Privacy notice

Version 1.0, effective August 10, 2026 August 10, 2026

The short version. We collect the minimum an account needs (an email address and a password), we never show your real identity in public, you control whether your exact locations are public, and you can see and correct your data, and erase it by closing your account — though the public record of the government's response to a Case stays on, no longer linked to you. We handle your data under the Nigeria Data Protection Act 2023 and the NDPR, and if you think we have got it wrong you can complain to the Nigeria Data Protection Commission (NDPC).

What we collect, and why

• An email address and a password — to create and secure your account and to send you the messages the service needs (confirming your address, resetting your password, telling you when a Case you filed or follow changes status). The password is stored only as a modern one-way hash, never readable.
• Your Alias — the public name on your Cases and Endorsements. It is chosen by you and is the only identity other people see.
• The reports you make — the Case text, category, photos, and location you provide.
• Technical records — the cookies that keep you signed in and keep the service secure (never advertising or tracking cookies), sessions you can see and revoke yourself, and security logs (such as sign-in attempts and the IP address they came from) kept for a limited time to protect accounts.

Why we're allowed to hold it

Nigerian data-protection law lets us keep personal data only for a reason the law recognises. Ours are three. A contract with you — we need your email and password to give you the account and the service you signed up for, including the messages the service sends. Your consent — you decide whether to publish a report at all, and whether the public sees its exact spot; you can change or withdraw that choice. Our legitimate interest — keeping security logs to protect accounts, and keeping the de-identified public record of government responses accurate after an account is closed. We rely on the Nigeria Data Protection Act 2023 and the NDPR.

What we deliberately do not do

• We never publish your name or email. Public pages, feeds, and the API's public responses are tested — automatically, on every change — to contain no real name, no email address, and no account identifier.
• We strip photo metadata. Photos you upload have their embedded location and device data (EXIF) removed before anything is stored or shown.
• We do not sell or share your data for advertising. There is no advertising, no tracking pixels, and no analytics that identify you.
• Your reading habits are not a record. Who viewed a Case is not stored against your identity; view counts are public, coarse buckets.

Who can see what

• The public sees your Alias, your Cases as you chose to publish them, and — where you chose to hide the spot — only the approximate area. Your profile is visible to signed-in users only, unless you open it up; your Case history on that profile is off unless you turn it on.
• The responding department sees the Case and its exact location. They do not see your email or your name — officials see the Alias like everyone else, and the product is tested to keep it that way.
• Platform administrators can access identifying data only where the law or the service requires it, and every such access is recorded in an audit log with who, what, and when.

Others who handle data for us

To run the service we rely on a few outside providers, each bound to handle data only on our instructions: a transactional email provider that sends your account and Case messages; a map-tile provider (OpenStreetMap) whose map tiles your browser loads directly — which means it receives your device's IP address and the area of the map you are looking at; cloud hosting, file storage, and a content-delivery network that run the service and hold evidence photos; and an error-monitoring provider that helps us find faults, set up to strip out identifying details. Before the pilot opens we publish the full list, the country each provider works in, and the safeguard that covers it.

Where your data lives

The pilot's data is hosted on infrastructure chosen for the pilot; when the hosting location is fixed at deployment, this notice names the country and the safeguards before the pilot opens.

Your rights under Nigerian data-protection law

You can see the data we hold about you (your own record is on your profile), correct it, and erase it. Erasing your account deletes the data that identifies you — your email, your password, your Alias, and the link between you and anything you posted. What stays is the public record of what the government did about the problems you raised: the Case text you wrote, its photos with their location already stripped, and the officials' responses. We keep that record because an accurate, unbroken account of how public bodies respond is in the public interest — and once your account is gone, nothing left in it can be traced back to you, so it is no longer personal data about you. Your Alias is retired and never given to anyone else.

You can also object to any processing we base on our legitimate interest, ask us to restrict what we do with your data while a question is being sorted out, and ask for a portable copy of the data you gave us, in a common machine-readable format. And you can complain to the Nigeria Data Protection Commission (NDPC) at any time — you do not have to raise it with us first.

If your data is ever breached, we investigate straight away, and where the law requires it we tell the Nigeria Data Protection Commission within 72 hours and tell you directly if you are likely to be seriously affected.

To exercise any of these rights beyond the self-service controls, contact us at the address below.

How long we keep things

Your account exists until you delete it. Evidence photos and Case records are kept while the Case is a public record. Security logs are kept only as long as protecting accounts requires.

Contact