Privacy Policy
Draft for legal review. This text was prepared for Macver Technology Ltd management and its lawyer. It is not yet in force.
1. Who we are
GistUp is provided by Macver Technology Ltd ([RC number]), [registered office address, Nigeria] ("Macvertech", "we", "us"). We are the data controller for the personal data described here. This policy follows the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC).
Contact our Data Protection Officer at [privacy email].
2. The short version
- Your messages, photos, voice notes and group names are end-to-end encrypted. We cannot read them.
- We keep the least we need to run the service: your phone number, name, username and the technical data needed to deliver messages.
- We do not sell your data, show ads or build advertising profiles.
- You can delete your account at any time in the app.
3. What we collect and why
| Data | Why we need it | Legal basis (NDPA s.25) |
|---|---|---|
| Phone number | To create your account and confirm it is yours by SMS code. It is not shown to other users. | Contract |
| Display name and username | So people can find you and see who they are chatting with. | Contract |
| Confirmation that you are 18 or over, and when you confirmed | GistUp is for adults only. | Legal obligation; legitimate interest |
| Public encryption keys and a device ID | So other phones can encrypt messages for you. Your private keys never leave your phone. | Contract |
| Push notification token | To tell your phone that a new message is waiting. Notifications only say "New message", with no sender or text. | Contract |
| Encrypted messages waiting for delivery | We hold sealed messages until the recipient's phone collects them, then delete them. We cannot open them. | Contract |
| Encrypted photos and voice notes | Stored sealed so the recipient can download them. Deleted automatically after 30 days. | Contract |
| Group membership (who is in which group) | To deliver group messages. Group names are encrypted and not stored by us. | Contract |
| Blocks | So messages from people you blocked are not delivered to you. | Contract; legitimate interest (safety) |
| Reports you send, and any messages you choose to include | So our safety team can review abuse, scams and harmful content. | Legitimate interest (safety); legal obligation |
| Your choice to be found by phone number (off by default) | To let people who know your number find you. | Consent, which you can withdraw in Settings |
| Chat backup (sealed file) and its size and date | If you turn on backup. Sealed on your phone with your 64-digit key, which we never receive. | Consent |
| SMS delivery records | To send sign-in codes and stop abuse of the SMS system. | Contract; legitimate interest |
| Technical delivery measurements (timing, sizes, error codes) | To keep the service reliable. These never include message content. | Legitimate interest |
We do not collect your contacts, location, photos you do not send, or the content of your messages.
4. What stays on your phone
Your message history, downloaded media, private encryption keys and backup key are stored only on your phone, in encrypted storage. Scam warnings are worked out on your phone; the messages are not sent to us for this.
5. Who we share data with
We use these service providers, under contracts that require them to protect the data and use it only for us:
- Supabase: database, sign-in and server functions.
- Cloudflare (R2): storage of sealed photos, voice notes and backups.
- Google Firebase Cloud Messaging: delivery of "New message" notifications.
- SMS provider ([provider name]): sending sign-in codes.
We share data with authorities only when Nigerian law requires it, such as a valid court order, and only the data we hold. We cannot provide message content because we do not have it.
6. Transfers outside Nigeria
Some providers store data outside Nigeria ([regions to confirm]). We transfer data only where the NDPA allows it, including with appropriate safeguards such as contract terms, as set out in sections 41 to 43 of the Act.
7. How long we keep data
- Account data: while your account exists. Deleted when you delete your account.
- Waiting messages: until delivered.
- Photos and voice notes: 30 days after sending.
- Backups: until you turn backup off or delete your account. Each new backup replaces the last.
- Reports: as long as needed to handle them and meet legal duties. A report stays when the reported account is deleted, without that account's details.
8. Your rights
Under the NDPA you can ask to access, correct or delete your personal data, to receive it in a portable form, to object to processing based on legitimate interest, and to withdraw consent at any time. Most of this you can do yourself in the app: change your name, change who can find you, turn backup off, or delete your account. For anything else, email [privacy email]. We reply within 30 days.
You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
9. Security
We use end-to-end encryption (Signal Protocol), encrypted storage on your phone, encrypted connections, and strict access rules on our servers. If a data breach puts you at high risk, we will tell you and the NDPC as the law requires.
10. Age limit
GistUp is only for people aged 18 and over. We do not knowingly allow anyone younger to use it. If you believe a child is using GistUp, report it in the app or email [support email], and we will remove the account.
11. Changes
We will post any change here and tell you in the app before an important change takes effect.