Effective 20 September 2026. Last updated 20 September 2026.
Guava is a publishing and learning platform for Tanzanian readers, writers and teachers. It is available on the web at guava.co.tz and as an Android application. People use Guava to read and publish articles and documentaries, to follow authors, to take and teach courses, and to message one another.
This policy explains what information Guava collects, why it collects it, who it is shared with, how long it is kept, and how you can get it removed. It applies to the website, the Android application, and every account created through them. It is written to be read rather than to be skipped, so it says plainly what happens to your information.
If you do not agree with this policy, please do not create a Guava account. If you already have one, you can close it at any time using the steps in Deleting your account.
Guava is operated from Tanzania. The operator of Guava is the data controller for the information described in this policy. You can reach a human about anything in this document at [email protected], and we answer privacy requests at that address.
Guava does not run its own password system for readers. The only way to sign in is with a Google account, using Google's Sign in with Google service. When you choose to sign in, Guava asks Google for two standard scopes and nothing more:
| Google scope | What it gives Guava | Why Guava needs it |
|---|---|---|
.../auth/userinfo.email |
Your email address, and whether Google has verified it | It is the unique identifier for your account. It is how we recognise you as the same person on your next visit, how we contact you about your account, and how we prevent one person quietly holding many accounts. |
.../auth/userinfo.profile |
Your name and your Google profile picture | Your name becomes your starting display name and your picture becomes your starting avatar, so your profile is not blank on your first visit. You can change both at any time in Settings, and changing them in Guava does not change anything in your Google account. |
Guava requests no sensitive and no restricted scopes. It does not request access to your Gmail, your Drive, your Calendar, your Contacts, your Photos, or any other Google service. It cannot read your email and it cannot see your files. The consent screen Google shows you lists exactly what is being requested, and it is only ever those two items.
Guava never receives and never stores your Google password.
Guava's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In concrete terms, for the name, email address and profile picture we receive from Google:
Guava does not sell your personal information, and never has. It is shared only in these situations:
Your display name, username, avatar, biography and anything you publish are visible to anyone on the internet, including people without a Guava account and search engines. That is the point of a publishing platform. Your email address is never part of this. Your direct messages are never part of this.
| Provider | What it handles |
|---|---|
| Supabase | Database, authentication and file storage. This is where your account and your content live. |
| Cloudflare | Website hosting, content delivery and protection against attacks. Handles the technical request information described above. |
| Sign in with Google. Google's own handling of your data is governed by the Google Privacy Policy. |
These providers act on our instructions and may not use your information for their own purposes.
We may disclose information where we are required to by Tanzanian law, by a valid legal order, or where it is necessary to protect the rights, safety or property of Guava, our users or the public.
You can close your Guava account yourself, without asking anyone:
Your profile, posts, courses and comments go out of sight the same day. The data is erased permanently 65 days later. Before that date you can sign back in and choose Keep my account to restore everything.
Closing your Guava account does not delete your Google account. To stop Guava having any access at all, you can also remove it from your Google account at myaccount.google.com/permissions.
If you cannot reach the app, email [email protected] from the address on your account and we will close it for you.
Write to [email protected] to exercise any of these. We respond within 30 days.
Connections to Guava are encrypted with HTTPS. Access to your data in the database is controlled by row level security policies enforced by the database itself, so a request can only read the rows that the signed-in account is entitled to read. The administrative dashboard is served from a separate hostname with its own session, so a signed-in reader's browser has no route to administrative access. No system is perfectly secure, and we do not claim otherwise, but if a breach affects your personal information we will tell you and the appropriate authority without undue delay.
Guava is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, write to [email protected] and we will remove it.
Guava is operated from Tanzania, and the providers listed above run infrastructure in other countries. Your information may therefore be stored and processed outside Tanzania. We use providers that offer appropriate protection for data handled on our behalf.
We may update this policy as Guava changes. The effective date at the top always shows the current version. If a change materially affects how your information is used, we will tell you in the app before it takes effect.
Questions, requests and complaints about this policy all go to the same place:
Email: [email protected]
Website: https://guava.co.tz