Privacy policy

We collect information you provide or generate while using Tokosss:

• Phone number, name, username, profile photo, and profile details.
• The places you give for delivery or collection, with their landmarks, voice notes, photos, and handoff positions (see “Places, landmarks and handoff evidence”).
• Your live position, only when you agree to share it with the transporter coming to meet you (see “Live location sharing”).
• For an approved transporteur, explicitly going On duty opens an active delivery shift/run and starts foreground or background location collection. The shift/run may be waiting for its first parcel assignment so Tokosss has a fresh position for dispatch. Readings include location, accuracy, capture and receipt times, movement information, and technical integrity signals. Tracking stops when the transporteur goes Off duty, the shift/run closes, permission is revoked, the user signs out, or the account is suspended.
• Listings, photos, posts, stories, comments, reviews, messages, reports, and support requests.
• Chat delivery and visible-read cursors used to show Sent, Delivered, and Seen status, together with your read-receipt preference.
• When content is reported, a restricted evidence snapshot of the reported text and relevant media references or metadata, together with report context and account history needed for review.
• What you look at in the app: the products and sellers shown to you, the ones you open, and what you search for (see “What you look at in the app”).
• Device and push-token information needed for security and notifications.
• If you apply for a verified role, identity-document photos and a photo of yourself.

We use this information to create and secure accounts, operate the marketplace, process orders and payments, arrange collection and delivery, dispatch active transporteurs, show delivery progress, protect handoffs, investigate delivery or safety issues, communicate order activity, review applications, prevent fraud and abuse, provide support, and improve Tokosss. We do not use active-run tracking for off-duty monitoring.

We share only what is reasonably needed to provide the service:

• Order and handoff details with the relevant seller or transporter.
• Your live position with the transporter handling your collection or delivery, during a share you agreed to (see “Live location sharing”).
• Payment details with the selected mobile-money provider.
• The messages you send to the Tokosss account, with the AI provider that writes Tokosss's first answer (see “Messages to Tokosss”).
• What people write that needs translating, with the same AI provider (see “Automatic translation”).
• Information with service providers that host, protect, monitor, or support Tokosss.
• Information when required by law or necessary to protect users and the platform.

Tokosss does not sell personal information. A reporter's identity and report evidence are restricted to authorized staff and service providers that need them for safety operations; Tokosss does not show the reporter's identity to the reported user. Identity documents are restricted to authorized review staff. A verified user's verification photo may be shown to an active delivery counterparty solely to help complete a handoff. Messages between a buyer or seller and the transporter handling their order are there to arrange the handoff: authorized Tokosss operations staff may read them to coordinate the delivery, help both parties, and handle a problem or dispute, and every such read is logged.

We keep information only as long as it is needed:

• Account and profile information is kept while your account is active and removed when a verified deletion request is completed.
• Chat text is kept with the conversation. When you delete your account, the messages you sent are deleted, except those under a documented hold.
• Photos, videos, and voice notes shared in chat become unavailable to users after 72 hours. A documented dispute, fraud, or legal hold may preserve restricted evidence internally, but does not make expired media available in chat again.
• The positions in a live location share are erased as soon as the share ends, at most 2 hours after it starts.
• Raw operational transporteur location heartbeats are automatically deleted 30 days after receipt. Collection or delivery GPS saved as handoff evidence may be kept with the related order, dispute, fraud-prevention, or legally required record instead.
• Order, payment, and payout records are kept for 10 years, as required by the OHADA accounting rules that apply to businesses in Cameroon.
• Identity-verification records are kept for 5 years after the verified role or account ends, in line with regional anti-money-laundering standards, or longer where the law requires.
• A report's evidence snapshot can remain available to authorized staff even if the original content is edited, recalled, deleted, or expires. Report, evidence, decision, appeal, and audit records are kept only as long as reasonably needed to review the case, protect against repeated abuse, resolve an appeal, or meet a legal obligation, then deleted or de-identified under Tokosss retention procedures.
• The record of which sellers the Sellers tab showed you, and which you opened, is deleted after 90 days.
• Login codes expire within minutes and are never stored in plaintext.
• Records tied to fraud prevention, an open dispute, or a legal obligation are kept under a documented, access-controlled hold until the matter is closed, then removed on the applicable schedule above.

You can update profile information in the app, manage notification and location permissions through your device, and request account deletion. In chat, you can edit the text of an ordinary message you sent for up to 15 minutes, hide an ordinary message from your own view before it expires, or recall an ordinary message for both participants within 15 minutes. Tokosss labels edited messages and shows a deletion notice after recall. System, offer, payment, order, price-change, and other transactional messages cannot be edited or deleted by users. Recall cannot remove a push already delivered, a screenshot, or a copy the recipient made outside Tokosss.

Read receipts are on by default. You can turn them off in Account & preferences. Seen status is reciprocal: it appears only when both participants have read receipts on. Sent and Delivered status continue to appear when read receipts are off, and your private unread state continues to work.

A transporteur chooses when to go On duty and can stop active-run tracking by going Off duty; turning off required location permission may prevent assignment to or completion of a delivery run. You can also ask us to access or correct the information we hold about you, in line with Cameroon's personal-data protection law (Law No. 2024/017 of 23 December 2024), by writing to support@tokosss.com. Some transaction and safety records are retained on the schedule in section 4 where the law or fraud-prevention and dispute-resolution needs require it.

Request account deletion →

To deliver your orders, Tokosss keeps the places you give: your usual place and any place you use for a single delivery, each with its quartier, a written landmark, and an optional voice note. When a transporter first collects or delivers at one of your places, Tokosss may record the GPS position of that handoff as the place's position, and the transporter may take a photo of the landmark so that the next transporter finds it. Each collection and delivery also keeps a photo and, where available, a GPS reading as evidence.

Your place, its landmark, voice note, photo, and position are shown only to the transporter assigned to a collection or delivery there and to authorized Tokosss operations staff, never to the other party of the order or to other users. The exception is a verified shop: its name and quartier appear on its public page. You can change your usual place in the app. Tokosss operations staff can also change it, or move a paid order to another place, at your request or so that the handoff can happen. When your account is deleted, your places' landmarks, voice notes, photos, and positions are erased; handoff evidence stays with the related order record under the retention schedule above.

When a transporter arrives for a collection or a delivery, they can ask you to share your live position so you find each other. Nothing is shared until you tap “Share my location”.

During the share, your phone sends your position and its accuracy to Tokosss every few seconds, including while the app is in the background; a notification (Android) or the location indicator (iPhone) stays visible while it runs. Only the transporter handling that collection or delivery and authorized Tokosss operations staff see your position; the other party to the order never does. You see the transporter's position, and they see yours. To show when the transporter should arrive, Tokosss sends the transporter's latest position and yours (or your place's pin) to Google's route service, which returns only a travel time.

The share stops when the parcel is handed over, when you or the transporter tap “Stop sharing”, when another transporter takes over the parcel, after 30 minutes without the transporter getting closer, and at the latest 2 hours after it started. Tokosss keeps only each person's latest position during the share and erases it as soon as the share ends; only the share's start and end times, and how it ended, stay with the order. A shared position never becomes your place's position, which comes only from the handoff.

The share uses only the “While using the app” location permission. You can withdraw it at any time in your phone's settings; the transporter can then call you or write to you in the order's chat.

When you write to the Tokosss account in the app, an automatic assistant reads your message and may give the first answer: for example, it notes the days and times that suit you for a delivery or a collection, or explains how Tokosss works.

To write that answer, it reads that conversation, your first name and the details of your current orders and sales (products, quartier, status and times). These are sent to our AI provider, Anthropic, which processes them on Tokosss's behalf to produce the answer.

Voice notes, videos and photos are not sent to it: it only knows that one was sent. The assistant decides nothing. Tokosss staff read every message you send to Tokosss and take over whenever needed.

When you enter a promo code or open a shared link that carries one, Tokosss records the code, who it belongs to, and whether you used the offer. On Android, the code in a shared link can reach the app through Google Play when you install it.

When you enter a code, you see the first name and photo of the person it belongs to. If you share your own code, whoever enters it sees yours. You see how many orders your code brought in, never who placed them or what they bought.

To keep the offer to one per person, Tokosss keeps a one-way fingerprint of your sign-in number and of the number that paid. A fingerprint can't be turned back into a number. It stays after you delete your account, so the offer can't be claimed again.

Tokosss works in French and English. To show what people write in the other language, these are sent to our AI provider, Anthropic, which processes them on Tokosss's behalf to produce the translation: product names and descriptions, comments and reviews, the landmark of a place you give, and your note to the transporter.

Tokosss stores the translation with the text. Voice notes are not sent.

Tokosss records what it shows you in the app and what you do with it: the products and sellers shown to you, the ones you open, and what you search for. This is used to choose what to show you first and to improve that choice.

When you delete your account, the record of what you were shown and what you opened is deleted. The words you searched for can stay, without your name or number. The record of which sellers the Sellers tab showed you, and which you opened, is in any case deleted after 90 days.

There is no Tokosss password to steal: you sign in with a one-time code sent to your phone, and codes expire within minutes and are stored only as a cryptographic hash, never in plaintext. Identity documents are stored privately, are never publicly accessible, and can be opened only by authorized review staff. Detailed transporteur location is restricted to authorized operations staff for dispatch, delivery safety, support, or a documented investigation; access to location history is logged. Buyers, sellers, and other transporteurs do not receive a transporteur's coordinates, except during a live location share the transporteur starts for a collection or delivery: the person they are coming to meet then sees their position on a map until the share ends. Tokosss only contacts you from @tokosss.com addresses or the in-app chat, and never asks for your Mobile Money PIN or a login code. No service can guarantee absolute security, so keep login codes private and contact support if you suspect unauthorized access.

Tokosss is for adults. You must have reached the age of majority where you live and be able to enter a binding contract to use Tokosss. We do not knowingly collect personal information from children; if we learn that an account belongs to a minor, we close the account and delete its profile information.

We may update this notice from time to time. Material changes require users to review and accept the new version in the app before continuing. Questions can be sent to support@tokosss.com.