Privacy policy

Last updated 18 August 2026

GIST (Government Instruments & Statutes Tracker) summarises Zimbabwean Statutory Instruments, Acts, and Bills and delivers alerts about them. This policy explains what we collect, why, who it's shared with, and how to get it changed or deleted. The short version: we collect the minimum needed to deliver alerts, we never sell it, and reading GIST needs no account at all.

What we collect

Reading GIST requires no account and no personal information. Summaries, the archive, search, and the RSS feed are open.

If you create an account, we store your email address, your name if you give one, and — when you sign in with Google or Apple — the basic profile (name, email) that provider shares. Sign-in uses one-time email codes or those providers; we never store a password.

If you set up alerts, we store your watchlists (the categories, keywords, and document types you follow), your chosen delivery channels and quiet hours, your timezone and country, and — only if you enable SMS — your phone number, which we verify before sending anything to it.

If you subscribe to a paid plan, payment is handled entirely by Stripe. Card details go to Stripe directly and never touch our servers; we store only your subscription status and plan so we know which channels to deliver on.

Operationally, we keep a record of the alerts we've sent you (channel, time, and status) so we can show your alert history, honour SMS quotas, and debug delivery problems.

What we don't do

• We don't sell or rent your data to anyone, ever.
• We don't run third-party advertising or ad trackers.
• We don't read more from Google or Apple than the name and email needed to create your account.
• We don't message you beyond what you asked for: your alerts, the weekly digest if you opted in, and essential account or billing notices.

Cookies

We use a single first-party session cookie to keep you signed in. There are no advertising or cross-site tracking cookies. Signed-out reading sets no cookies at all.

Who we share data with

Delivery requires a few processors, each receiving only what its job needs: Stripe for payments; our email provider to send sign-in codes, alerts, and the digest; our SMS provider to deliver text alerts to the number you verified; and Google or Apple only if you choose to sign in with them. We'll disclose data if the law compels us to, and we'll tell you when we're allowed to.

Retention

Your account data is kept while the account exists. Cancelling a paid plan keeps your watchlists — they're switched back on if you resubscribe — but you can delete any watchlist, your phone number, or the whole account at any time. Deleting the account removes your profile, watchlists, and alert history from our systems; Stripe retains billing records as financial regulations require it to.

Your rights

You can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Unsubscribe links are in every digest email, alert channels can be switched off per watchlist from your dashboard, and replying STOP to any SMS stops SMS. For anything else, email privacy@gist.co.zw and we'll respond within 14 days.

Changes

If this policy changes materially, we'll note it here with a new date and tell account holders by email before it takes effect. Questions about the service itself are answered in the terms of service.