Privacy

We ask for your M-Pesa number so the payment prompt can reach your phone. Paystack processes the payment; iTip never sees or stores your M-Pesa PIN. We keep a masked version of your number for your receipt and for support, and we use your full number to send that receipt by SMS.

Your number is never shown to the worker you tipped, and it is never published anywhere.

When you tip, you can write a short note. The worker you tipped can choose to show that note on their public iTip page, where anyone who scans their code can read it. We never show your name, your phone number, the amount you tipped, or when you tipped it — only the words you wrote. The worker chooses; we do not publish notes automatically.

Because a note can be shown publicly, please do not put anything in it that you would not want a stranger to read, and avoid naming other people.

Ratings are anonymous. A worker can see the stars they received and can choose whether an average rating appears on their public page, but no rating is ever linked to your name or number for them.

If you give one or two stars we ask what went wrong. That reply is private: it goes to the worker and to iTip support only, and it can never be published on their page.

We store your name, photo, service, the business and area you give us, your iTip code and your M-Pesa payout number, so that customers can find you and Paystack can pay you.

Two things on your page are your choice alone: whether your star rating is shown, and which customer notes are shown. You can turn either off at any time, and nobody else — not iTip staff and not a business you are linked to — can turn them on for you. Your earnings are never shown on your public page.

We sign you in with your phone number and a PIN, and we send a code by SMS when you use a new device. We keep a record of which devices you have verified, and a count of recent sign-in attempts, so we can stop someone guessing your PIN.

To see where people get stuck, we record anonymous events as you move through a tip page — that the page was opened, that a rating was given, that a payment prompt was sent, whether it succeeded. These carry amounts and timings, never your phone number and never the words you wrote.

Your browser keeps a random identifier so that re-rating the same worker updates your rating instead of adding a second one. We store only a one-way hash of it, and a similar hash of your network address, to stop one person flooding a worker with ratings. Neither can be turned back into you.

If you tick “remember my number” after a tip, that number is saved on your own device only, so your next tip is one tap. It is never sent anywhere until you actually tip again, and clearing your browser data removes it.

Paystack processes payments and settles money to M-Pesa. Belio sends our SMS messages. Lovable Cloud hosts our database. We do not sell your data and we do not use it for advertising.

A worker can take any published note off their page at any time from their dashboard. If you wrote a note and want it taken down, or you want your data deleted, contact iTip support and we will act on it.