Privacy Policy

MBBS Digital Limited, a company incorporated in Nigeria ("MBBS," "we," "us," "our"), operates an interactive fiction reading app and website (the "Service"). This policy explains what information we collect, why, and what rights you have over it.

Data controller: MBBS Digital Limited.
Contact: hello@readmbbs.com (general) / support@readmbbs.com (account or data requests)

This policy applies to the MBBS website and mobile app, wherever you access them from.

Guest reading(a season's free first chapter, no account) is for readers who are at least 13 years old. Before your first chapter we ask you to confirm this with a one-time prompt, stored locally on your device so you're not asked again.

Creating an account or buying a season is for readers who are at least 18 years old. You confirm this when you sign up.

Both confirmations are self-attested, not independently verified. We don't ask guests for personal information. We do not knowingly collect personal data from anyone under 18 through an account, and if we learn we have, we will delete that account and its data.

Account information

When you sign up, we collect an email address and generate a username (editable later in account settings). You can sign up with an email and password, or with Google; if you use Google, we receive the email address on your Google account. We never see or store your raw password. Authentication is handled by our secure authentication provider.

Guest reading

You can read a season's first chapter without an account. Your position is stored locally on your device/session until you either continue as a guest for that session or create an account. If you sign up, that locally-held progress is carried into your new account once, at signup. It isn't retained by us before that point.

Reading progress and choices

Once you have an account, we store where you are in each story and the choices you've made along the way. This is what lets the story respond to your decisions and lets you pick up exactly where you left off, on any device. This information is private to your account. It's never shown to other readers and is only used to determine what content is shown to you as you read.

Following

If you follow a story, or buy a season (which follows that story automatically), we record that against your account so we can tell you about new chapters and show them in your feed. You can unfollow at any time. This is private to your account.

Purchases

When you buy a season, we store a purchase record: which season, the amount, currency, which payment method was used, and a transaction reference. We don't keep your card or payment details, only the record that the purchase happened.

Season Reactions

If you've purchased a Season, you can pick from a small, fixed set of reactions to express how it landed for you (e.g. "loved it," "wrecked me"). There's no free text, so there's nothing you write that we'd need to store or moderate. We record which reactions you've picked, tied to your account, so you can see and change your own picks later. What's shown to other readers is an anonymous total only (e.g. "94 readers picked this"), never your identity, never which reactions you personally chose. Aggregate totals are visible even to people who haven't purchased the season yet, since a count reveals nothing personal; only purchasers can add or change a reaction.

Referrals

If you refer another reader, we track whether that referral qualifies, in order to award referral points.

Notifications

If you enable notifications, we store your preferences per notification type (chapter releases, referral points) and per channel (push, email, in-app). We never send re-engagement or "come back" style prompts, only notifications tied to something that actually happened.

Messages and feedback

If you send feedback through our Contact page, or email us, we receive your message and, so we can reply, your email address. If you're signed in we already have it; guests can leave it blank.

Usage analytics

We log basic usage activity on our own systems (e.g. a chapter was started or completed, a purchase completed, a signup completed) to understand pacing, drop-off, and conversion. We do not use any third-party analytics or advertising tracking tools, and this information is never sold or shared with advertisers.

Location signal

At signup, we ask for your country, which determines regional pricing. To pre-fill that field, your browser sends a request to a third-party IP-location service, which receives your IP address (as it would for any web request) and returns a country guess. We use that only as a suggestion that you confirm or change, and we don't save it to your account unless you confirm that country yourself. We never use it to silently reprice your account later or to track your movements. Once set, your pricing country is sticky and only changes if you update it yourself.

We use the information above to:

• Operate your account and keep your reading progress in sync across devices.
• Process and verify purchases, and give you access to what you've bought.
• Determine appropriate regional pricing.
• Show anonymous, aggregated reaction totals, and let you see and change your own reaction picks.
• Send you the notifications you've opted into.
• Respond to your messages and feedback.
• Understand how the product is used, in aggregate, so we can improve pacing, content, and the reading experience.
• Detect and prevent abuse (e.g. spam or fraudulent activity).
• Meet legal obligations (e.g. records needed for tax or dispute-resolution purposes).

We do not sell your personal data, and we do not use it for third-party advertising.

We share data only with the service providers needed to operate MBBS, each acting on our instructions and only for the specific purpose listed:

When you pay on the web, Flutterwave's checkout loads on the page and handles your payment details under its own privacy policy.

We do not share your reading progress or in-story choices with anyone beyond what's needed for these providers to perform their specific function.

We may disclose information if required by law, or to protect the rights, safety, or property of MBBS, our readers, or the public.

Our providers may store or process data outside your home country, including outside Nigeria and the EU/EEA. We choose providers that offer standard contractual protections for these transfers, and we rely on those protections where the law restricts moving personal data across borders.

• Account data and reading progress: kept for as long as your account is active, so your progress stays available across devices and sessions.
• Purchase records: retained for as long as the law requires for tax, accounting, and dispute-resolution purposes, even after account deletion.
• Usage/analytics data: retained in aggregate/operational form; we periodically review whether older, granular data is still needed.
• Messages and feedback: kept for as long as needed to follow up and improve the product.
• Reactions: retained for as long as your account is active. On account deletion, your reactions stay as part of the anonymous total (they carry no personal content beyond your account link, which is itself anonymized on deletion, see Section 9) rather than being removed, since removing them would just make the totals less accurate for no privacy benefit.

Depending on where you live, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate data (most account info is also self-editable in-app).
• Delete your account and associated personal data ("right to erasure").
• Receive a copy of your data ("data portability"). We don't have a self-serve export yet; email us and we'll provide a copy of your data manually.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent (e.g. optional notifications).

EU/EEA readers (GDPR): the legal bases we rely on are performance of a contract (running your account, delivering purchases), legitimate interest (product analytics, abuse prevention), and consent (optional notifications). You also have the right to lodge a complaint with your local data protection authority.

Nigerian readers (NDPA): under the Nigeria Data Protection Act 2023 you have rights over your personal data, including to access it, have it corrected or deleted, and object to its processing. You can send requests to the contact below, and you may also complain to the Nigeria Data Protection Commission.

To exercise any of these rights, email support@readmbbs.com. We'll respond within the timeframe required by applicable law (typically 30 days).

You can request deletion of your account and associated personal data at any time via account settings or by emailing support@readmbbs.com. When you delete your account:

• You'll have a 14-day grace period before deletion actually happens. Your account stays fully usable during this time (reading, purchasing, everything works normally), and you can cancel the deletion request at any point before the window closes.
• Once the window closes, your personal reading data (reading progress, choices, notification settings) is deleted, and your email/username are replaced with anonymized values.
• Your reactions and our usage records stay, disconnected from your identity, as part of anonymous totals and aggregate analytics (see Section 7).
• Purchase records are retained only to the extent required by law (see Section 7), disconnected from your identity.

MBBS uses local device storage (not third-party ad-tracking cookies) to:

• Hold guest reading progress before you have an account.
• Remember that you've confirmed the minimum age for guest reading (Section 2), so it doesn't re-prompt every visit.
• Keep you signed in once you have an account.
• Briefly hold sign-up details (your chosen country, any referral code, and your acceptance of these terms) while your sign-up completes.
• Remember small interface choices, such as whether you've already seen a prompt.
• Store device-only reader settings (e.g. text size), which are not synced to our servers.

We do not use third-party advertising cookies or cross-site tracking.

We use industry-standard security practices, including HTTPS everywhere and secure authentication, and no payment instrument data touches our own systems. That's handled entirely by our payment processors. Internal access to reader data is restricted to authorized personnel only. No system is perfectly secure, and we can't guarantee absolute security, but we follow standard access-control practices throughout.

We'll update this policy as the product changes and post the revised version with a new "Last updated" date. Material changes will be flagged more prominently (e.g. in-app notice or email) where appropriate.

Questions or requests about this policy or your data: support@readmbbs.com. See also our Terms of Service and Contact page.