Privacy policy
Last updated October 4, 2026
This policy explains what personal data Joytich collects, why, and the choices you have. We collect only what we need to run the community, the shop and the marketplace.
1. What we collect
- Account details: your username, display name, email address and an optional bio. We store your password only as a salted, one-way hash and can never see it.
- Content you post: reviews (critics only), ratings, comments and helpful votes. These are public and show your display name.
- Orders: the books you buy, order totals and the delivery name and address you give at checkout.
- Payments: the method you chose, the amount, the provider's transaction reference, and for M-Pesa the phone number that paid.
- Sellers: files and cover images you upload, your sales, and the M-Pesa number or USDT wallet address you ask us to pay out to.
- Critic applications and disputes: the text you submit.
We never see or store your card number. Card payments are entered on Paystack's secure page, and crypto payments on NOWPayments'.
2. How we use it
- To run your account, show your public profile and rank, and keep you signed in.
- To process payments, deliver and support your orders, handle refunds and disputes, and pay sellers.
- To moderate content and listings, review critic applications, verify accounts and keep the community safe.
- To prevent fraud and abuse, for example by limiting repeated sign-in attempts.
We don't sell your data, and we don't use it for advertising.
3. Cookies and local storage
shelf_session: keeps you signed in for up to 30 days. It's essential and is removed when you sign out.shelf_flash: holds a one-time confirmation message for about a minute.shelf-theme(browser local storage): remembers your light or dark theme choice. It never leaves your device.
We don't use analytics or advertising cookies.
4. Payment providers and other services
We share only what each service needs to do its job:
- Paystack (card payments) receives your email address, the amount and an order reference.
- Safaricom M-Pesa receives your phone number, the amount and an order reference.
- NOWPayments (USDT) receives the amount and an order reference.
- Our email provider delivers receipts and account emails.
- Pages load fonts from Google Fonts and icons from the jsDelivr CDN, which receive your IP address when the files load.
Each provider handles your data under its own privacy policy.
5. What's public
Your display name, username, bio, role, rank, verification status, reviews, comments and (for sellers) listings are visible to everyone. Your email, orders, payments, delivery details and payout details are visible only to you and to site administrators.
6. How long we keep it
We keep account data while your account exists. Order, payment and payout records are kept for as long as tax and accounting law requires, even after an account is deleted. Expired sessions and password-reset links are deleted automatically. Backups are rotated regularly.
7. Your rights
Depending on where you live, including under Kenya's Data Protection Act, 2019, you may have the right to access, correct, export or delete your personal data, or to object to how we use it. You can change your profile, email and password, delete your reviews and comments, and delete your account yourself from Settings. For anything else, contact us using the details below.
8. Security
The site is served only over HTTPS. Passwords are hashed with PBKDF2, session tokens are random and stored only as hashes, forms are protected against cross-site request forgery, and uploaded files are stored privately and served only to buyers. No system is perfectly secure, but we take reasonable steps to protect your data.
9. Children
Joytich is not directed at children under 13, and we don't knowingly collect their data.
10. Changes
If we change this policy, we'll update the date above and, for significant changes, let signed-in members know.
11. Contact
Questions about privacy? Email privacy@shelfnotes.example.