Your data

Privacy

What Nyirobi collects, why, how long we keep it, and how to have it removed — under Kenya's Data Protection Act, 2019.

Last updated 13 Oct 2026

What we collect

Your account: your email address, the name you give us, and — if you write for us — your public profile and payout details.

Reading: to show writers who is reading them and to rank what is popular, we record that a piece was read, for how long and how far down the page. A signed-in read is tied to your account; a signed-out read is tied only to a code made from part of your network address, your browser and a secret that changes every day. We never store your IP address, and the code cannot follow you from one day to the next.

Payments: IntaSend handles your card or M-Pesa details. We keep what IntaSend tells us about each payment — the amount, the reference and whether it succeeded — so we can unlock what you bought and answer questions about it.

What we do with it

We use your email to sign you in, send receipts and account notices, tell you when a writer you follow publishes (only if you asked), and send Nyirobi Girl's column (only if you confirmed). Reading records are used to count readers for writers' statistics and the front page, and to spot abuse. We do not sell data, show advertising, or share your details with anyone except the services that run the site: Supabase (our database), IntaSend (payments) and ZeptoMail (email).

Email

Signing up for Nyirobi Girl's column sends a confirmation email; nothing else is sent until you confirm. Every email has a one-click unsubscribe link. We do not track whether you open our emails or which links you click.

How long we keep it

Individual reading records are kept for thirteen months, then deleted; only daily totals per piece remain. Payment records are kept for as long as the law requires for accounts. Your account data is kept until you ask us to delete the account.

Your rights

You can ask to see the personal data we hold about you, have it corrected, or have your account and data deleted. Write to us from the contact page and we will reply within thirty days. If you are unhappy with how we handle your data, you may complain to the Office of the Data Protection Commissioner of Kenya.

Questions about any of this? Write to us. See also the terms, privacy and refunds pages.