Privacy Policy

1. Who We Are and the Scope of This Policy

OtwoX Digital Solutions (referred to in this document as "OtwoX," "we," or "us") is a technology company based in Kampala, Republic of Uganda. We build custom software, artificial-intelligence solutions, business management systems, and web and mobile applications. Our website is otwox.com.

This Policy covers:

• Our website at otwox.com, including its pages and contact forms.
• All OtwoX products and applications published under our name, including our mobile apps on Google Play and our web applications.
• Data we process as the controller, meaning where we determine the purposes and means of processing.

OtwoX uses a single umbrella structure for privacy: Part One applies to every one of our products without exception, and Part Two adds a separate, product-specific disclosure for each product. Where a product-specific disclosure conflicts with a general provision, the product-specific disclosure prevails for that product only.

2. Information We Collect and Why

We work on the principle of data minimisation: we collect only what the feature you are actually using requires, and we do not ask for data merely because it might be useful later. In many of our products, core features work without creating an account at all.

Information you provide voluntarily

• Contact details when you complete a form or write to us: name, email address, phone number, organisation or company name, and the content of your message.
• Account details in products that offer sign-in: your email address, and whatever you choose to put in your profile.
• Content you create inside a product, and any files, images, or recordings you deliberately upload.

Information generated by your use of a product

• Your preferences and settings, such as language, favourites, and reminders. In several of our applications these preferences are stored only on your device and never reach our servers.
• Records a feature cannot work without, such as follow lists, request status, or your progress through a task.

Technical information collected automatically

• IP address, browser type, operating system, pages visited, and the dates and times of visits.
• We use this to operate the service, measure its performance, and protect it from abuse and intrusion. We review it in aggregate rather than individually.

3. How We Use Information

We use your data for specific, disclosed purposes, on a lawful and transparent basis:

• To operate the product: deliver the features you asked for, give you access to your account, and save your work.
• To communicate with you: answer your enquiries and send notices and updates about the service you use.
• To improve: understand in aggregate how our products are used, so we can improve performance and usability.
• To protect: prevent abuse, fraud, and unauthorised access, and review reported content.
• To comply: meet the legal and regulatory obligations that apply to us.

Purpose limitation: we do not repurpose your data for a new, unrelated purpose without informing you and obtaining your consent where applicable law requires it. We do not send you marketing messages without your express consent, and you may withdraw that consent at any time.

4. Sharing — We Do Not Sell Your Data

We share your data only in the following limited circumstances:

• Trusted service providers who help us operate our products, such as hosting, database, authentication, email, and analytics providers. Each receives only what its task requires, is bound to confidentiality, and may use the data solely on our behalf. The disclosure for each product in Part Two names its providers.
• Competent authorities where a binding legal obligation or valid court order requires disclosure, and only to the extent required.
• With your consent or at your direction, for example when you ask us to connect your account to another service.
• Content you publish publicly inside a product that offers public posting, which is by its nature and by your choice visible to everyone.

5. Our Website and Cookies

The otwox.com website uses essential cookies without which the site cannot function, such as those that hold your session and your chosen language. We may also use analytics cookies that show us how visitors use the site in aggregated, anonymised form. You can manage or delete cookies in your browser settings, bearing in mind that disabling essential cookies may stop parts of the site from working.

Data you submit through our contact form is recorded in our customer-relationship system and used to reply to you and follow up on your request. It is not used in marketing campaigns without your consent.

6. Your Rights

Subject to the limits permitted by applicable law, you have the following rights over your personal data:

• Access: to know what data we hold about you and to receive a copy of it.
• Correction: to correct data that is inaccurate or incomplete.
• Deletion: to request erasure of your data. In products with accounts, you can delete your account yourself.
• Objection and restriction: to object to a particular processing of your data or ask us to restrict it.
• Withdrawal of consent: to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Complaint: to complain to us or to the competent supervisory authority in your country.

To exercise any of these rights, write to privacy@otwox.com. We respond within 30 days, and we may ask you to verify your identity first, to protect your account from impersonation.

7. Data Security

• Data travels between your device and our servers over an encrypted HTTPS connection.
• We apply least-privilege access controls, so no one reaches more than their role requires.
• Our databases enforce row-level access rules that prevent any user from reading or modifying another user's data.
• We keep regular backups and monitor our systems for unauthorised access.

No electronic system is absolutely secure. We work continuously to strengthen our safeguards, and if a security incident materially affects your personal data we will notify you and the competent authority to the extent and within the time that applicable law requires.

8. Data Retention and Deletion

We keep your data only for as long as is necessary for the purpose it was collected for, or for as long as applicable law requires, after which it is securely deleted or stripped of anything that identifies you.

• Account data: deleted immediately and permanently when you delete your account inside the product.
• Deletion requests by email: acted on within 30 days of receipt and identity verification.
• Backups: data may persist in encrypted backups for a limited period before the normal backup cycle replaces them.
• Aggregate data: we may retain anonymised statistics that cannot be traced back to you.

9. Children

OtwoX products are intended for a general audience, and creating an account is for users aged 13 and over. We do not knowingly collect personal data from children under that age, and we do not direct our products at them.

If we learn that we have collected data from a child under that age, we delete it. Any parent or guardian who believes their child has provided us with data may write to privacy@otwox.com and we will remove it.

10. International Data Transfers

OtwoX operates from Kampala, Uganda, and relies on service providers whose servers may be located in other countries. Data for some of our products is stored and processed in the European Union (specifically in Frankfurt, Germany, with certain providers), and other data may be processed in additional regions where those providers operate.

We select providers that offer appropriate safeguards and bind them contractually to keep data confidential and use it only for the agreed purpose. By using our products, you understand that your data may be processed outside your country of residence.

11. Changes to This Policy

We may update this Policy from time to time to reflect changes in our products or in legal requirements, or to add a new product disclosure to Part Two. Any update is published on this same page with a new last-updated date at the top.

If a change is material and significantly affects your rights, we will notify users by an appropriate means, such as an in-product notice or an email. Continuing to use our products after an update is published constitutes acceptance of it.

12. How to Contact Us

For any question about this Policy, or to exercise any of the rights described above:

• Privacy privacy@otwox.com
• General info@otwox.com
• Phone +256 785 140 035
• Address Kampala, Uganda

Data controller: OtwoX Digital Solutions — أوتواكس للحلول الرقمية, Kampala, Uganda.

13. Mobile Apps: Ishraqa (Daily Wisdom)

This section applies to the Ishraqa (Daily Wisdom) app on Google Play, developed by OtwoX Digital Solutions. App page: https://ishraqa.otwox.com

Disclosure last updated: October 2026 · version 1.2

Using the app without an account

You can read the daily quotes, articles, books, and opportunities without an account. Your preferences (favorites, streaks, reading goal and reading time, book progress, greeting name, interests) are stored only on your device and are not sent to our servers.

When you create an account (optional)

Signing in is required to post in "Your Culture" or to follow writers. We then collect:

• Email address (or basic Google account details if you sign in with Google), only to identify you and sign you in.
• The public profile you write yourself: display name (a pseudonym is fine), profile photo, bio, region, and country. These are publicly visible with your posts.
• Content you post: text, images, and voice recordings you submit to "Grandma's Wisdom". Submissions are reviewed before publication and then shown publicly under your display name. Microphone permission is requested only when you tap the record button; nothing is recorded in the background.
• Follows, reports, and block lists you create.

How we use data

• To run app features: showing posts, follows, content review, and handling reports.
• We do not sell your data, show ads, or share data for advertising.

Service providers

• Supabase (database, file storage, and authentication; servers in the EU, Frankfurt).
• Google (Google sign-in if you choose it, Google Play services, and optional support payments through Google Play Billing; we never see your card details).
• Anthropic (drafting articles for our editorial team, and explaining quotes in the "Explain" feature. Only the quote text is sent; no user data is sent to it).

Notifications

Notifications (morning quote, reading reminder, opportunity deadlines) are scheduled locally on your device and can be turned off at any time in Settings.

Account and data deletion

You can permanently delete your account in the app: Account → Delete account. This immediately deletes your account, public profile, posts, images, and follows from our servers. You can also request deletion by email; we act on requests within 30 days.

Children

The app is intended for a general audience; creating an account is for users aged 13 and over. We do not knowingly collect data from children.

Security

Data is transmitted over encrypted connections (HTTPS), and database access rules prevent any user from modifying another user's data.

Privacy contact

Privacy contact for this app: privacy@otwox.com — you may also write to the Ishraqa app team directly at saifuddin.ai.dev@gmail.com.