Sign in
Enter the number registered with your campaign.
Joining a campaign as a member? Your campaign sends you a recruitment link — ask whoever asked you to join.
Terms · Privacy · Accessibility
© 2026 Dhamana Technologies Limited
Enter the number registered with your campaign.
Joining a campaign as a member? Your campaign sends you a recruitment link — ask whoever asked you to join.
Terms · Privacy · Accessibility
© 2026 Dhamana Technologies Limited
— everything above is also in the tabs on the left, whenever you want it.
Cells are how support is held. A cell at full strength has ten paid members and a lead; one that is forming has neither yet.
What your supporters say the IEBC register holds about them, checked by them on their own handsets. A supporter who is not on the register can still be helped onto it while registration is open, and not afterwards.
What supporters have raised for you, and what you owe CellTree. Two different directions, kept apart.
Everything needed to start organising, in order. Each step says why it matters and what changes when you finish it.
A campaign is a ticket, not a single name. File the seat you lead with first — it opens the ground you may organise — then add everyone standing with you, so their supporters find their name here and organise behind it.
A ward campaign fields an MCA. A constituency campaign fields an MP and the MCAs beneath them. A Senator, Governor or Women's Representative runs county-wide, alongside the MPs and MCAs in that county. A presidential ticket carries the whole ballot beneath it.
Splits into a new, separate campaign. This cannot be undone. The new campaign starts with this candidacy and nothing else — no members, no cells, no money follow it. Everyone currently organising for this campaign stays exactly where they are.
Each jurisdiction runs its own campaign — its own members, its own cells, its own money — and links upward to the wider ticket. The link is not a merger: if the wider campaign folds or you leave, you keep everything you built. That is deliberate, and it is why a ward campaign should be its own campaign rather than a name on somebody else's list.
A cell is the unit of organising: a small group with a lead who knows every member. Ten is the default and the shape the whole platform is built around — larger cells are allowed, and harder to hold together.
The joining fee is yours — it reaches the campaign, with the platform's commission and the identity check added on top of it rather than taken out of it.
One link is how supporters join: they open it, prove who they are, and appear in your queue. Make it here and send it on WhatsApp.
Anyone who follows the link waits here until you say yes. Approving moves them to the payment queue; membership starts when the joining fee settles.
Ten people who organise together. Nobody outside it can open this, and you choose how much of your name your cell-mates see.
Your people's own reports of what the IEBC register says about them. Nobody is named here, and nobody can be — these are counts. Members check themselves on their own handset; the platform never queries IEBC.
What you have given this campaign, with the M-Pesa receipt for each. Only you can see this.
A recovery number is how you get back in if you lose this phone or the SIM in it. It can be any number, anywhere — a relative's, a second handset — and only you can set it.
Your anchor is what makes this account yours rather than your phone's. It is worked out from things that do not change — your ID, your surname and the number you first registered on, and your Elector’s Card as well if you gave one — so a lost handset, a new SIM or a recycled number never costs you your place. Keep the code below: it is what you read out if you ever have to prove who you are.
Re-enter the details it was worked out from, exactly as they were when you registered — including the original number, which stays part of the answer forever even after it stops being yours. Get them right and your anchor points at the new number; get them wrong and nothing happens and nothing is revealed.
Leave this empty unless somebody set your anchor up with a PIN. The anchor you were given when you registered was not.
A fresh identity check is required: this is the one action that moves where money and messages for your anchor are sent.
A cell is ten people in one ward. It is opened, given a lead, filled, and — when it has to be — quarantined. Every action here is recorded against the person who took it.
The id is on every cell you open, and the forms below read this one box — open a cell once and the actions apply to it.
Seeds an empty container into a ward the campaign contests. It holds nobody and counts toward nothing until it has a lead.
Binds one person to the cell in the box above and gives them the Cell Lead grade. Somebody who does not already hold a place in that cell is given one and seated in it — they lead the cell and are counted in it, which is the same thing everywhere else on the platform.
For somebody the campaign is admitting by its own hand rather than through a recruitment link. The ward decides which cell they land in — placement is auto-routed, so this does not read the box at the top. They must already be verified: the identity check produces the reference below.
A repair, not a routine. Members are seated when they are placed and contributions are settled by the payment rail itself — a slot still holding at pending payment is one a settlement never reached, and this is how it is cleared by hand against the reference on the receipt.
Quarantines the cell in the box above, strips its lead back to member and promotes the deputy in the same breath. For a lead who has taken their cell to another campaign. The cell keeps its people and reopens under new leadership.
Destroys a member's identifiers and reopens their slot as an unnamed vacancy. This is the campaign acting on somebody's written request, or on a death — a member erasing themselves does it from their own Privacy screen and needs nobody's permission. It cannot be undone and the person cannot be recovered.
Signs one member out of every device, right now. The Defection firewall above does this automatically when a cell is quarantined; this is for acting on intelligence that has not produced that decision yet — a stolen handset, a credential shared somewhere it should not have been.
A flag raises a post here. It never hides anything on its own — a threshold that did would be a brigading weapon inside a campaign.
Your rights under the Data Protection Act, as the Privacy Policy describes them. Everything on this page acts on your own record and nobody else’s.
Each use of your data was consented to separately and can be withdrawn separately. Withdrawing stops that use from now on — it does not undo what was lawfully done while consent stood.
Everything this campaign holds about you, in one file you can keep or take elsewhere — your name and number unsealed, your cell, your consents, your payments, what you have posted, and every sign-in. The file also lists what it leaves out and why, so you can tell “we do not hold this” from “we did not give you this”.
The digest of your National ID is not in it. It is one-way and unreadable by design — the policy says so — and it is the one handle erasure exists to destroy.
Your campaign is the controller and holds the decision, so a correction is a request to it rather than an edit here — your name is checked against the national register and your ward comes off your Elector’s Card, and neither can be retyped without redoing the check that placed you. Tell them what is wrong; they have 30 days to answer, and both the asking and the answer are written down.
What members of this campaign have asked you to put right, oldest first — the one closest to breaking the 30-day promise is at the top. Make the correction through the proper route first, then record what you did here.
The Right to Erasure. Your name and phone number are overwritten with a tombstone, the digests of your National ID and phone are destroyed, and your ward is cleared — in one transaction, exactly as the policy sets out. Your place in the cell re-opens as an unnamed vacancy. The consent records survive, because they are the proof that what was done before you asked was lawful — with the ID digest inside them destroyed too. The identity check that admitted you, any application filed in your name, every message queued to your number and your cell's offline records are cleared the same way.
One thing is kept and cannot be destroyed: the anchor digest your Forever Key was built from. It is arithmetic over credentials you keep — never a copy of them — three financial records depend on it, and it names nobody. Everything else about the anchor, including your legal name and every number it routed, is destroyed with the rest.
This cannot be undone, and you will be signed out everywhere. Joining again later means registering again from the beginning.
The target is projected from the register and last election's turnout — 50% + 1 of the votes expected to be cast — unless this campaign has set its own. “Figures from” says which register is behind it: the platform's national projection, or a roll this campaign bought from the IEBC and entered, which no other campaign sees.
Every ward inside one constituency or county, rolled into one figure — for the leads who answer for more ground than a single ward.
How far each seat this campaign contests is from the registered-voter support the law requires to be nominated for it. Counted only from supporters a certified IEBC register has confirmed — the basis is printed beside every figure, because a threshold that looks met here and is refused at the Commission's counter is worse than showing no number at all.
Everyone here followed a recruitment link and passed the identity check. They hold a slot but are not members: approving admits them to the payment queue — the fee the campaign set decides when they have joined — and rejecting releases the slot they were holding.
Paste the numbers of the people you want to ask. Each one gets their own message from CellTree, naming your campaign, with a link only their handset can use — forwarding it to somebody else does nothing. They still land in the queue above, and you still decide.
Kenyan mobile numbers, up to fifty at a time. A number already with your campaign, or already invited and still waiting, is skipped and named below rather than asked twice.
The message names whoever you pick, which is what somebody actually recognises — a name they know beats a campaign name they may not.
A personal invitation already goes to one handset, so a ward restriction is usually unnecessary. It is here for a drive that should only seat people in one place.
A link admits people to the queue above — it decides who may apply, never who has joined. Anyone holding it can follow it, so a forwarded link keeps working until it runs out, expires or is revoked.
Pick a candidate and whoever follows this link is shown that candidate alone before they consent. Leave it as it is and they are shown the whole ticket, which is how every link worked before.
Leave the county blank to open the link everywhere your campaign stands. If you are responsible for one part of it rather than all of it, you have to name a ward inside your own area.
A limit is what makes a forwarded link survivable — the damage stops at a number the campaign chose rather than running for as long as the link circulates.
Everybody you have given a grade to, and the part of the campaign each one answers for. A grade carries the same powers wherever it is held — recruiting, admitting supporters, standing up cells, appointing the grades below — and stops at the boundary of that area.
They must already be a member of this campaign, so find them by the number they registered with. Appointing somebody does not create an account and does not send them anything — their grade changes the next time they open the app.
Set by the campaign administrator. The tiles show what is in force now; change a field and press Save, and the new figures apply to everybody who joins or pays from that moment.
How your campaign appears to the people you are recruiting — on the register page, in the app, and in every message CellTree sends for you. Changing the name is recorded, with the old name and the new.
A web address the logo can be fetched from, not a file. If you want your party symbol carried on the register page and verified as yours, use the Campaign mark panel instead — that one takes the picture itself.
Where this campaign may organise is decided by who it is fielding. File a candidate and their unit opens; withdraw one and it closes.
Filled in from your choice above. Not something you should have to know.
The people who signed this party's application to run on CellTree. A party campaign must always have at least one — the platform will not let you remove the last one.
Leave blank to keep this signatory's current National ID.
Putting somebody back on file needs their National ID again — this console never holds one, and it is what finds the filing you removed. The name and phone above replace what was on it.
What the law asks of one of your candidates before they can be nominated, and where they actually stand. CellTree can verify exactly one item on this list — the supporter threshold, counted from the register evidence this campaign holds. Everything else is a reference and the name of the person who checked it: the platform records what a human saw, and never claims to have checked an EACC clearance itself.
The IEBC's nomination fee is recorded here, never collected. It is payable to the Commission at their counter. Nothing on this platform can take it, and nothing here should be read as having paid it. The only money CellTree collects for a nomination is a party's own certificate fee, which a party sets and charges on its own panel.
A clearance, a certificate, a receipt or a fact somebody else issued. Record the reference on the document you are looking at; your name and the time are stamped on it as the person who checked. Re-checking replaces what was there — a clearance expires and is checked again.
The Commission halves its fee for youth, women and persons with disabilities. Claiming it records personal data about the candidate — and on the disability basis, sensitive personal data under the Data Protection Act, held encrypted and destroyed the moment the claim is withdrawn. Claim it only if the candidate has agreed.
Used to make a one-way digest so an erasure can find this record later. The number itself is never stored.
Only the President and a County Governor name one. The deputy is filed as a candidacy of their own, for the same office and the same unit, and has to meet every requirement on this list in their own right — the ticket clears when both halves do.
Every requirement the platform holds, for every office, so a campaign fielding a slate can read the whole checklist in one place. These are rows in a table rather than rules in code, so a figure the Commission corrects is a data change and not a release.
A Certificate of Nomination is issued only to a candidate who has cleared every requirement on the panel before this one, and exactly one certificate stands per post — revoking is what frees a post for somebody else. The document is a printable page this platform renders; it is not an IEBC document and discharges nothing owed to the Commission.
What your party charges its own aspirants for a Certificate of Nomination — never the Commission's fee, which is recorded on the panel above and this platform never collects. Set it to 0 if your party charges nothing; the certificate then issues directly, with no payment involved.
Revoking , issued to . The certificate stops standing and the post is free for another candidate. The row keeps everything about itself, including why it was withdrawn — a correction must not require the evidence of the mistake to be deleted.
The picture supporters see in place of the platform logo — on this console, and on the registration page somebody lands on from your recruitment link, so the person joining sees who they are joining. Only a verified campaign may set one: the badge is earned, not typed.
PNG or JPEG only — never an SVG, which a browser will run as a program. Between 64 and 2048 pixels on each side, and no larger than 512 KB once the camera's own metadata has been stripped off it. Location data a phone attached to the picture is removed on the way in, and the file you upload is never stored as it arrived.
What standing for each office costs one of your candidates: the party's own nomination fee, and what this campaign charges once they are nominated. Both are yours to set.
A blank is not yet known, which is a different answer from free — and a total is withheld while either half is blank. This is money a candidate physically carries to a nomination desk: one told the fee is zero arrives with the wrong money, one told it is unknown goes and finds out.
| Office | Party nomination | Our candidate fee | Total |
|---|
Both boxes are filled in from the table when you pick an office. Empty one and save to put that figure back to not yet known.
The IEBC sells a register by scope. Buying it here unlocks entering the figures — the IEBC still hands over the document, and somebody at the campaign still types what it says.
| Scope | Covers | You pay |
|---|
Buying a roll unlocks entering it. Until the figures are in, this campaign's targets are computed from the platform's estimate — 2022 registration grown by one flat national rate, which is wrong in a knowable direction and usually understates a growing town. What you type here is yours alone: no other campaign sees it, and the shared national register is not touched.
One of the wards this campaign holds a roll for. Anything else is refused — a campaign that could type figures for a ward it has not bought could move its own goalposts and call the result a plan.
A roll is a snapshot and it ages, so its date is part of the figure.
Paste the rows, or choose a CSV file. One ward to a line: ward code, then registered voters, then — both optional — votes cast and the roll date. A heading line is ignored, and so are blank ones.
Used for every row that does not carry its own date.
Off by default. A ward entered in March and corrected by hand since must not be quietly overwritten by June's document, so wards that already have figures are left exactly as they are and reported as left alone. Wards this campaign has not bought are reported too, not refused — a constituency document lists every ward in it.
The IEBC's certified register is your document under the Elections Act — the platform is not entitled to it and holds none of it. Paste or upload an extract; each row is hashed and compared against this campaign's own members, and then it is gone. Only the counts a comparison produced are kept below — nothing here can store a National ID.
A member is only ever confirmed if they have separately agreed to this exact check on their own device. Anyone who has not, or who has since said no, is left alone and counted as awaiting consent, never guessed at.
Bounded to the wards this campaign may organise in — the same territory your candidacies open above. A row naming a ward outside it is refused, the whole batch, with the ward codes named, rather than letting a mis-parsed document quietly check people it has no business checking.
One row to a line, the National ID first and the IEBC ward code second. A heading line is ignored, and so are blank ones. Up to 1,000 rows a batch — a bigger document is several batches, each its own record in the history below.
An anchor is a member's permanent identity, worked out from their own documents. The phone number attached to it is only a pointer, and this is where the pointer is read and, when a carrier reissues a number, broken.
Severs the number from whoever it answered for, before somebody else is given it. The anchor survives with no route — its holder can point it at a new number themselves — and the wallet behind it is orphaned rather than handed to a stranger. Driven by a carrier's file, never by a hunch.
A corporate anchor moves under an M-of-N signatory quorum rather than a single re-verification. Corporate anchoring is not built into this console yet — a signatory who opened one by API reads out the anchor's code so it can be told apart from another company's request — but this is where the quorum is worked: each pending request shows the anchor it would move and the number it proposes, so approving means confirming something you can actually read rather than an id typed into a box.
Changing these details cancels the platform's check, and settlement waits until the new account has been verified.
What CellTree spends on your behalf, what you hold on deposit against it, and the agreement between you.
Every sign-in sends a WhatsApp code, and every code costs money. Those, notifications, and identity checks are gathered for the week and billed together — a shilling collected on its own would be more M-Pesa fee than message.
Held against your weekly bills: two weeks of your own usage or KES 15,000, whichever is larger. A week left unpaid past the following week is taken from it.
What this campaign is responsible for as data controller, what we are responsible for as its processor, and the measures behind that.
CellTree's own settings and health, across all campaigns.
A campaign's access fee is credited against its licence in full, and is not refunded if the campaign never takes the licence up. Campaigns are told both before they pay.
What the platform is currently set to. Each tile opens what it governs and what goes wrong when it is wrong, and offers the box that changes it.
A presidential ticket here is a coalition whose ward, constituency and county campaigns each pay their own share, so a full percent of the national limit would bill the same organising twice.
Buys access and nothing else. It is what switches a campaign on. It does not include voter rolls, identity checks, or any member contribution — each of those is charged separately, and a campaign that has paid this has bought the door, not what is behind it.
Charged once, after approval, before a campaign is switched on — it is what makes a spam application cost something. Nobody pays to be told no. Setting it to zero turns that off.
What the IEBC charges at each scope, and our markup on it. The price a campaign pays is calculated, not typed — when the IEBC raises a fee you change one number here.
The tiers are not proportional: a county costs five times a ward and contains about thirty of them. A campaign that could only see the ward price would buy the country one ward at a time.
| Scope | IEBC list price (KES) | Campaign pays |
|---|
Buying the national register once and availing it to campaigns is cheaper for everyone than every campaign paying the IEBC for the same document. While CellTree holds it, campaigns pay the markup only — the IEBC fee is a cost already borne, not one to pass on again.
Both are required. Distributing a certified register is something the platform may be asked to account for, and a switch with no paperwork behind it is not an account of anything.
Smile ID bills in dollars and so does Twilio. Both are held in cents with the exchange rate beside them, so when the shilling moves you change one number rather than re-costing every service.
Priced apart because they are billed apart. Verify charges per sign-in and costs many times a template message; one figure for both would charge every approval and reminder at the sign-in rate.
A sign-in is the largest recurring cost per member on this platform, which is why the console holds its session rather than asking for a new code — every avoided sign-out is this figure saved.
Codes go over WhatsApp and fall back to SMS for a member who cannot take one, so both prices are live at once and each sign-in is billed at the rail it actually travelled.
Gathered weekly rather than charged per message: a shilling collected on its own is more M-Pesa fee than message. A campaign with no activity this week does not appear.
| Campaign | Logins | Notifications | ID checks | Owed |
|---|
Not yet collected. This is what each campaign has run up and what it would be billed. Nothing here charges anybody — how a weekly bill is presented and paid has not been decided, and a payment nobody agreed to is worse than an invoice nobody has sent.
| When | What | Campaign | Cost | Recovered |
|---|
All four boxes are needed before identity checks run. Greyed text is an example, not a value — an empty box saves as empty.
Pesapal needs the base URL, consumer key, consumer secret, callback URL and an IPN id. Greyed text is an example, not a value — an empty box saves as empty.
Leave the IPN id alone. Save the credentials above first, then run the
register-pesapal-ipn task — it registers the
notification URL with Pesapal and writes the id back here. The URL
carries the callback secret, which is why it is not typed into a browser.
The passkey is not the consumer secret — Safaricom issues it separately for each shortcode, and the STK push cannot be signed without it.
How members receive the six-digit code they sign in with. Without this nobody can log in — and phone numbers leave Africa to reach Twilio, which needs a processor agreement and an ODPC transfer basis.
WhatsApp runs through Twilio Verify, which carries the message templates Meta has already approved. Without it a code is accepted by Twilio and never delivered.
Members check their own registration on their own device: the portal opens in their browser, the SMS option composes a message on their handset. This server never contacts IEBC and never sees a National ID leave the phone.
The ID is substituted on the handset by the member's own SMS composer. Leave the body blank to send them to the short code with nothing prefilled.
What the platform has told people, across every campaign — never the numbers themselves, only whether the message went.
Until a kind carries a Meta-approved template, every message of that kind is recorded and held undeliverable — retrying it changes nothing.
Manual, on purpose — a schedule is one more thing that can silently not be running, and the failure mode is messages quietly never going out.
The IEBC's published ward-level figures, which replace the platform's estimate for every campaign at once. This is the widest-reaching change anyone can make here: it moves the target on every dashboard in the country, so it is recorded against your name.
Aggregate counts only. A ward code and how many voters are registered in it — never a voter. Checking individual members against a certified register is a campaign's own document and a different screen (Campaign settings → Voter rolls → Register reconciliation).
One ward to a line: ward code, then registered voters. A heading line is ignored, and so are blank ones. Every line that cannot be read is reported and nothing is sent.
Required. A national figure with no document behind it cannot be checked against anything, and this is the platform's whole answer to "says who?".
The platform administrator is an organisation. Each grade holds only what its work needs, and nobody here can see inside a campaign — staff see campaigns as organisations, never the people in them.
For somebody who has lost both the phone they sign in on and their recovery number. Three steps, with the member on the line: check their ID (they must agree to the check), find the account, and point it at a number they can receive codes on. Every session they had is ended.
Every campaign on the platform, newest first, with the officer to call about it. Contacts are a campaign's own officers — a supporter's number is never on this page.
Seats an administrator on , which currently has nobody able to sign in to run it. This is either a fresh account, or an existing administrator's account moved here from a campaign they have already closed.
What the registration fee has brought in, and what is still outstanding. Counts organisations and sums what they owe — nothing here is about any member of any campaign.
A campaign manager either applies from the app or is invited. Nothing organises anyone until it has been approved here.
The campaign exists but organises nobody until the registration fee settles. When a note lapses the approval goes with it.
The invitation goes to a number, not to a name — whoever redeems it gives their own name then, so the record says who actually took it up.
Collections land with the principal. A batch divides what a campaign is owed; it becomes a payment only once a transfer is confirmed.