This is an interim notice, written in plain language while our full privacy policy is prepared with a lawyer. It describes what we actually do today. Last updated 20 October 2026.
Who we are
266Labs runs this website (266labs.com) and the writing and reading app at write.266labs.com. We are the controller of the personal data described here. Contact us about anything in this notice at hello@266labs.com.
What we collect
- Your account: your name, email address and password (stored only as a one-way hash we cannot read). If you sign in with Google or GitHub, we receive your name and email from them.
- Writers only: to approve writers, we ask for a phone number, an ID type and number, and optionally a photo of the ID. The photo is stored privately and only our administrators can open it.
- What you post and do in the app: your posts and notes, what you save and follow, quote cards you make, your points, and reports you send.
- Security records: when you sign in we record the date, your IP address, your browser and how you signed in, so we can warn you about sign-ins you do not recognise.
- Reading statistics: when a post is opened we record the IP address, browser and how long it was read, to count views fairly and stop fake views.
- Messages to us: what you send through the contact form, the feedback form or the newsletter signup, including where you came from if you followed one of our links.
- Analytics: this website uses Google Analytics, which sets cookies and collects information about your visit, such as pages viewed and your approximate location.
- Preferences on your device: some settings, such as dark mode, reading mode and accessibility choices, are kept in your browser only and never sent to us.
Why we use it
- To run your account and the app, which is our agreement with you.
- To keep 266Labs safe: confirming emails, checking that you are human (Cloudflare Turnstile), stopping spam and fake views, and warning you about new sign-ins. This is our legitimate interest in a secure service.
- To verify writers before their work goes live, so readers can trust who is publishing.
- To send emails you need: sign-in codes, account notices and, for writers, milestones. We do not sell your data or send marketing without your agreement.
- To understand how the site is used and improve it (analytics).
Who handles it for us
We use trusted providers to run 266Labs, and they process data only on our instructions: Supabase (our database, hosted in the European Union), Render (our server), Netlify (hosting the website and app), Cloudinary (images, including private ID photos), Resend (emails), Cloudflare (Turnstile, the human check), Google (Analytics, and sign-in with Google) and GitHub (sign-in with GitHub). Some of these providers store data outside Nigeria; we choose providers with recognised security standards for this.
How long we keep it
- Your account and posts: while your account is open.
- Closed or deactivated accounts: deleted when you ask us, and automatically 90 days after the account was deactivated, together with its posts.
- Archived posts: deleted after a year.
- Writers' ID photos: kept as a record that the writer was verified, including after the account is deleted. Ask us and we will tell you what we hold, or delete it.
- Security and reading records: kept as long as they are useful for security and fair statistics.
Your rights
Under the Nigeria Data Protection Act 2023 you can ask us to give you a copy of your data, correct it, delete it, stop or limit how we use it, or move it to another service, and you can withdraw any consent you gave. Email hello@266labs.com and we will reply within 30 days. You can change your name and password yourself in the app's Settings. If you are unhappy with how we handled your data, you can complain to the Nigeria Data Protection Commission.
Security
Passwords are hashed, connections are encrypted, ID photos are private, sign-in sessions can be ended from Settings, and only administrators can see writers' identity details. No system is perfectly secure; if something goes wrong that affects your data, we will tell you and the regulator as the law requires.
Children
If you are under 18, please use 266Labs only with a parent's or guardian's permission.
Changes
We will update this notice as 266Labs changes, and replace it with the full policy when it is ready. The date at the top shows the latest version.