Privacy Policy

This Privacy Policy explains how Owavera ("we", "us", "our") collects, uses, and protects your personal data when you visit owavera.com. By using our website, you agree to the practices described here.

1. Data We Collect

Account data

When you register an account, we collect your email address and a hashed password (bcrypt, strength 12). We never store your password in plain text.

Analytics data

When you view an article, we record an anonymised analytics event containing:

• A one-way hash of your IP address (we cannot reverse this to your IP)
• A one-way hash of your browser user-agent string
• The article ID viewed and the timestamp

We do not use cookies for analytics. We do not use Google Analytics or any third-party analytics provider that tracks you across sites.

Email subscription data

If you subscribe to keyword alerts or category notifications, we store your email address and your subscription preferences. You can manage or delete these at any time from your account settings.

2. How We Use Your Data

• Account data: To authenticate you and provide personalised features
• Analytics data: To understand which articles are popular and to rank trending content
• Subscription data: To send you email notifications when relevant articles are published

We do not sell your data to third parties. We do not use your data for advertising targeting.

3. Cookies & Local Storage

Authentication cookie

When you log in, we set a refresh token cookie with the following attributes:

• HttpOnly — inaccessible to JavaScript, preventing XSS theft
• Secure — only sent over HTTPS in production
• SameSite=Strict — not sent on cross-site requests
• Scoped to /owavera-app/api/v1/auth paths only
• Expires after 7 days

This cookie is required for the "stay logged in" feature. It is deleted when you sign out.

Theme preference

If you set a colour scheme preference (light/dark/system), we store it in localStorage as owavera-theme. This never leaves your device.

No tracking cookies

We do not set any advertising, tracking, or analytics cookies.

4. Third-Party Services

Google AdSense

We display advertisements served by Google AdSense. Google may use cookies to serve ads based on your prior visits to other websites. You can opt out of personalised advertising at google.com/settings/ads. See Google's Privacy Policy for full details.

Affiliate partners

Our articles may contain links to affiliate partners (Yellow Card, Luno, Binance, Coinbase, Ledger). When you click these links, the partner may set their own cookies. We do not control those cookies — please review each partner's privacy policy before signing up.

Fonts

Fonts are self-hosted on our servers. We do not load fonts from Google Fonts or any external CDN, so no font requests leak to third parties.

5. How Long We Keep Your Data

We retain your email address and account information for as long as your account is active or as needed to provide our services. If you delete your account or submit a deletion request, we will permanently remove your personal data within 30 days. Anonymised analytics data (which cannot identify you) may be retained indefinitely for service improvement.

6. Your Data Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request permanent deletion of your account and personal data
• Objection: Opt out of email communications at any time via the unsubscribe link in any email
• Portability: Request your data in a portable format

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

7. Applicable Data Protection Laws

Owavera complies with applicable data protection laws including the Protection of Personal Information Act (POPIA) in South Africa, the Nigeria Data Protection Act (NDPA) 2023, and the General Data Protection Regulation (GDPR) where applicable. Our designated privacy contact is [email protected].

8. Data Deletion Request

To delete your account and all associated personal data:

1. Email [email protected] from the address linked to your account
2. Include "Data Deletion Request" in the subject line
3. We will confirm deletion within 7 business days

Note: anonymised analytics event hashes (which cannot be re-linked to your identity) may be retained for up to 90 days as part of aggregate reporting.

9. Security

We protect your data with:

• HTTPS on all connections (TLS 1.2+)
• bcrypt password hashing (strength 12)
• httpOnly, Secure, SameSite cookies for session management
• IP address hashing (SHA-256) before storage — we never log raw IPs
• JWT-based authentication with 24-hour access token expiry

10. Changes to This Policy

If we make material changes to this policy, we will update the "Last updated" date at the top of this page. Continued use of Owavera after changes take effect constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions, use our contact form or email [email protected].