Privacy Policy

01Who is responsible for your data

Guava is operated from the United Republic of Tanzania. For the purposes of the Personal Data Protection Act, No. 11 of 2022, Guava is the data controller for the personal data described in this policy, and decides why and how it is processed.You can reach us about anything in this policy at this address. Please write “Data request” in the subject line so it is handled as one.This policy covers the Guava website and the Guava mobile applications. It does not cover other people's websites, streams, embedded videos or applications that you reach from Guava. Those have their own policies.

02The short version

We do not sell your personal data. not to advertisers, not to data brokers, not to anyone.
We collect what the product needs. an account, what you publish, and how the app is used, so the feed, search, notifications and moderation can work.
Most of Guava is public. posts, comments, profiles, follows and likes are visible to anyone, including people who are not signed in and search engines.
Direct messages are private but not secret. they are not end to end encrypted. Staff can access them where a safety, legal or investigation reason requires it.
You can leave. close your account and, after 65 days, it and its personal data are erased.
You have rights. access, correction, erasure, objection and complaint. Section 15 explains how to use them.

03Information you give us

Account details. your email address, password (stored only as a cryptographic hash, never in readable form), display name and username.
Profile details. anything you choose to add: bio, avatar and cover images, links to your other social accounts, website, location text and contact details you publish yourself.
Content you publish. posts, articles, documentaries, research summaries, stories, novels, comics, poll questions and options, comments, hashtags, mentions, images and video links, course modules, lessons and quizzes, brand and channel entries, and partner listings, together with their drafts and edit history.
Messages. direct messages and group chat messages, including who they were sent to and when.
Applications and submissions. creator applications, partner listings, research submissions and anything you attach to them.
Support and reports. messages you send to the support inbox, problem reports, and reports you file about other people's content or accounts, including the reason you selected and any details you typed.
Actions you take. follows, likes, saves, poll votes, course enrolments, lesson progress, quiz attempts and results, certificates issued, blocks and mutes.

04Information collected automatically

Device and browser. device type, operating system, browser, screen size, app version and language preference, so pages render correctly and we can reproduce bugs.
Connection data. IP address and general request information collected by our hosting providers as part of delivering and securing the service. An IP address indicates approximate location at city or region level. We do not collect precise GPS location.
Usage events. which items appeared on your screen, which you opened, how long you stayed, and whether you liked, saved, shared, skipped, hid, dismissed or reported them, including the reason chosen for a negative action. These drive feed ranking and tell us which content people find misleading or offensive.
A device identifier. a random identifier generated in your browser and stored on your device, used to count views and to keep usage measurement sensible for signed-out visitors. It contains nothing about you and is not linked to any advertising network. Clearing your browser storage resets it.
Security and audit logs. sign-in attempts, moderation actions, staff access to an account, and authorisations you grant to third-party applications.

The Cookie Policy lists every cookie and storage key by name, what it does and how long it lasts.

05Information from other people

Reports about you. if someone reports your post, comment or account, we receive their reason and description, which is about you.
Mentions and tags. other people can name you in posts, comments and messages.
Content others publish. photographs, footage and writing uploaded by other people may include you. If it does and it should not, report it and we will review it.
Service providers. our hosting, database, storage, email and delivery providers pass us technical information about requests and deliverability.

06Why we use it, and our lawful basis

Under the Personal Data Protection Act we must have a lawful reason for each use. Ours are set out below.

What we do	Why	Lawful basis
Create and run your account, publish your work, deliver messages and notifications	It is the service you asked for	Performance of a contract with you
Rank the feed, run search, suggest people and content	So the app is usable	Legitimate interest, and your consent where required
Detect spam, scams, fraud, abuse, ban evasion and security incidents	To keep members safe and the platform working	Legitimate interest and legal obligation
Review reports and enforce the Community Guidelines	To keep harmful content off Guava	Legitimate interest and legal obligation
Fix faults, monitor performance and improve features	So problems are found and corrected	Legitimate interest
Send service, security and policy messages	So you know about things that affect your account	Performance of a contract and legal obligation
Send optional updates about Guava	To tell you what is new	Consent, withdrawable at any time
Respond to a valid legal request from a court or a competent authority	Because we are required to	Legal obligation
Protect someone from serious harm	Where life or safety is at risk	Vital interests

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not undo processing that already happened lawfully.

07What is public, and what is not

Information	Who can see it
Username, display name, avatar, cover image, bio, social links	Anyone, including signed-out visitors and search engines
Posts, articles, comments, stories, novels, courses, listings, channels	Anyone, unless you delete them
Follows, likes, poll votes shown as totals, saved counts	Anyone, in aggregate or as a public action depending on the feature
Certificates you have been issued	Anyone with the verification link
Direct messages and group chat messages	The people in the conversation, plus staff where a safety, legal or investigation reason requires it
Email address, password hash, drafts, blocks and mutes, reports you filed	You and authorised staff only
Reports filed about you	Authorised staff only. The person reported is never shown who reported them
Usage events, device identifier, security logs	Authorised staff only

08Who we share personal data with

We do not sell personal data and we do not share it for anyone else's marketing. We share it only in the situations below.

Service providers. hosting, database, file storage, content delivery, email delivery, error monitoring and application platform providers, who process data only on our instructions and under a contract that requires them to protect it.
Other users. everything the previous section marks as public, plus what you send to a person or a group directly.
Third-party applications you authorise. only the access you approved, only for as long as you leave it approved.
Law enforcement, courts and regulators. where a valid legal order or a properly made request from a court, a regulator or another competent authority requires it. We do not volunteer information about our users, we disclose no more than the request requires, and we tell you it happened unless the law forbids it.
Safety and rights. where we reasonably believe disclosure is necessary to prevent serious harm to a person, to investigate fraud or abuse, or to establish, exercise or defend a legal claim.
A change in the business. if Guava is sold, merged or reorganised, personal data may transfer with it. The buyer must continue to honour this policy or give you notice before changing it.

Where the law allows us to, we will tell you before disclosing your data in response to a legal request. Sometimes the law forbids us from telling you.

09Where your data is stored and transferred

Guava runs on cloud infrastructure, and some of the servers and support staff of our providers are outside Tanzania. That means your personal data may be stored in or accessed from another country.When personal data leaves Tanzania we do so on the bases permitted by the Personal Data Protection Act and its regulations, which include your consent, the necessity of the transfer to perform our contract with you, and contractual safeguards with the receiving provider requiring a level of protection consistent with Tanzanian law.Ask us at this address if you want to know which providers currently hold data and where.

10How long we keep it

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.

Data	Kept for
Your account and profile	While the account is open
A closed account and its personal data	65 days after you request closure, then erased
Content you delete yourself	12 days, then erased
Content removed for breaking the rules	12 days, then erased, unless an appeal or a legal duty requires longer
Direct messages	Until deleted by a participant or with the account
Usage events used for ranking and abuse detection	Up to 24 months, then deleted or aggregated so no individual can be identified
Security, sign-in and staff access logs	Up to 24 months
Moderation records, including reports, reasons and enforcement decisions	Up to 5 years, so repeat behaviour and ban evasion can be identified and appeals can be judged fairly
Records we must keep by law, or that relate to a live legal claim	As long as the law or the claim requires
Encrypted backups	Rotated on a rolling basis, normally within 90 days

11How we protect it

Encryption in transit. traffic between your device and Guava is encrypted with HTTPS.
Passwords. stored only as salted cryptographic hashes. Nobody at Guava can read your password.
Row level access control. the database enforces, per row, who is allowed to read or change what, so a bug in the interface does not expose someone else's private data.
Least privilege. administrative access is limited to the people who need it, and sensitive administrative actions are recorded in an audit log.
Review. we review what we collect, where it is stored and who can reach it.

12Staff access and support impersonation

We would rather tell you this plainly than have you discover it. Authorised administrators can open an account view as that user, in order to reproduce a fault, investigate abuse or answer a support request.

Every such session is written to an audit log with who did it and when.
It is used for support, safety and investigation, never out of curiosity.
Administrators can also read reports, moderation records and, where a safety or legal reason requires it, message content.

13Applications you connect

Guava supports authorising an external application to access parts of your account. You are shown what it is asking for before you approve, and every authorisation is recorded in an audit log.Once you approve, that application handles your data under its own privacy policy, not ours. Withdraw an authorisation you no longer use, and contact us at this address if you cannot.

14Automated processing

Ranking. the feed, search results and recommendations are ordered automatically from what people open, finish, save, skip and dismiss.
Abuse detection. automatic limits apply to new accounts and to activity that looks like spam. These can restrict posting temporarily.
Human review. a decision to remove content, suspend an account or refuse a creator application is made or confirmed by a person, and can be appealed under the Community Guidelines.
No profiling with legal effect. we do not make decisions about you with legal or similarly significant effects using automated processing alone.

15Your rights

Under the Personal Data Protection Act, No. 11 of 2022 and its regulations you have the following rights over your personal data.

Be informed. know what we hold and why, which is what this policy is for.
Access. ask for a copy of the personal data we hold about you.
Rectification. have inaccurate or incomplete data corrected. Most of it you can edit yourself in Settings.
Erasure. ask us to delete your personal data. Closing your account does this. We may keep what the law requires us to keep.
Object and restrict. object to processing based on our legitimate interests, or ask us to pause processing while a dispute is resolved.
Withdraw consent. where we relied on your consent, take it back at any time.
Portability. ask for a copy of the data you gave us in a common machine readable format.
Complain. raise a complaint with us, and with the Personal Data Protection Commission of Tanzania if you are not satisfied with our answer.

How to make a request

1Write to this address from the address on your Guava account, with “Data request” in the subject line.
2Say which right you are using and, if it helps, which data or which period you mean.
3We may ask a question or two to confirm the request really comes from you. We will not ask for a copy of your national identity document unless it is the only way to be sure.
4We will respond without undue delay and within the period set by Tanzanian law. If a request is complex we will tell you and explain the delay.

Requests are free. If a request is clearly unfounded or repetitive we may charge a reasonable fee for the administrative cost, or decline it and tell you why.

16Children

Guava is for adults. You must be 18 or older to hold an account, and we do not knowingly collect personal data from anyone under 18.If you believe a child has an account or that a child's personal data has been published on Guava, tell us at this address and we will close the account and delete the data. Content that sexualises a child is removed immediately and permanently and closes the account behind it.

17Changes to this policy

We will update this policy when the product or the law changes. The date at the top always shows the current version, and we will give notice in the app or by email before a significant change takes effect.

18Contact and complaints

For any question, request or complaint about your personal data, write to this address.If our answer does not satisfy you, you can complain to the Personal Data Protection Commission of the United Republic of Tanzania, which supervises compliance with the Personal Data Protection Act.