Privacy Policy

We collect information to provide, improve and personalise the Service. The categories we collect include:

Information you provide directly

• Phone number — required to create an account via OTP verification.
• Name & profile details — first name, surname, role (student / professional / entrepreneur) and role detail (e.g. university name) collected at registration.
• Email address — optional; collected if you provide it for account recovery or billing.
• Age — used to ensure our Service is appropriate for you (minimum age: 13).
• Communications — messages you send us via email, WhatsApp or support forms.

Information collected automatically

• Device & usage data — device type, operating system, app version, edition views, session duration, crash reports.
• Country & language — inferred from your phone number prefix and device settings.
• Payment metadata — payment reference numbers and status; we do not store card numbers or mobile-money PINs.

We use the information we collect to:

• Create and manage your account and authenticate you via OTP.
• Process subscription payments and verify transactions via Flutterwave or DPO.
• Deliver the correct country edition and personalise your reading experience.
• Send important service communications (e.g. OTP codes, payment receipts, edition alerts).
• Improve our product through aggregate usage analytics.
• Comply with legal obligations and enforce our Terms of Service.
• Contact you with marketing messages only if you have opted in.

We do not sell your personal data to third parties.

We share data only in the following circumstances:

• Payment providers — Flutterwave and DPO receive transaction details necessary to process payments. Their privacy policies govern their use of this data.
• SMS provider — Africa's Talking receives your phone number solely to deliver OTP codes.
• Legal requirements — We may disclose information if required by law, court order, or to protect the rights, property or safety of KandaNews, our users, or the public.
• Business transfers — In the event of a merger, acquisition or asset sale, user data may be transferred. We will notify you before that happens.

We implement industry-standard security measures to protect your data:

• All data in transit is encrypted using TLS 1.2+ (HTTPS).
• Passwords and OTP codes are never stored in plain text; we use bcrypt hashing.
• Access tokens are short-lived JWTs; refresh tokens are rotated on use.
• Database access is restricted to authorised server processes only.

Despite these measures, no system is 100% secure. If you suspect a security issue, please contact us immediately at security@kandanews.africa.

We retain your account data for as long as your account is active or as needed to provide the Service. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business reasons (e.g. resolving disputes, preventing fraud). Anonymised, aggregated analytics data may be retained indefinitely.

Our Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

Depending on your country's data protection laws, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and personal data ("right to be forgotten").
• Restrict certain processing activities.
• Data portability — receive a copy of your data in a machine-readable format.
• Opt out of marketing communications at any time.

To exercise any of these rights, contact us at privacy@kandanews.africa. We will respond within 30 days.

Our websites use minimal cookies — primarily to maintain session state and analyse traffic (via privacy-respecting analytics). Our mobile app uses device local storage to cache your access tokens and reading preferences. You can clear app storage at any time via your device settings.

We may update this Privacy Policy from time to time. When we make significant changes we will notify you via in-app notification or email (if provided). The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes constitutes acceptance of the revised Policy.

If you have questions about this Privacy Policy or your personal data, please reach us at:

• Email: privacy@kandanews.africa
• General: hello@kandanews.africa
• Company: Thirdsan Enterprises Ltd, Kampala, Uganda