Data Privacy & Usage Policy

We collect only what is necessary to operate a secure, DRM-protected reading service:

• Account data — name, email address, and a securely hashed password (we never store passwords in plain text).
• Purchase & access records — which titles you have requested or been granted, order references, and access expiry dates.
• Reading activity — your last-read page per book, used solely to resume your place, and per-page watermark data (name, order reference, timestamp) embedded for content-security purposes.
• Technical data — IP address and request metadata, used briefly for rate-limiting and abuse prevention, and standard server logs.
• Communications — any message you send us via a purchase request or support email.

• To create and secure your account, and authenticate you when you sign in.
• To grant, track and enforce access to the specific titles you have purchased.
• To watermark book pages so that any leaked content can be traced back to the account that accessed it — this is core to how our DRM protects authors and publishers.
• To resume your reading progress and personalise your library.
• To send transactional email you have triggered — password resets and access-granted notifications. We do not send marketing email.
• To detect and rate-limit abusive behaviour such as scripted scraping, credential stuffing, or excessive search queries.

We process your data under a mix of contractual necessity (delivering the reading service you requested access to), legitimate interest (securing the platform and the content on it), and, where applicable, your consent.

Under the Botswana Data Protection Act, 2018, these grounds correspond to processing that is necessary to perform a contract with you, necessary for our legitimate business interests (in particular, DRM enforcement and platform security), and processing carried out with your consent. Where the GDPR applies to you, the same activities are carried out under the equivalent Article 6 bases: contract, legitimate interests, and consent.

We do not sell your data. Limited data is shared with the infrastructure providers that operate the platform, strictly to deliver the service:

• Our hosting and edge network provider, to serve the application and enforce security headers.
• Our managed database provider, to store account, access and progress records.
• Our transactional email provider, solely to deliver password-reset and access-granted messages.
• Our object-storage provider, to host book cover art and chapter images.

Each provider is contractually restricted to processing data only on our instructions.

Some of these providers process data outside Botswana, including within the European Economic Area. Where the GDPR applies to you, we rely on providers that offer appropriate safeguards (such as standard contractual clauses) for any transfer of your data outside the EEA. Under the Botswana Data Protection Act, 2018, we only transfer data outside Botswana where the recipient is subject to a comparable level of protection.

Account and access records are retained for as long as your account is active. Password reset tokens expire after one hour and are single-use. If you ask us to delete your account, we will remove your personal data within a reasonable period, except where we are required to retain records (e.g. for fraud prevention or legal obligations).

We use a small number of strictly necessary cookies to keep you signed in securely (HttpOnly, Secure, and scoped with the __Host- prefix). These cookies are essential to the service and cannot be disabled while remaining signed in. We do not use third-party advertising or tracking cookies.

All traffic is encrypted in transit (TLS). Passwords are hashed, never stored in reverse-readable form. Access to administrative functions is role-gated. Our database enforces row-level security on every table. A full technical breakdown is available to signed-in readers as our downloadable Security Report, accessible from the footer of any page once you are logged in.

The Botswana Data Protection Act, 2018 and, where applicable to you, the GDPR, give you the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction (rectification) — ask us to correct inaccurate or incomplete account details.
• Deletion (erasure) — request that your account and associated personal data be removed.
• Portability — request your data in a structured, portable format (GDPR).
• Restriction — ask us to limit how we process your data while a request is resolved (GDPR).
• Objection — object to processing based on legitimate interest.

To exercise any of these rights, contact us at rtrmoga@gmail.com. If you are not satisfied with our response, Botswana-based readers may lodge a complaint with the Information and Data Protection Commission (IDPC) of Botswana, and readers in the EEA may lodge a complaint with their local data protection supervisory authority.

SK Tribute is not directed at children under 13, and we do not knowingly collect data from them.

We may update this policy as the platform evolves. Material changes will be reflected by updating the “Last updated” date at the top of this page.

Questions about this policy or how your data is handled can be sent to rtrmoga@gmail.com.