StokFam Privacy Policy

StokFam is a stokvel record-keeping and coordination app developed and operated by Quill Qode (Pty) Ltd (“QuillQode”, “we”, “us”, or “our”). For purposes of South Africa’s Protection of Personal Information Act, 2013 (“POPIA”), QuillQode is the responsible party for the personal information described in this policy.

Who this policy covers

This policy applies when you use the StokFam mobile app, visit its related web pages, or contact us about StokFam. It does not govern services that you choose to use outside StokFam, including your bank or payment provider.

Information we handle

Account and identity information

We process your display name, email address, verification status, password hash, authentication tokens, account dates, and identifiers associated with sign-in. If you use Sign in with Apple or Google, we receive the identifier and account information that provider makes available to StokFam, such as your verified email address and name.

Stokvel and financial record information

We process the stokvels you create or join, your role and membership dates, group names, descriptions and rules, contribution amounts, savings goals, schedules, payout order, transaction records, notes, reversal reasons, and related timestamps. StokFam records these activities; it does not receive, hold, or transfer the money represented by them.

Files you choose to upload

When you submit proof of a contribution, we process the image or PDF, its original file name, type, size, uploader, and the ledger entry to which it belongs. Camera and file access are used only when you choose to capture or select a payment proof.

Device, usage, and diagnostic information

We process session information, IP address, user agent, app version, operating system, push-notification token, notification preferences, screens and features used, crash reports, performance data, and technical logs. Diagnostic tools may capture interaction details or a sampled replay of an app session so that we can reproduce errors. We use safeguards and configuration controls intended to limit unnecessary sensitive content in diagnostic data.

Information stored on your device

StokFam stores authentication tokens in protected device storage and may cache app data locally to improve reliability and offline use. A biometric app lock can use your device’s Face ID, fingerprint, or passcode facilities; StokFam does not receive or store your biometric template.

How we use information

• Provide accounts, sign-in, email verification, and account security.
• Create and administer stokvels, memberships, cycles, schedules, and invitations.
• Record contributions and payouts and make the shared ledger available to authorised group members.
• Store and display payment proofs to authorised members where the app permits access.
• Send service, security, group, and transaction-related email or push notifications.
• Provide support, investigate misuse, prevent fraud, and enforce our Terms of Use.
• Measure reliability and feature usage and diagnose crashes and performance problems.
• Meet legal, regulatory, accounting, and dispute-resolution obligations.

Under POPIA, we process personal information where it is necessary to provide the service you requested, with your consent where required, to meet a legal obligation, or to pursue a legitimate interest such as securing and improving StokFam without overriding your rights.

When information is shared

StokFam is a group service. Your display name, membership, role, contribution and payout records, and payment proofs may be visible to other authorised members or administrators of the same stokvel. Do not upload information that your group does not need.

We also disclose information only as needed to:

• infrastructure and storage providers that host the app, database, background jobs, and uploaded files;
• email and notification providers, including Expo’s push-notification service;
• authentication providers when you choose Apple or Google sign-in;
• analytics and diagnostic providers, including Vexo and Sentry, which help us understand usage, crashes, performance, and support feedback;
• professional advisers, regulators, law enforcement, courts, or other parties where the law requires it or where necessary to protect rights and safety; and
• a successor involved in a merger, financing, reorganisation, or sale, subject to appropriate confidentiality and data-protection measures.

We do not sell personal information, and StokFam does not use it for third-party advertising.

International processing

Some providers may process information outside South Africa. Where information crosses a border, we use providers and safeguards intended to provide an appropriate level of protection consistent with POPIA.

Retention and account deletion

We keep personal information only for as long as it is reasonably needed for the purposes described above. Retention depends on the type of record, whether your account or stokvel remains active, security needs, disputes, and legal or audit obligations.

You can delete your account in StokFam under Settings → Account → Delete account. You must first transfer administration of any active stokvel that you administer. After you confirm deletion, active memberships are deactivated, push tokens are disabled, active sessions are revoked, and you can no longer sign in. The account record is scheduled for permanent deletion after 90 days.

Some historical stokvel, ledger, and audit records may remain where deletion would damage the integrity of records shared with other group members or where retention is required for legal, security, fraud-prevention, or dispute-resolution purposes. We restrict and minimise retained information where reasonably possible. To request deletion without the app, email [email protected] from the address linked to your account and use the subject “StokFam account deletion”. We may need to verify your identity before acting on the request.

Security

We use technical and organisational safeguards designed to protect personal information, including encrypted network connections, password hashing, protected token storage, access controls, time-limited sessions, and restricted file access. No system is entirely secure, so we cannot guarantee that unauthorised access will never occur.

Your choices and rights

Depending on the circumstances, POPIA may give you the right to ask whether we hold your personal information, request access or correction, ask for deletion or restriction, object to certain processing, withdraw consent, or complain about our handling of your information. You can update some information in the app or contact us at [email protected]. You may also lodge a complaint with the Information Regulator of South Africa.

You can disable push notifications in StokFam or your device settings. Disabling a permission may prevent the related feature from working, but it does not affect features that do not need that permission.

Children

StokFam is intended for adults managing or participating in stokvels. We do not knowingly allow children under 18 to create accounts. Contact us if you believe a child has provided personal information through StokFam.

Changes to this policy

We may update this policy when StokFam, our providers, or legal requirements change. We will publish the revised policy here, change the effective date, and provide additional notice in the app when a change materially affects your rights or how we use information.