Privacy

1. What we hold about buyers

Your mobile number, because that is how you sign in and how your runner reaches you. Everything else is optional and only there if you typed it: a display name, an email address, a profile photo, and your preferred language.

Your orders, and the delivery details you enter for them: pickup point, or area, directions, and GhanaPostGPS address. If you tap "use my location" on a door delivery, the coordinates your phone returns are saved on that order so your runner can navigate to you. Your phone asks you first, we never read your location in the background, and you can remove the pin at any time before the run arrives. Opening a pin (yours or your runner opening it to find you) sends that coordinate to the map provider in the link, the same as pasting it into a maps app yourself. Your basket. Messages you send your runner. Your ratings and reviews, which appear to other buyers under a shortened name, never your full number.

Your settings: whether you want WhatsApp updates, and whether data saver is on.

2. What we hold about runners

Runners are verified, so they give more. On top of everything above: Ghana Card number and the name on it, the identity photos ops reviews, and the name their mobile money account is registered in, which must match before any payout can leave.

Runners also create public material: a storefront name and address, listings and photos, run descriptions, and the evidence they seal on every run.

Buyers are never asked for identity documents. No Ghana Card, no selfie, no card details.

3. How identity data is protected

Ghana Card numbers, the names on them, and the provider's verification payloads are encrypted in our database. They are never written to logs. In the staff admin they are masked in list views, and only ops can open a verification to review it.

Identity photos are never served from a public address. They are only reachable through a permission-checked path, and are excluded even from the developer's local file server.

4. What we never see

Your mobile money PIN. Your bank or card details. You approve payment on your own handset with your own PIN; Walupi receives only a confirmation that a payment succeeded, its amount, and its reference.

5. Who can see what

Your runner sees what they need to deliver: your name as you gave it, your number, your order, and your delivery details. On a run page other buyers appear only as masked labels and counts, never as numbers.

Someone receiving an order for you. If you name a receiver (buying for family at home, for example), they get delivery updates by SMS and can follow the order once they verify their own number. They never gain control of your money: paying, cancelling, confirming, disputing, and rating stay with you.

Walupi ops can see orders, money movements, verifications, and problem reports, because resolving them requires it. Staff actions on money, verifications, and disputes are recorded with who did them.

The public sees a run's evidence trail on public runs, because an inspectable trail is the point of Walupi. Evidence attached to your individual order, such as your handover photo, is not public.

6. Messages we send, and switching them off

We send milestone updates, payment and refund notices, and problem report updates. In the app these always appear in your notifications, because that record is how you check what happened.

WhatsApp and SMS updates are optional: turn them off in account settings at any time. One exception, and it is deliberate: sign-in codes always send, because they are how you get into your account.

7. Evidence files

Every photo or document sealed on a run is fingerprinted with a SHA-256 hash when it uploads. Nobody can edit or delete it afterwards, including Walupi staff. A correction is a new file that points at the one it replaces, so the record stays honest in both directions.

8. Who else is involved

Paying and being paid runs through our licensed payment partner, a licensed payment provider. They receive what a payment needs: the amount, a reference, and the mobile number paying or being paid.

Sign-in codes and SMS updates go through a messaging provider. Error reports may go to a monitoring service to help us fix crashes.

To be confirmed: the named list of providers used in production, and the country each stores data in

9. How long we keep it

Money records, milestones, and evidence are permanent by design: they are the proof that protects both sides of an order, and the system cannot delete them.

To be confirmed: how long we keep everything else, and what happens to an account that asks to be closed

10. Your choices and how to reach us

You can edit your name, email, photo, and language, and switch messages off, in account settings. You can see every pesewa in and out on my money.

To be confirmed: the privacy contact address, the rights we commit to (access, correction, deletion), and how long we take to answer