PRIVACY POLICY
Last Updated: January 18, 2026
1. Introduction
LaunchGround is Kenya's innovation platform. This Privacy Policy explains how we collect, use, store, and disclose personal data in compliance with the Kenya Data Protection Act 2019 (KDPA). The data controller is William Obino, P.O. Box 16646-20100, Nakuru.
2. Information We Collect
We collect the following categories of information:
- Account data: email, name, and username from OAuth providers or provided during sign-up.
- Profile data: bio and avatar you choose to add.
- Content data: launches, comments, and votes you create.
- Session data: IP address, user agent, and timestamps for security.
- Payment data: subscription status via Polar.sh (we do not store card details).
3. How We Use Information
We use personal data to create and manage accounts, deliver services, process payments, maintain security, respond to support requests, and improve LaunchGround. We may also send operational and account-related messages.
4. Legal Basis for Processing
| Data Category | Legal Basis | Justification |
|---|---|---|
| Account data (email, name, username) | Contract | Necessary to provide service |
| Profile data (bio, avatar) | Consent | User chooses to provide |
| Content data (launches, comments, votes) | Contract | Core functionality |
| Session data (IP, user agent) | Legitimate Interest | Security, fraud prevention |
| Payment data (subscription status) | Contract | Subscription fulfillment |
| Analytics (view counts, shares) | Legitimate Interest | Improve service |
5. Data Storage and Security
We store personal data in secure environments with access controls and monitoring. Access is limited to authorized personnel and service providers who need it to deliver LaunchGround.
- All data is transmitted over HTTPS.
- Authentication cookies are configured with Secure, HttpOnly, and SameSite attributes where supported.
- When password-based sign-in is used, passwords are securely hashed before storage.
- Database security is managed by Convex infrastructure.
6. Cookies and Similar Technologies
We use cookies and similar technologies to keep you signed in, remember preferences, and understand usage patterns. You can control cookies through your browser settings.
7. Third-Party Services
We work with service providers to operate LaunchGround. Convex and Resend act as data processors under our instructions. Google, GitHub, and Polar.sh operate as independent controllers for authentication and payment services respectively.
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Convex | Database and backend | All user data | United States |
| Google OAuth | Social login | Email, name, profile picture | United States |
| GitHub OAuth | Social login | Email, username | United States |
| Polar.sh | Payments (Merchant of Record) | Email, subscription data | European Union |
| Resend | Email delivery | Email addresses | United States |
| Serwist | PWA/Service Worker | Build assets only | Client-side |
8. Cross-Border Transfers
Your data may be processed by service providers in the United States and European Union. By using LaunchGround, you consent to these transfers. We ensure appropriate safeguards consistent with KDPA requirements.
9. Your Rights
Under the KDPA, you have the right to: access your personal data, request rectification of inaccuracies, request erasure, object to processing based on legitimate interests, request restriction of processing, and data portability. Where processing is based on consent, you may withdraw consent at any time. We respond within 30 days of verifying your request.
10. Data Retention
| Data Category | Retention Period | Notes |
|---|---|---|
| Launches and comments | Indefinite | Until user requests deletion |
| Vote records | Indefinite | Unlinked from account on deletion |
| Profile data | Until deletion + 30 days | Grace period for disputes |
| Session logs (IP, user agent) | 90 days | Security purposes |
| Payment records | 7 years | Kenya Income Tax Act requirement |
| Email address | Until account deletion | Required for account |
11. Children's Privacy
LaunchGround is intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18.
12. Changes to This Policy
We provide at least 30 days' notice before material changes to this Privacy Policy take effect. We will notify you through the platform or by email.
13. Contact and Complaints
For privacy requests, contact us at [email protected]. If you are not satisfied with our response, you may escalate a complaint to the Office of the Data Protection Commissioner (ODPC) at [email protected].
Please review our Terms of Service.