Privacy policy

The short version

We keep what you give us to run your account and what you post to show it to others. The site shows ads from Google to pay its way and counts visits with Google Analytics; both use cookies, and you can turn off personalised ads (see Analytics and ads). Beyond that, we do not sell or share your information with anyone for their own purposes. Anything you post is public. Your email, phone number and date of birth are not.

What we keep

Your account. Your email address, username and password (stored as a hash, not as the password itself), and, if you choose to add them, your name, date of birth, country, phone number, website, social handles, bio and profile photo.

What you do here. Your posts and the photos and videos in them, the tags they carry, your comments, your likes, who you follow, and the time each of these happened.

Views. When you look at someone’s post while signed in, we keep a note that you saw it so that you are counted once per day rather than every time you scroll past. That note expires within a day. The post keeps only a total; it does not keep a list of who looked.

Copyright notices. If you send one, the name, email address, links and details in it, to act on it and to reply to you.

Nothing else, on our side. We do not record your IP address against your activity, your location or your device. Reading Kyabaatay while signed out sends us nothing about you beyond what any web server sees to deliver the page. Google’s analytics and ads collect their own information, set out in Analytics and ads.

What is in your browser

• Your sign-in. After you log in, a token is stored in your browser’s local storage so you stay signed in. Logging out removes it.
• Your appearance choice. Light, dark or system is stored there too, so the page can paint the right colour before it loads. It is never sent to us.
• Your sound setting. Whether videos play muted, and how loud, is kept there as well, so every video starts the way you left the last one. It is never sent to us.

We set no cookies of our own. The cookies on the site are Google’s, for the analytics and ads below.

Analytics and ads

Google Analytics. We use Google Analytics to count visits: which pages are opened, how people arrive, what kind of device and browser they use, and roughly where they are (a country or city, worked out from the connection’s IP address, which Google Analytics does not keep). It sets cookies to tell one visit from another, and it gives us totals rather than who you are; we never send it your account details. Google explains how it handles this in How Google uses information from sites or apps that use its services. You can stop it counting your visits with Google’s Analytics opt-out browser add-on.

Ads from Google. The site shows ads served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or to other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet. You can turn off personalised ads in Google’s Ads Settings, and opt out of other vendors’ use of cookies for personalised ads at www.aboutads.info. The ads have no say in what your feed shows.

Who can see what

Public: your username, display name, bio, profile photo, website and social links, when you joined, how many people follow you and you follow, and every post, comment and like you make. Reading Kyabaatay needs no account, so public means anyone on the internet.

Private to you: your email address, phone number, date of birth and country. These are used to sign you in and to reach you, and are never shown on your profile or given to other members.

Photos and videos are served from a content delivery network at addresses that are not guessable but are not secret: anyone who has the address of a photo can open it, whether or not they are signed in, for as long as the post it belongs to exists.

Where it lives

Your account and posts are stored in our database; photos and videos are stored with a cloud storage provider and delivered through its content delivery network. These providers hold the data on our behalf and are not permitted to use it for anything else. Google provides the analytics and the ads described above; how it uses what they collect is set out in Google’s privacy policy. We have no other partners, processors or buyers.

Your choices

• Change it. Everything on your profile can be edited from Edit profile.
• Remove it. You can delete your own posts and comments, take back likes, and unfollow anyone, at any time, from the app.
• Leave. To delete your account, write to us from the email address on it. We will remove the account, your posts and their media, your comments, likes and follows. Your username is released. Copies may persist in backups for a short while afterwards, and cached copies of public media may take a little time to expire.
• Ask. You can ask us for a copy of what we hold about you, or to correct it, at the address below.

How long we keep it

For as long as your account exists. When you delete a post or a comment it is removed from the app straight away; when you delete your account, everything above goes with it. We do not keep activity logs that would need a separate schedule. Google Analytics keeps its visit records for the retention period set on our account, and Google’s advertising cookies expire on the schedule Google sets for them.

Children

Kyabaatay is not intended for children under 13, and we do not knowingly keep an account for one. If you believe a child has made an account, write to us and we will remove it.

Changes to this policy

If we change what we collect or how we use it, we will change this page and move the date at the top. A change that matters to you will also be announced in the app before it takes effect.

Contact

Anything about your data: hello@kyabaatay.com.