Security & Privacy at Uswazi Wazi

• Sign-in is handled by our managed authentication provider with email and Google OAuth.
• Passwords are never stored by the application — only by the auth provider, hashed at rest.
• Administrative privileges are stored separately from user profiles to prevent self-escalation.
• Each authenticated request is verified server-side; client-side role checks are not trusted.

• Row-level security is enabled on every user-owned table; you can only read your own data unless a record is explicitly published.
• Private book files live in a non-public storage bucket and are only readable by the creator, confirmed buyers, and active subscribers.
• Reviewer identities are not exposed to anonymous visitors on public review listings.
• Internal payment identifiers and private file URLs are hidden from anonymous visitors.

• Account profile (name, email, optional profession, preferences) that you provide.
• Content you create (books, chats, prompts, reading progress).
• Purchase and subscription metadata returned by our payments processor.
• Basic operational logs needed to run the service.

We rely on the following third parties to operate the service:

• Lovable Cloud — hosting, database, authentication, file storage.
• Stripe — payments and subscription billing.
• Lovable AI Gateway — AI model inference for chat, generation, and analysis features.

Content you submit to AI features is transmitted to the AI Gateway for processing.

• You can update profile fields from your Account page at any time.
• You can delete your own books, reviews, and favorites from within the app.
• To request full account deletion or a copy of your data, contact us at the address below.

To report a security issue or ask a privacy question, email security@uswaziwazi.dev. We aim to acknowledge reports within a few business days.