Privacy Policy
Last updated: September 2026
1. Introduction
No Safe Word ("we", "us", "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect information when you use our website and any associated services.
2. Information We Collect
We may collect the following types of information:
- Account Information: When you create an account, we collect your WhatsApp number or your email address, along with any name or profile information you choose to provide. If you message us on WhatsApp, we keep those messages.
- Payment Information: When you make a purchase or subscribe, payment is processed securely through our third-party payment provider (Payfast). We do not store your credit card or banking details directly.
- Usage Data: We may collect information about how you interact with our website, including pages visited, reading progress, device information, and whether you opened an email we sent you.
- Cookies and Similar Technologies: We use cookies to keep you signed in and to understand how the site is used. Some of them also let us show our adverts to people who have visited before. Section 11 lists the tools we use and how to switch them off.
3. How We Use Your Information
We use the information we collect to:
- Provide and maintain our services
- Process purchases and subscriptions
- Manage your account and provide customer support
- Send you updates about new stories and features (with your consent)
- Improve our website and reading experience
- Show our adverts to people who have visited the site before (see section 11)
- Comply with legal obligations
4. Third-Party Processors (POPIA Section 72)
We do not sell your personal information. We share information only with the processors listed below, each engaged solely to operate or promote the Service:
- Payfast — payment processing. Handles subscription and purchase transactions; processes your card or bank details, the email address on your account and what you bought. If you sign in with WhatsApp, that address is one we create from your phone number. Hosted in South Africa.
- Supabase — database hosting and authentication. Processes account data and login credentials. Hosted in the EU.
- Resend — transactional and marketing email delivery. Processes your email address, the content of emails we send you, and whether you opened them. Based in the US.
- WhatsApp — sign-in codes, story alerts and support replies for accounts that use WhatsApp sign-in. Processes your phone number and the content of messages you exchange with us. Delivered through a gateway we host ourselves on Railway in the EU.
- Anthropic — the AI service that writes the replies from our WhatsApp assistant. Processes your recent WhatsApp messages with us, your name, and your reading, membership and purchase history. Based in the US.
- Railway — application hosting. Processes all traffic routed to the site. Hosted in the EU.
- Cloudflare — website security and delivery, and forwarding email sent to our addresses. Processes your IP address, device information, the pages you request and any email you send us. Based in the US.
- Google — website analytics (Google Analytics), advertising (Google Ads), reading phone numbers our own checks cannot (Gemini), and the inbox that receives email you send us (Gmail). Processes the pages you visit, device information and cookie identifiers; a phone number you type into a sign-up form, if we cannot read it ourselves; and the content of email you send us. Based in the US.
- Meta — measures our adverts on Facebook and Instagram (the Meta Pixel). Processes the pages you visit and cookie identifiers. Based in the US.
- Microsoft — Microsoft Clarity, which shows us how pages are used. Processes taps, scrolling and device information. Based in the US.
- Browser notification services — if you turn on our Friday notifications, your browser's own service (Google, Apple, Mozilla or Microsoft) delivers them. Processes an address for your device; the notification itself is encrypted, so they cannot read it. Based in the US.
- Legal Requirements: We may disclose information if required by law or to protect our rights.
Some of the recipients listed above are located outside South Africa. Section 72 of POPIA allows those transfers where the recipient is bound by a law, binding corporate rules, or an agreement that protects your information to a standard comparable to POPIA, or where you have consented. We choose our providers on that basis, and we do not share your information with anyone who is not listed here.
5. Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. This includes encryption of data in transit (HTTPS), secure authentication mechanisms, and regular security reviews.
6. Your Rights
In accordance with the Protection of Personal Information Act (POPIA) of South Africa, you have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Object to the processing of your personal information
- Withdraw consent for marketing communications
To exercise any of these rights, please contact us at [email protected].
7. Data Retention
We retain your personal information for as long as your account is active or as needed to provide you with our services. If you request account deletion, we will remove your personal information within a reasonable timeframe, except where we are required to retain it by law.
8. Children's Privacy
Our services are intended for users aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected information from a minor, we will take steps to delete that information promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.
10. Marketing Communications
When you subscribe to access a story, you can optionally consent to receive marketing communications from us. This includes:
- Email: notifications when a new story is published, and occasional special promotions.
- WhatsApp: same notifications via WhatsApp, if you provided your WhatsApp number, and a short welcome sequence when you join.
- Browser notifications: our free story each Friday, if you switch them on in your browser.
You can unsubscribe from any of these channels at any time:
- Email: every email contains an unsubscribe link.
- WhatsApp: reply STOP to any message from us. Telling us in your own words that you want the messages to stop works too.
- Browser notifications: turn them off at /account/notifications, or in your browser or device settings.
Unsubscribing from one channel does not unsubscribe you from the others. To remove your data entirely, contact us at [email protected].
We process your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).
12. Contact
If you have any questions about this Privacy Policy or our data practices, please contact us at [email protected].