Xitique
Legal document
Privacy policy
This policy explains what personal data the Xitique app collects, what it is used for, who it is shared with, and how you can control or delete it.
1. Who handles your data
The Xitique app is built and operated by the Xitique team, based in Maputo, Mozambique. We are responsible for the processing of the personal data described in this policy. For any privacy question, write to privacidade@xitique.co.mz.
By creating an account and using the app you agree to your data being processed as described here and in the Terms and Conditions.
2. Summary
- We collect only what the app needs to work.
- We do not sell your data and we do not use it for targeted advertising.
- There are no advertising trackers in the app and no data goes to ad networks.
- Xitique does not process payments and has no access to your M-Pesa, e-Mola or bank accounts.
- Some of your information is visible to the members of your groups — see section 5.
- You can delete your account and data at any time — see Delete account.
3. Data we collect
3.1 Data you give us
- Account data: name, username, email address and password (stored encrypted, never in plain text).
- Profile: phone number and profile photo, if you choose to add them.
- Group content: group names, contribution amounts, frequency, dates, payout order and any notes you write.
- Proof of payment: the photos or screenshots you attach to the contributions you record.
- Support messages: the content of emails or messages you send us.
3.2 Data generated by use
- Activity log: contributions recorded, members joining and leaving, cycles started and closed, with the date and who did it.
- Minimal technical data: server logs generated when the app talks to our services (IP address, timestamp, request type), used for security and troubleshooting.
3.3 What we do not collect
- We do not collect your location.
- We do not read your contacts, SMS messages or other apps on your phone.
- We do not collect card details, PINs, balances or banking and mobile wallet credentials.
- We do not use advertising identifiers and we do not track you across apps.
4. What we use it for
| Data | Purpose | Basis |
|---|---|---|
| Email, password, username | Create your account, sign you in and recover your password | Performance of the service you asked for |
| Name, photo, phone number | Identify you to the members of your groups | Performance of the service / consent (optional fields) |
| Groups, dues, cycles, contributions | Show the state of the xitique, its history and whose turn it is | Performance of the service |
| Proof of payment | Let the group confirm a recorded contribution | Performance of the service |
| Technical logs | Security, abuse prevention and bug fixing | Legitimate interest in keeping the service safe |
| Support messages | Answer your request | Performance of the service |
We do not use your data for targeted advertising, we do not sell it and we do not pass it to data brokers.
5. What other members see
A xitique is by nature a group activity. When you join a group, the other members can see:
- your name and username and, if you have set one, your profile photo;
- the contributions you record, with the amount, date and attached proof;
- your position in the payout order and the amounts you have received;
- your actions in the group activity log (joining, leaving, contributing).
Your email address is the one thing other members never see. Only attach proof you are comfortable showing the group — if a payment screenshot contains information you would rather not share, hide it before attaching.
6. Who we share with
We share data only in these cases:
- Infrastructure providers. The app uses Supabase to host the database, authentication and file storage. Supabase processes the data on our behalf and on our instructions.
- App stores. Google Play and the Apple App Store handle distribution of the app and may collect their own install and diagnostic data under their own policies. We have no access to your Google or Apple account.
- Legal obligation. Where required by law or by a decision of a competent authority, and only to the extent required.
There are no ad networks, behavioural analytics tools or tracking SDKs in the app.
7. Where data is stored
Data is stored on servers managed by Supabase, which may be located outside Mozambique. By using the app you accept that your data is processed on that infrastructure, always subject to contractual and technical protection measures.
8. How long we keep it
- Account data is kept for as long as the account is active.
- After a deletion request, the account and the personal data attached to it are erased within 30 days at most.
- The history of the groups you took part in (amounts, dates and cycles) may be kept without identifying you, because it also belongs to the other members and is needed for the group's books to balance.
- Technical logs are kept for a short period, normally up to 90 days.
- We may keep information longer where the law requires it or to defend our rights in a dispute.
9. Security
- All traffic between the app and our servers is encrypted in transit (HTTPS/TLS).
- Passwords are stored only as hashes, never in plain text.
- Data access is enforced at the database level by rules that ensure you only see the groups you belong to.
- Administrative access is limited to the people who need it to operate the service.
No system is entirely free of risk. If we detect an incident affecting your data we will tell you, and notify the competent authorities where required. Choose a strong password, do not reuse it elsewhere, and tell us if you suspect someone else has access to your account.
10. Your rights
In relation to your personal data, you can:
- Access — find out what data we hold about you;
- Correct — update your name, email, phone number or photo directly in the account screen;
- Export — ask for a copy of your data in a readable format;
- Delete — erase your account and the data attached to it;
- Object or restrict — ask us to stop processing certain data, where applicable;
- Withdraw consent — where processing relies on your consent, without affecting what was done before.
To exercise any of these rights, write to privacidade@xitique.co.mz from the email address on your account. We answer within 30 days at most. If you are not satisfied with our answer, you can complain to the competent authority in Mozambique.
11. Deleting your account
You can delete your account at any time, without having to talk to us. The Delete account and data page explains the procedure, what is erased, what is kept and how long it takes.
12. On-device storage and cookies
The app stores your signed-in session and a few preferences (such as your active group) on your phone, so you do not have to sign in every time. This information stays on the device and is removed when you sign out or uninstall the app.
This website (xitique.wei.co.mz) is static and uses no cookies, no analytics and no tracking. Typefaces are loaded from Google Fonts, which means your IP address is visible to Google for that request.
13. Children
Xitique is intended for people aged 18 and over and is not directed at children. We do not knowingly collect data from minors. If we learn that an account belongs to a minor we will delete it. If you are responsible for a minor who created an account, contact us and we will remove it.
14. Changes to this policy
We may update this policy to reflect changes in the app or in the law. The date at the top shows the version in force. Material changes will be announced in the app before they take effect.
15. Contact
Privacy and data protection:
privacidade@xitique.co.mz
General support: suporte@xitique.co.mz
Xitique · Maputo, Mozambique