Privacy Policy

Last updated: September 2026

1. Introduction

No Safe Word ("we", "us", "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect information when you use our website and any associated services.

2. Information We Collect

We may collect the following types of information:

  • Account Information: When you create an account, we collect your WhatsApp number or your email address, along with any name or profile information you choose to provide. If you message us on WhatsApp, we keep those messages.
  • Payment Information: When you make a purchase or subscribe, payment is processed securely through our third-party payment provider (Payfast). We do not store your credit card or banking details directly.
  • Usage Data: We may collect information about how you interact with our website, including pages visited, reading progress, device information, and whether you opened an email we sent you.
  • Cookies and Similar Technologies: We use cookies to keep you signed in and to understand how the site is used. Some of them also let us show our adverts to people who have visited before. Section 11 lists the tools we use and how to switch them off.

3. How We Use Your Information

We use the information we collect to:

  • Provide and maintain our services
  • Process purchases and subscriptions
  • Manage your account and provide customer support
  • Send you updates about new stories and features (with your consent)
  • Improve our website and reading experience
  • Show our adverts to people who have visited the site before (see section 11)
  • Comply with legal obligations

4. Third-Party Processors (POPIA Section 72)

We do not sell your personal information. We share information only with the processors listed below, each engaged solely to operate or promote the Service:

  • Payfast — payment processing. Handles subscription and purchase transactions; processes your card or bank details, the email address on your account and what you bought. If you sign in with WhatsApp, that address is one we create from your phone number. Hosted in South Africa.
  • Supabase — database hosting and authentication. Processes account data and login credentials. Hosted in the EU.
  • Resend — transactional and marketing email delivery. Processes your email address, the content of emails we send you, and whether you opened them. Based in the US.
  • WhatsApp — sign-in codes, story alerts and support replies for accounts that use WhatsApp sign-in. Processes your phone number and the content of messages you exchange with us. Delivered through a gateway we host ourselves on Railway in the EU.
  • Anthropic — the AI service that writes the replies from our WhatsApp assistant. Processes your recent WhatsApp messages with us, your name, and your reading, membership and purchase history. Based in the US.
  • Railway — application hosting. Processes all traffic routed to the site. Hosted in the EU.
  • Cloudflare — website security and delivery, and forwarding email sent to our addresses. Processes your IP address, device information, the pages you request and any email you send us. Based in the US.
  • Google — website analytics (Google Analytics), advertising (Google Ads), reading phone numbers our own checks cannot (Gemini), and the inbox that receives email you send us (Gmail). Processes the pages you visit, device information and cookie identifiers; a phone number you type into a sign-up form, if we cannot read it ourselves; and the content of email you send us. Based in the US.
  • Meta — measures our adverts on Facebook and Instagram (the Meta Pixel). Processes the pages you visit and cookie identifiers. Based in the US.
  • Microsoft — Microsoft Clarity, which shows us how pages are used. Processes taps, scrolling and device information. Based in the US.
  • Browser notification services — if you turn on our Friday notifications, your browser's own service (Google, Apple, Mozilla or Microsoft) delivers them. Processes an address for your device; the notification itself is encrypted, so they cannot read it. Based in the US.
  • Legal Requirements: We may disclose information if required by law or to protect our rights.

Some of the recipients listed above are located outside South Africa. Section 72 of POPIA allows those transfers where the recipient is bound by a law, binding corporate rules, or an agreement that protects your information to a standard comparable to POPIA, or where you have consented. We choose our providers on that basis, and we do not share your information with anyone who is not listed here.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. This includes encryption of data in transit (HTTPS), secure authentication mechanisms, and regular security reviews.

6. Your Rights

In accordance with the Protection of Personal Information Act (POPIA) of South Africa, you have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Object to the processing of your personal information
  • Withdraw consent for marketing communications

To exercise any of these rights, please contact us at [email protected].

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. If you request account deletion, we will remove your personal information within a reasonable timeframe, except where we are required to retain it by law.

8. Children's Privacy

Our services are intended for users aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected information from a minor, we will take steps to delete that information promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

10. Marketing Communications

When you subscribe to access a story, you can optionally consent to receive marketing communications from us. This includes:

  • Email: notifications when a new story is published, and occasional special promotions.
  • WhatsApp: same notifications via WhatsApp, if you provided your WhatsApp number, and a short welcome sequence when you join.
  • Browser notifications: our free story each Friday, if you switch them on in your browser.

You can unsubscribe from any of these channels at any time:

  • Email: every email contains an unsubscribe link.
  • WhatsApp: reply STOP to any message from us. Telling us in your own words that you want the messages to stop works too.
  • Browser notifications: turn them off at /account/notifications, or in your browser or device settings.

Unsubscribing from one channel does not unsubscribe you from the others. To remove your data entirely, contact us at [email protected].

We process your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).

11. Cookies, Analytics and Advertising

We use these tools to understand how the site is used and to show our adverts to people who have visited before:

  • Google Analytics counts visits and records how the site is used (for example, which chapters are opened and where readers stop), using a cookie set by this site. We use its advertising features: remarketing and Google signals.
  • Google Ads shows our adverts on other websites and apps. Third-party vendors, including Google, use cookies to serve ads based on your earlier visits to this site. Google's advertising cookies let it and its partners serve ads to you based on your visits to this site and to other sites on the internet. The Google Analytics cookie and Google's advertising cookies are used together to do this.
  • Meta Pixel tells Meta which pages were visited, so we can measure our adverts on Facebook and Instagram.
  • Microsoft Clarity records how pages are used (taps, scrolling and where people get stuck) so we can fix what is confusing.

You can switch these off:

  • To stop Google showing you personalised adverts, including ours, use Google's Ads Settings (now called My Ad Center) at myadcenter.google.com.
  • To stop Google Analytics recording your visits to any website, install Google's opt-out browser add-on on your computer.
  • To stop this site counting your visits at all, in the browser you are using, visit nosafeword.co.za/analytics-optout. In that browser, this site then stops loading Google Analytics, Google's advertising tags, the Meta Pixel and Microsoft Clarity.

12. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at [email protected].