GraphBook

Privacy policy

Draft — not in effect. This text is still being reviewed and doesn't apply to anyone yet.

GraphBook is run by [operator's registered name — not yet set] ("we"). This policy explains what we collect when you use the GraphBook app and website, why, who else handles it for us, and what you can do about it. Questions and requests: [contact address — not yet set].

What we collect

  • Your phone number, if you sign in with one: we text a code to it. It is never shown on your profile or to other members.
  • If you sign in with Google or Apple: an identifier for your account with them and, when they include it, your email address. We use the email only to show you which account is linked, never to contact you or to find your account. For Apple we also keep a token, encrypted, so that deleting your GraphBook account also ends GraphBook's access to your Apple account.
  • What you put on your profile: your name, username, photo, what you make, know and offer, your languages and availability.
  • What you post: posts, needs, alerts, events, works, services, businesses, Lives, recommendations and reviews, with the photos, videos and voice notes you choose to attach.
  • Your messages, so they can reach the people you send them to.
  • Your location, only while you use the app and only if you allow it. We use it to show what's around you and to place what you post.
  • The people and businesses you follow, save, recommend or block, and the reports you make.
  • If you turn on notifications, a token from Apple or Google that lets us send them to your phone.
  • Technical records our servers keep when they answer a request: your IP address, the time and what was asked for, and error reports when something breaks.

What we don't do

  • We don't sell your information, and we don't show ads.
  • The app doesn't read your phone's contacts, and it contains no advertising or third-party analytics trackers.
  • The website sets no cookies and runs no scripts.
  • Your profile's web page isn't listed by search engines unless you turn that on.

How location is shown to others

Others never see where you are. What you post is shown at the Place it belongs to. When that Place came from your own GPS, others see a point rounded to about 100 metres, not your exact position. A business's address is shown exactly, because the business chose to be found there.

Ghost Mode (Me › Settings) takes you out of the People directory, and your profile no longer names the Places of your activity.

Why we use it

  • To run your account and sign you in.
  • To show your profile and posts to other members, and theirs to you, with what's near you first.
  • To deliver messages and notifications.
  • To answer what you ask GraphBook, and to fill in a form or improve a post when you ask for that.
  • To keep GraphBook safe: limits against abuse, reviewing reports and removing what breaks the rules.
  • To find and fix problems.

Who else handles it

Other members see what you make public: your profile and what you post. We share no more with them than that. These services handle information for us, only to provide GraphBook:

  • Amazon Web Services: our servers and databases, and their backups.
  • Africa's Talking: sends your sign-in codes by SMS.
  • Google and Apple: let you sign in with your account with them, if you choose to.
  • Cloudinary: stores and serves the photos, videos and voice notes you post.
  • Anthropic: when you ask GraphBook a question, or let GraphBook fill in a form or improve a post from your words or a photo (such as a price list or a poster), what you gave it is sent to Anthropic's AI to write the answer or the draft. So is a note you write about one of your connections, with their name.
  • Google Maps: finds places and addresses when you search for one or pick a point on the map.
  • Expo, Apple and Google: deliver notifications to your phone.
  • Sentry: receives error reports from our servers so we can fix them.

Where it's kept

Some of these services keep data in countries other than Kenya. We use them under their terms for business customers, which require them to protect it.

We'll give information to authorities only when the law requires us to.

How long we keep it

  • While your account exists.
  • Delete your account in the app (Me › Settings › Delete account). You have 7 days to change your mind. After that we erase your profile and everything you posted, your messages and your media.
  • Some things stay, without your name: recommendations and reviews you wrote are shown as from "A former member", and place knowledge others rely on (landmarks, public spaces, the place wiki) stays. Your username is never given to anyone else.
  • Encrypted backups are kept for up to six months, only to recover from a failure, and are then deleted.
  • Server records are overwritten automatically as new ones arrive.

Your choices and rights

In the app you can edit your profile, delete your works, change who can message you, turn on Ghost Mode, block people, report content and delete your account. To have something else you posted removed, write to us.

Under Kenya's Data Protection Act, 2019, you can ask us for a copy of the information we hold about you, ask us to correct or delete it, and object to how we use it. Write to [contact address — not yet set]. If you're unhappy with our answer, you can complain to the Office of the Data Protection Commissioner.

Security

Everything between the app and our servers is encrypted in transit, and the app keeps your sign-in in your phone's secure storage. Messages are stored on our servers so they can be delivered; they aren't end-to-end encrypted.

Age

GraphBook is for people aged 18 and over.

Changes

If we change this policy, we'll update the date at the top. If a change affects what we collect or who we share it with, we'll tell you in the app before it applies.