Privacy Policy

This policy explains what information Gists collects, why, where it is kept and the choices you have. Gists is run by Goadvert iAdvertise (Private) Limited ("we", "us"), 21 Glenara Avenue South, Eastlea, Harare, Zimbabwe, which is responsible for your information. We follow Zimbabwe's Cyber and Data Protection Act and treat everyone, wherever they live, with the same care.

What we collect

• Account details: your name, username, email address, password (stored scrambled, never readable) and date of birth. Your birthday is never shown to anyone; we use it to check your age.
• Backup email and email changes: a second email address, if you add one, used only to help you get back into your account and for security alerts. When you change your main email we send a link to the new address and a notice to the old one.
• If you sign in with Google or Apple: the name, email address and account ID they share with us. We never see your Google or Apple password.
• Profile: photo, bio and settings such as private account, message requests and theme.
• Your location, if you add it (country, region, city), used to show you promoted Gists for your area and to estimate how many people a boost can reach. You choose whether it shows on your profile.
• Your gender, if you add it. Gender is optional. It's shown on your profile only if you choose, never for under-18s, and isn't used for ads.
• What you share: Gists (photos, videos, voice notes, text, GIFs, polls), stories, captions, comments and replies, reactions, saves, follows and blocks, and what you post in groups and channels.
• Calls and live rooms: who called whom, when and for how long (shown as a note in the chat), and who hosted, joined and spoke in a live voice room. We don't record calls or live rooms: the sound and video pass through LiveKit (see below) while they happen and aren't stored.
• Business accounts: the business details you choose to show, such as a category, website, phone or opening hours.
• Invites and credits: who joined through your invite link and the credits you earned or used.
• Messages: your one-to-one and group chats, so they can be delivered and shown to the people in them.
• Finding friends from your contacts, if you choose it: the Gists app scrambles the email addresses in your phone's contacts on your phone (a one-way code called a hash) and sends only those codes to us. We compare them with Gists accounts, show you the matches and then throw the codes away. We never receive or keep your contacts' names, numbers or addresses. You can stop others finding you this way in Settings ("Let people find me by email").
• Link previews: when you post a link in a Gist, comment or chat, our server visits that public web page once to fetch its title, picture and site name, and shows them as a card. The website sees our server, not you.
• Messages you schedule wait on our server, seen only by you, until we send them at the time you chose.
• Reports you send, and reports others make about you. Under Account status you can see whether we've reviewed your reports and acted on them (never who was reported or what happened to them beyond that).
• Appeals you send against our decisions, and what we decided.
• Time on Gists: if you set a break reminder or daily limit, the app counts your time on your phone only; it isn't sent to us.
• Device and technical data: a push-notification token for your phone if you allow notifications, your IP address, browser or device type, and sign-in times, used to keep accounts secure and stop abuse.

We don't sell your information, we don't show ads based on it, and we don't use your private messages for anything except delivering them, keeping Gists safe and handling reports.

How we use it

• To run Gists: your account, feed, profile, chats and notifications.
• To keep people safe: age checks, protections for 17-year-olds, blocking, reviewing reports and stopping spam and abuse.
• To contact you about your account, such as password resets and important changes.
• To fix problems and improve Gists.
• When the law requires it.

Who can see what

• Your name, username, photo, bio and follower counts are public.
• Your Gists are seen by everyone if your account is public, or only by approved followers if it is private (or if you choose "Followers" when posting).
• On the open web: if you're 18 or over and your account is public, your profile and your Gists shared with "Everyone" can be seen at gists.chat by people who aren't signed in, and can appear in search engines such as Google and in link previews when someone shares them. Comments, likes, followers lists and chats never appear there. Make your account private to stop this (search engines may take a while to drop pages they already saw). Profiles and posts of under-18s, private accounts, followers-only and close-friends posts, group posts and posts marked sensitive are never shown on the open web.
• Messages are seen only by the people in that chat.
• People you block can't see your Gists or contact you.

Where it is kept

We use a few trusted companies to run Gists. They only handle your information on our instructions:

• Vultr: our server in Johannesburg, South Africa, which holds the database (accounts, messages, comments) and its backups.
• Cloudflare: stores photos and voice notes (in Europe), protects the website and delivers it quickly.
• Resend: sends our emails (servers in Ireland).
• Google and Apple: sign-in if you choose it, and phone notifications.
• Expo: passes notifications on to Google and Apple for the Gists app.
• LiveKit: carries the sound and video of calls and live rooms between the people in them, along with your name, username and profile photo so they can see who is there. LiveKit doesn't record them for us.
• Paynow: handles payments if you pay for something on the website. We never see your card or mobile-money PIN.
• GIPHY: GIF search. The words you type into the GIF search are sent to GIPHY by our server, without your name or account. When a GIF is shown, your phone or browser loads it straight from GIPHY, so GIPHY sees your device's internet address, as any website would. GIPHY's own privacy policy applies to that.

This means your information may be stored outside your own country. We choose providers with strong security and we keep what we share with them to the minimum needed.

How long we keep it

• Your information stays while your account exists.
• A deleted Gist disappears at once and its files are erased within 30 days. Uploads you started but never posted are erased within 2 days.
• Stories disappear after 24 hours, unless you keep them in a highlight on your profile.
• When you delete your account we erase your profile, Gists and their files, comments, reactions, saves and follows straight away. Messages you sent in chats stay in the other people's chats, shown as from a deleted account, because they are part of their conversations too.
• Copies in our backups are cleared out on their normal schedule (within about 30 days).
• We may keep a record longer when the law requires it or to deal with a serious report.

Verification and identity documents

You can ask for a verified badge. To check that you are who you say you are, we ask you to upload documents on the Gists website (gists.chat). You cannot upload them in the apps.

• When this applies. You don't need to send an ID to ask for the badge right now. This section covers documents people sent earlier, and any we ask for in future.
• What we collect. For a public figure or creator: the front and back of your national ID or driver's licence, and a selfie of you holding the ID. For a business or organisation: its registration certificate, the front of the applicant's ID and a selfie. We also record the document type and the country that issued it.
• Why. To confirm your identity and to stop impersonation and fraud.
• Our legal basis is your consent. You tick a box before you upload. You can withdraw your consent at any time.
• Who sees them. Only Gists admins can open these files. Each view is logged, and photos are watermarked with the admin's name and the time.
• How they are protected. The files are encrypted and kept in private storage. They are never public. They are shown to admins only inside the Gists admin area, with no download button, and never sent anywhere else.
• How long we keep them. The files are deleted 30 days after we decide on your request or you withdraw it. A request that is still waiting after 90 days expires and its files are deleted. Copies in our server backups are replaced automatically as backups roll over, so a deleted document can stay in a backup for a short time before it's gone.
• What we keep afterwards. A short note that the check happened: the document type, the country, whether your name matched, and who checked it and when. It stays while your account exists.
• We never sell or share them. We only hand them over where the law requires it.
• Early deletion. Choose "Withdraw my request" in Settings. That withdraws your request and deletes the files. If you delete your account, they are deleted at once. You can also write to [email protected].

The rules for the badge itself are in the Verification terms.

Your rights

You can see and change most of your information in your profile and Settings, and delete your account at any time. You can also ask us for a copy of your information, ask us to correct or erase it, or object to how we use it, by writing to [email protected]. We reply within 30 days. If you are unhappy with our answer, you can complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the data protection authority, or to the authority where you live.

Security

Gists uses encrypted connections (HTTPS), scrambled passwords, private file storage and limited staff access. No system is perfect, so please use a strong password that you don't use anywhere else.

Age

Gists is for people aged 17 and older. If we learn that someone younger has an account, we delete it. If you believe a child is using Gists, tell us at [email protected].

Cookies

The website uses only the cookies it needs to work: keeping you signed in and protecting forms from misuse. Your theme choice is saved with your account, not in a cookie. We don't use advertising or tracking cookies.

Changes

If we change this policy in a way that matters, we will tell you on Gists or by email before it takes effect.

Place names

Place names from GeoNames (geonames.org), used under the CC BY 4.0 licence.