to, and its email address and phone number stay attached to it — so they cannot be used to open a new account. If you want the account back, email sikanest@gmail.com and we will reopen it: your susu history will still be there, your other data will not. Wallet circles you belonged to show you as a deleted member either way.
• If money of yours is still moving in a wallet circle when the 30 days are up — a contribution or payout that has not settled, or a refund a circle still owes you — we let it finish first and purge shortly afterwards.
• What survives: the record that you asked and that we deleted, security and audit events with the link to your account severed, susu wallet payment records we must keep by law and, for a closed account, the identity described above for six years. Anonymised, aggregate figures that cannot identify you may remain in our usage statistics.
• Deleting your account does not cancel SikaNest Plus. Cancel an App Store subscription in your Apple account settings, and email us to cancel one you pay through Paystack or Stripe, or you may keep being billed.

27Children and teenagers

SikaNest is not for children under 13, and we do not knowingly collect personal data from anyone under 13. If we learn that a child under 13 has created an account or given us personal data, we will delete it. If you believe that has happened, contact sikanest@gmail.com.

If you are 13 to 17, you need a parent or guardian's permission to use SikaNest. Wallet susu circles are for adults only: you must be 18 or over to create, join or pay into one.

In some countries, including parts of the EEA, you must be older than 13 — up to 16 — to agree to data processing yourself. If that applies to you, anything we base on your consent — allowing personalised ads on Android among it — needs your parent or guardian's agreement. On iPhone and iPad ads are never personalised, and everywhere they are limited to content suitable for teenagers.

We do not ask for your date of birth, so we rely on you and your parent or guardian to follow these age rules.

28Cookies and our website

Our website at sikanest.com is a static site with no advertising or analytics cookies and no third-party trackers. We set no cookies on it at all.

The site stores one value in your browser's local storage — a note that you dismissed the announcement bar. If you join the early-access list, your email address is sent to our own server, and we use Resend to send you a welcome email and later news, which you can unsubscribe from.

Our administrative dashboard, which only staff can reach, uses strictly necessary cookies to keep an administrator signed in and to protect against forged requests.

29Changes to this policy

If we change how we handle your data in a way that affects you, we will tell you in the app before the change takes effect — not by quietly editing this page.

The date above this document always reflects the wording you are reading, and the same policy is readable offline in the app and at sikanest.com/privacy.

30Contact and complaints

Privacy and everything else: sikanest@gmail.com.

Please come to us first — most things we can simply fix. If you are not satisfied, you have the right to complain to a regulator:

• Ghana — the Data Protection Commission, at dataprotection.org.gh.
• The EEA — your national data protection authority.
• The UK — the Information Commissioner's Office, at ico.org.uk.