Privacy notice
Plain answers about your information, written for readers first.
The short version
- You can read the whole briefing without giving us anything. There are no advertising or analytics cookies, no tracking pixels and no third-party scripts. Fonts are served from this site.
- If you choose to sign in, to comment, react or highlight, we keep your email address to sign you in. It is never shown to anyone and never sold.
- Comments are published under the name and role you give, after a person has reviewed them. Reactions and highlights are shown only as counts.
- We add you to Al Kags's Substack newsletter only if you tick the box to say so. You can change your mind at any time.
- You can download everything we hold about you, or delete your account and all your activity, yourself, at any time.
Who is responsible for your information
Curious Briefs is published by Al Kags (Curiosity) at alkags.agency. Al Kags is the data controller: the person who decides how your information is used and who answers to you and to regulators for it.
Contact for anything about your information: agency@alkags.me. Postal address: P.O. Box 50474 - 00100, Nairobi, Kenya.
The briefing is supported by The ChangeOrg (changeorg.africa). The ChangeOrg does not receive any information about readers.
Reading the briefing
You do not need to sign in to read, download PDFs or share pages. When you read:
- We set no cookies.
- Your choices of reading length, text size and colour theme are kept in your own browser (local storage). They are never sent to us.
- Our host, Cloudflare, processes your IP address and browser details to deliver the pages and to protect the site from attacks. We do not use this information to identify you, and we do not run analytics on it.
- Sharing buttons are plain links. Nothing is sent to a social network unless you choose to share.
If you sign in
Signing in lets you comment, react to sections and highlight passages. We use a one-time link sent to your email, so there is no password to store.
| What | Why | Legal basis |
|---|---|---|
| Your email address | To send your sign-in link and to recognise you when you return. Also used to contact you about your own comments if we must. | Necessary to provide the account you ask for (contract); legitimate interests |
A sign-in cookie, cb_session | Keeps you signed in on this device. It is strictly necessary, so it needs no consent banner. It holds a random code, not your email. | Necessary to provide the service |
| The name and role you choose | Shown with your comments. You can use initials. | Your choice to publish (consent) |
| Your comments, and any words you quote | Published on the page after review. | Consent |
| Your reactions and highlights | Shown to others only as totals. A passage is marked as a top highlight when at least two readers highlight it. | Consent |
| The time you ticked the Substack box, and its exact wording | Our record that you asked to join the newsletter. | Consent, and our legal duty to show it |
To limit abuse, we count sign-in requests and posts for 24 hours. These counts are stored under one-way scrambled codes (hashes), never your email or IP address itself.
Comments and moderation
Every comment is read by a person before it appears. Until then it shows as “Awaiting review”, to you only. Comments that are abusive, off topic, unlawful or that reveal someone else's personal information are not published. Someone who repeatedly posts such comments may be blocked.
Published comments are public and can be read by anyone, including search engines. Please do not include personal information you do not want public. You can delete your own comments at any time.
The Substack newsletter
When you sign in there is a box, unticked, that says: “Add me to Al Kags's Substack newsletter. I can unsubscribe at any time.” We add you only if you tick it.
If you tick it, we pass your email address and name to Substack Inc. by importing them into Al Kags's publication, usually within a month. From then on Substack holds your subscription under its own privacy policy (opens in a new tab).
To change your mind, untick the box in your account panel on this site: you will not be included in any further import. If you have already been added, use the unsubscribe link at the foot of any newsletter. It takes one click.
Who else handles your information
We never sell or rent your information, and we do not use it for advertising or profiling. These organisations handle it on our instructions only:
| Organisation | What they do | What they receive |
|---|---|---|
| Cloudflare, Inc. | Hosting, the database that stores accounts and comments, and protection against attacks | Everything described in this notice, stored in its database |
| Resend (Plus Five Five, Inc.) | Sends sign-in emails, from its Ireland (EU) region | Your email address and the email itself |
| Anthropic PBC | Its assistant, Claude, helps the editor moderate comments and edit the briefing | The text, display name and role of comments, including those awaiting review. Never your email address. |
| Substack Inc. | The newsletter, only if you ticked the box | Your email address and name |
Where your information goes
These organisations are based in the United States, and Cloudflare may process information in data centres in many countries. Where your law requires it, transfers are protected by recognised safeguards: the European Commission's Standard Contractual Clauses and, where they apply, the EU-US Data Privacy Framework and its UK extension. These cover transfers under the Kenya Data Protection Act 2019, the Nigeria Data Protection Act 2023, South Africa's Protection of Personal Information Act 2013 and the UK and EU GDPR. You can ask us for a copy of the safeguards that apply.
How long we keep it
| Information | Kept for |
|---|---|
| Sign-in links | 15 minutes to use; deleted a day later |
| Sign-in sessions | 90 days, or until you sign out |
| Abuse-prevention counts | 24 hours |
| Your account, comments, reactions and highlights | Until you delete them or your account. Accounts with no activity for three years are deleted. |
| Comments that were not published | Deleted after 90 days |
| Your Substack consent record | While you remain on the list. If you withdraw, only the dates you agreed and withdrew are kept, for three years. Deleting your account removes it at once. |
Your rights
Wherever you live, you can:
- see what we hold about you, and take a copy in a standard format: use Download my data in your account panel;
- correct it: change your name or role in your account panel;
- delete it: use Delete my account. This removes your account, comments, reactions and highlights at once and cannot be undone;
- withdraw consent, for example to the newsletter, at any time; this does not affect what was done before;
- object to or ask us to restrict how we use it.
For anything you cannot do yourself, email us. We reply within one month, and sooner where your law requires it. We will not charge you. These rights are given by the Kenya Data Protection Act 2019, the Nigeria Data Protection Act 2023, South Africa's Protection of Personal Information Act 2013, the UK GDPR and the EU GDPR, among others.
How we protect it
- All connections are encrypted (HTTPS).
- Sign-in links and session codes are stored only in scrambled form, so a copy of the database would not let anyone sign in as you.
- The site loads no scripts from other companies, and a strict security policy stops pages from running anything else.
- Only named editors can see comments awaiting review or the newsletter list.
- If a breach puts your information at risk, we will tell the regulator within 72 hours and tell you without delay where the law requires it.
Children
The briefing is written for adults. Please do not sign in if you are under 18.
Complaints
Please contact us first, so we can put things right. You also have the right to complain to a data protection regulator, for example:
- Kenya: Office of the Data Protection Commissioner (opens in a new tab)
- Nigeria: Nigeria Data Protection Commission (opens in a new tab)
- South Africa: Information Regulator (opens in a new tab)
- United Kingdom: Information Commissioner's Office (opens in a new tab)
- European Union: your national data protection authority (opens in a new tab)
Changes to this notice
This notice is dated 2026-09-30. If we change how we use your information, we will update it here and ask you to read the new version the next time you sign in.
Signed-in readers can download or delete their information from the account panel. Return to the briefing.