Privacy Policy

This Privacy Policy explains what Tembea Nami (“we”) collects, why we collect it, and the choices you have. We treat your travel memories as yours: we aim to collect the minimum needed to run the Service and we never sell your personal data. This policy applies to the Service available at the Tembea Nami website.

1. What we collect

Account information

• Email address and password (or Google account, if you sign in that way), and optionally a phone number for SMS verification.
• Your profile: username, display name, bio and avatar photo.

Content you create

• Memories: a photo, a place name, an optional caption and an optional recommendation.
• Photos are public with your memory. Location metadata (EXIF/GPS) is stripped from photos when they are uploaded — a memory is located by the county and place name you type, not by hidden photo coordinates.

Technical data

• Logs (IP address, browser and device basics, timestamps) for security, abuse prevention and troubleshooting.
• Analytics from Microsoft Clarity (how pages are used) and bot-protection signals from Cloudflare Turnstile.
• Usage events we record internally (for example “county unlocked”).

2. Why we process data

• To run the Service: create and secure your account, store and display your memories, and power maps and discovery.
• To send you essential service messages (verification codes, password resets). We do not send marketing email without your consent.
• To keep the Service safe: spam and abuse prevention, moderation, and enforcing our Terms and Content Policy.
• To understand and improve the product through analytics.

3. Who we share data with

We do not sell your personal data. We share data only with the processors needed to run the Service, and only as far as necessary:

• Hosting and storage providers (our servers, database, object storage and backups).
• Login and communication providers: Google (sign-in), an SMS provider for phone verification (Africa’s Talking), and our transactional email provider.
• Security and analytics: Cloudflare (Turnstile bot checks) and Microsoft Clarity (analytics).
• Map provider: Google Maps renders map tiles in your browser on pages such as Journey and Explore; map data is subject to Google’s privacy policy.
• Authorities: if required by law or to protect rights and safety.

4. Public content

Memories you publish are visible to anyone on the Service — on maps, county pages, public profiles and community statistics (“Shaped by N travellers”). Think before sharing photos of other people or sensitive places. Deleting a memory removes it from public view.

5. Retention

• Account data: kept while your account is active.
• Memories and media: kept until you delete them or your account.
• Logs: kept for a limited period (typically up to 30 days) unless needed longer for security investigations.
• Backups: your content may persist in encrypted backups for a short retention window (up to 30 days) after deletion, then it is overwritten.

6. Your rights

• Access and correct: edit your profile any time in Profile.
• Delete: delete individual memories from a county gallery, or delete your whole account in Profile (Danger zone) — this permanently removes your memories, media and data.
• Object or withdraw consent: where processing relies on consent (for example analytics), you can withdraw it; for other lawful bases you can contact us and we will consider your request under applicable law, including Kenya’s Data Protection Act.

7. Security & children

We use industry-standard safeguards (HTTPS everywhere, hashed credentials, rate limiting, restricted access to servers) and we review them as the Service grows. The Service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

8. Contact & changes

Questions, requests or complaints about this policy: [email protected]. We may update this policy; material changes will be announced in the Service and this page will show the new date.