Privacy Policy

This Privacy Policy explains how iCtory (“iCtory”, “we”, “us”) collects, uses, stores, and shares personal data when you use ictory.com, the iStory apps, and related services (the “Service”). It should be read with our Terms and Conditions (Terms of Use) and Copyright Policy.

We process personal data in line with the laws of the United Republic of Tanzania, including the Personal Data Protection Act, 2022, and other laws that apply to people who use the Service from elsewhere.

1. Who is responsible

iCtory is the data controller for personal data collected through the Service. Contact: [email protected].

2. Information we collect

Account and profile

Name, username, email address, password (stored hashed), and optional profile fields such as headline, bio, location, website, avatar, and cover photo.
If you sign in with Google, we receive the identifier, name, and email your Google account shares with us through Firebase Authentication.
Role information (reader, creator, staff), verification status, follower counts, and whether you have accepted the current legal version.

Content you create

Stories, chapters, drafts, covers, statuses, comments, messages, attachments, bookmarks, and library items.
Copyright claims, legal-name signatures, declarations, and evidence files you upload when you make a claim.
Reports you file about other content or members.

Reading and social graph

Follow and subscription relationships.
Story view events (including a guest viewer key so we can count unique views without forcing login).
Continue-reading progress (how far you have read a story).
Likes, helpful marks, and similar reactions.

Payments and wallets

Wallet balances and ledgers in supported currencies (USD and TZS).
Purchase, tip, subscription, deposit, and withdrawal records.
Limited payment-method details needed to complete a transfer (for example mobile-money network and masked account references). Full card numbers are handled by payment partners, not stored as raw PAN on iCtory.
Payout destination details you give us for withdrawals.

Device, security, and communications

Session tokens, cookies, and similar identifiers to keep you signed in.
Approximate technical data such as IP address, browser or app type, and request logs used for security, rate limiting, and debugging.
Notification receipts and email delivery events.
Customer-support messages you send us.

We do not require government ID to open a basic account. We may ask for extra identity or payment information if you withdraw funds, if a copyright claim requires it, or if the law requires it.

3. How we use information

We use personal data to:

create and secure your account, including Google / Firebase sign-in;
publish, display, recommend, and let others read stories according to the visibility you choose;
operate follows, messages, statuses, comments, search, and notifications;
process payments, wallets, tips, subscriptions, platform fees, and payouts;
run copyright similarity checks, claims, evidence review, and strikes;
detect spam, fraud, abuse, and security incidents;
improve the product, measure usage, and fix bugs;
comply with law, enforce our Terms, and defend legal claims;
send service email (password reset, security, legal version updates). Marketing email is sent only if we offer it and you can opt out.

We do not sell your stories or your personal data. We do not rent mailing lists.

4. Why we are allowed to use it

Depending on the activity, we rely on:

Contract — to provide the account, publishing, reading, and payment features you request;
Legitimate interests — to keep the Service safe, prevent fraud, measure performance, and improve features, balanced against your rights;
Consent — where we ask for it (for example optional profile fields, Google sign-in, or non-essential cookies if we add them);
Legal obligation — where tax, accounting, or law-enforcement rules require us to keep or disclose records.

The public. Stories, profiles, covers, and other content you set to public are visible on the web and in apps. Search engines may index public pages.
Other members. Followers, people you message, and people who buy or subscribe to your work see the information those features require.
Platform operators. Staff and moderators can review reported content, claims, and safety signals to enforce the Terms of Use and Copyright Policy.
Service providers. Hosting, CDN (including Cloudflare), email, analytics if enabled, Firebase / Google authentication, and payment / mobile-money processors that must receive the data needed to complete a transaction.
Law and safety. We may disclose data if required by a valid legal process, or to protect someone’s vital interests, the Service, or the public.
Business transfers. If iCtory is reorganized, merged, or sold, personal data may transfer to the successor under this Policy.

We do not share private direct messages in public feeds. Messages may still be accessed for abuse investigations or legal process.

6. International processing

Servers, CDNs, Firebase, and payment partners may process data outside Tanzania. Where we do that, we take contractual and technical steps appropriate to the destination. By using the Service you understand that your data may be processed in those locations.

7. How long we keep it

We keep account data while your account is open. After closure we delete or anonymize personal data within a reasonable period, except records we must keep longer:

payment, wallet, and tax records (typically up to the period required by Tanzanian accounting and tax rules);
copyright claims, signatures, and evidence (for dispute and safety history);
security logs and bans needed to prevent repeat abuse;
backups, which rotate on a delayed cycle;
content you published that other people lawfully purchased, until those access rights expire or are unwound.

Draft stories you never publish can be deleted by you. Guest view keys are not used to market to unidentified readers.

8. Security

We use HTTPS, hashed passwords, access controls, and session tokens. No method of transmission or storage is perfectly secure. Tell us promptly at [email protected] if you believe your account was compromised.

9. Your rights

Subject to the Personal Data Protection Act, 2022 and other applicable law, you may request to:

access the personal data we hold about you;
correct inaccurate data (you can already edit much of your profile in settings);
delete your account and associated personal data, with the exceptions in section 7 (see Delete your account);
object to or restrict certain processing;
withdraw consent where processing is based on consent (this does not undo processing already done);
lodge a complaint with Tanzania’s Personal Data Protection Commission or another competent authority where you live.

To delete your account, follow Delete your account, or email [email protected] from your account email. We may need to verify it is you. We will respond within the time the law allows.

10. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have, contact us and we will delete it. Users aged 13–17 may use the Service only with a parent or guardian’s agreement to the Terms and this Policy.

11. Cookies and similar technology

We use essential cookies and local storage to keep you signed in, remember preferences, and protect the Service (including cache-busting for the web app). We also use a content delivery network that may set technical cookies. The Flutter / web app may store a small cache version marker on your device. We do not currently use third-party advertising cookies. If that changes, we will update this Policy.

12. Automated checks

Copyright similarity scoring, spam filters, and fraud checks are automated aids for human review. They can be wrong. A similarity warning is not itself a legal finding of infringement. Decisions that take down a story or strike an account are made through our moderation process as described in the Copyright Policy.

13. Changes

We may update this Privacy Policy. The version and effective date appear at the top of this page. Material changes will get a new legal version. If we need a new consent, we will ask for it. Continued use after the effective date means you accept the update, except where the law requires a different process.

14. Contact

Privacy questions and data-rights requests: [email protected]. You can also use in-app reporting for content concerns. For the contract that governs use of the Service, see the Terms and Conditions.