RafikiHPress Privacy Policy

This policy explains how RafikiHPress (“the app”), published by HostRafiki (“we”, “us”), handles your information. RafikiHPress is a mobile app for writing and publishing to your WordPress sites. It works with a free HostRafiki account.

This policy is about the app and the HostRafiki account you use with it. HostRafiki’s general privacy policy, for our website and hosting services, is a separate document at hostrafiki.com/privacy-policy. Last updated: September 2026.

One free HostRafiki account works across our apps and on the web at account.hostrafiki.com. For the account itself we store:

• Your name and email address, and whether you have confirmed the address
• A password, stored only as a salted hash (we never store it in readable form)
• Your plan (new accounts start on the Free plan, which does not expire)
• A sign-in session for each device you are signed in on. Sessions expire after 90 days, and you can sign any of them out from the Security page of your account
• When you last used an app, and which device platform (Android or iOS) and app version it was

On the web you can see and change these details, download everything we hold about you, and delete your account.

What we store about a connected site:

• Its web address, its name and icon, the WordPress version, and the kind of sign-in you used (an application password, or WordPress.com)
• When you connected it and when it was last used, so we can apply your plan's limit on connected sites

What we never receive or store:

• Your WordPress username, password or application password. They stay in your phone's secure storage and are sent only to your own WordPress site
• If you connect through WordPress.com, you sign in on WordPress.com's own page: we never see your WordPress.com password, and the access token it issues stays on your phone
• The content of your posts, pages or media, their titles, or their addresses

We record simple, anonymous-style counts so we can tell whether the app works and how it is used:

• That you created, scheduled or published a post, or that connecting a site failed (and a short reason such as a wrong password or no network). Never the title, the text, or the address of a post
• The days you used the app, your device platform (Android or iOS) and the app version

This information is linked to your account while it exists, and is kept only as anonymous counts after you delete it.

• Camera and photo library: only when you choose to add an image to a post. The image goes to your own WordPress site. We do not receive it
• Notifications: reminders and comment alerts are created on your phone. We do not send push notifications from our servers
• Internet: to reach your WordPress site and the HostRafiki service
• An optional PIN lock, if you turn it on, is stored only on your phone

• To create and secure your account, sign you in, and email you when you ask us to (confirming your email address, resetting a password, confirming an account deletion, a notice when your password changes)
• To apply your plan's limits, and to keep the service secure and prevent abuse
• To understand, in aggregate, how the app is used and to fix problems

We do not sell your personal information, and we do not use it for advertising.

We share information only with providers that help us run the service, and only what they need:

• Our hosting provider, which stores the account database and runs the service
• Our email delivery service, which sends the emails described above
• A crash-reporting service (Sentry), only if it is switched on in a release of the app. Reports contain technical details such as device model, operating system version and the error, not your content
• Authorities, when the law requires it

• All traffic between the app and our service uses HTTPS
• Passwords are stored only as salted hashes, and sign-in tokens can be revoked at any time
• Your WordPress credentials are kept in your phone's secure storage

No method of storage or transmission is completely secure, but we work to protect your information.

• Account and connected-site records: while your account exists. They are removed when you delete it
• Sign-in sessions: until they expire (90 days) or you sign them out
• Server logs, which can include an IP address when a sign-in fails: about 14 days
• Anonymous usage counts: kept without any link to you, also after you delete your account

You can delete your HostRafiki account at any time, in any of these ways:

• In the app: Profile → Delete Account
• On the web, without the app: request a confirmation link on the RafikiHPress account-deletion page, open the link we email you, and confirm
• In your account at account.hostrafiki.com: Account → Delete account
• By email to officialhostrafiki@gmail.com, if you can no longer use the email address of the account (we reply within 7 days)

Deleting your account permanently removes your account, your connected-site records, and your sign-in sessions on every device. Anonymous usage counts are kept without any link back to you. Deleting your account does not change anything on your WordPress sites. Go to the RafikiHPress account-deletion page.

Depending on where you live, you can ask to access, correct, download or delete your information, or object to how we use it. You can do most of this yourself:

• Download everything we hold about you, change your name and password, and see where you are signed in: at account.hostrafiki.com
• Delete your account: see “Deleting Your Account” above
• Anything else: email officialhostrafiki@gmail.com

RafikiHPress is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

We may update this policy. The date at the top shows when it last changed, and for significant changes we will tell you in the app or by email.

• HostRafiki, HostRafiki HQ, Kampala, Uganda
• Email: officialhostrafiki@gmail.com