Last updated: October 2026. Necpra ("we", "us") is committed to protecting your personal data.
What we collect
Account info: name, email, username, hashed password (if you set one), profile photo, cover photo, bio.
Google sign-in: if you use "Sign in with Google," we receive your Google account ID, name, email and profile photo from Google to create and authenticate your Necpra account.
Messages and calls: message content is end-to-end encrypted in transit and at rest on our servers — we cannot read it. We do process message and call metadata we are not able to encrypt away, including sender/recipient account IDs, timestamps, chat/group membership, delivery and read status, and (for calls) duration and participants.
Media: photos, videos and audio you upload (profile/cover photos, chat attachments, Status/Vibe posts, voice messages) are stored with our media hosting provider (Cloudinary) or on our servers.
Status/Vibe: the posts you share, who you've set them visible to, and viewer/like/comment activity on them.
Groups: group membership, roles, and moderation actions taken in groups you belong to.
Social data: your friends, blocked users, and reports you submit or that are submitted about you.
Device permissions: camera and microphone are accessed only when you actively capture a photo, video or voice message — never in the background.
Push notification token: a device-specific Firebase Cloud Messaging token, used only to deliver notifications to your device.
Encryption key material: your public identity/pre-keys, needed for end-to-end encryption to work, and an encrypted backup of your private key material (encrypted with a key only you control) if you enable key backup.
Device/session info: browser type, OS, IP address, and active login sessions, for account security.
Marketplace/payments (if you use them): order, wallet, payout and accommodation-booking records, and payment metadata from our payment processors (e.g. M-Pesa, card networks) — we do not store your full card or mobile-money credentials ourselves.
Location (optional): if you use friend or group discovery that needs your area, the app asks for location permission (you can allow approximate or precise). It is used only while you use that feature, to show nearby suggestions; it is not collected in the background, and you can refuse or revoke it in your phone settings without losing other features.
Wallet and payments: if you use the wallet, we process your mobile-money phone number, amounts, transfers, withdrawals, top-ups, airtime purchases and the resulting transaction records. Payments are handled by Safaricom M-Pesa (Daraja) and other payment providers; we do not receive your M-Pesa PIN or full card details. Financial records are kept for as long as the law requires.
Games: your arcade progress, scores, coin balance, and the results and moves of live matches you play with friends.
Age: Necpra is for people aged 13 and over. We do not knowingly collect data from children under 13; if we learn that we have, we delete the account. Wallet features are for users aged 18 and over.
How we use your data
We use your data to provide and improve the service, keep the platform safe (including reviewing reports and enforcing blocks), send security alerts, process marketplace/accommodation transactions you initiate, and — with your consent — personalise your experience.
Your preferences
Analytics cookiesHelp us improve Necpra (anonymous)
Marketing emailsProduct updates and offers from Necpra
Third-party integrationsShare anonymised data with analytics partners
Service providers
We share data with providers who help us run Necpra, under contracts limiting their use of it: Cloudinary (media hosting), GIPHY (GIF search - only the search words you type are sent, through our server), Google Firebase (push notifications and, if you use it, Google sign-in), Safaricom M-Pesa and other payment processors (wallet, marketplace and accommodation transactions), and our hosting provider. We may also disclose information when the law requires it or to protect users from harm. We do not sell your personal data and we do not show third-party ads.
Data retention and deletion
You may delete your account at any time from Settings, or via our account deletion page if you no longer have the app installed. On deletion, your profile is immediately anonymised, your active sessions are revoked, and you leave all groups. Remaining data — including messages, Status/Vibe posts and their hosted media, and account records — is permanently deleted within 30 days. We may retain limited information beyond that where required by law (e.g. transaction records for tax/fraud purposes) or to resolve an active dispute, and will disclose any such retention if it applies to you.