Privacy Policy
Draft for legal review. This text was prepared for Macver Technology Ltd management and its lawyer. It is not yet in force.
1. Who we are
GistUp is provided by Macver Technology Ltd ([RC number]), [registered office address, Nigeria] ("Macvertech", "we", "us"). We are the data controller for the personal data described here. This policy follows the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC).
Contact our Data Protection Officer at [privacy email].
2. The short version
- Your messages, photos, voice notes and group names are end-to-end encrypted. We cannot read them.
- We keep the least we need to run the service: your phone number, name, username and the technical data needed to deliver messages.
- We do not sell your data, show ads or build advertising profiles.
- Some parts are public by design and clearly labelled: Live Rooms, and the communities and groups their admins choose to show in GistUp search.
- You can delete your account at any time in the app.
3. What we collect and why
| Data | Why we need it | Legal basis (NDPA s.25) |
|---|---|---|
| Phone number | To create your account and confirm it is yours by SMS code. It is not shown to other users. | Contract |
| Display name and username | So people can find you and see who they are chatting with. | Contract |
| Confirmation that you are 18 or over, and when you confirmed | GistUp is for adults only. | Legal obligation; legitimate interest |
| Public encryption keys and a device ID | So other phones can encrypt messages for you. Your private keys never leave your phone. | Contract |
| Push notification token | To tell your phone that a new message is waiting. Notifications only say "New message", with no sender or text. | Contract |
| Encrypted messages waiting for delivery | We hold sealed messages until the recipient's phone collects them, then delete them. We cannot open them. | Contract |
| Encrypted photos and voice notes | Stored sealed so the recipient can download them. Deleted automatically after 30 days. | Contract |
| Gists (public posts): text, photos, comments, likes, Regists, quotes, follows, and your public profile (public photo and bio) | Shown to everyone on GistUp, because gists are public. They are not end-to-end encrypted, so our safety team can moderate them. Your public photo is separate from your encrypted chat photo. When you delete a gist it disappears for everyone; if it had been reported, a hidden copy is kept for up to 30 days so the report can still be reviewed. Bookmarks and the people you mute are private. Muted words stay on your phone. | Contract; legitimate interest (safety) |
| Live Room messages, gifts, reactions and pictures (public rooms you choose to join) | Shown to everyone in the room. These are not end-to-end encrypted, so our safety team can moderate them. Gifts are free and have no money value. Pictures are stored sealed, but the key travels with the room message, so everyone in the room and our safety team can open them. Messages are deleted 7 days after they are sent; the sealed picture files after 30 days. Who is in the room right now and who is typing are shown live and never stored. | Contract; legitimate interest (safety) |
| Community and channel names, photo, and who is a member | So invite codes can show what you are joining and channels reach every member. Messages, polls, votes, events and pinned messages in communities and groups stay end-to-end encrypted. | Contract |
| Search listings (only if an admin turns on "Show in GistUp search") | The name, description, category and city the admin types are shown to everyone on GistUp, so people can find the community or group. For a group, this is the only time its name reaches us. Messages stay end-to-end encrypted. | Consent of the admin, which they can withdraw at any time |
| Verified badge (only for accounts and communities GistUp has checked) | Shown to everyone, so people can tell the real business, church or school from someone pretending. We keep a note of how we checked. | Consent; legitimate interest (safety) |
| Scheduled messages, until they are sent | The message is encrypted on your phone before it reaches us, so we cannot read it. We keep only the sealed message, who it is for and when to send it, and delete it once it is delivered or you cancel it. | Contract |
| Requests to join, and people removed or blocked from a community | So admins can approve new members and keep people they removed from coming back. Admins see your name and username, never your phone number. | Contract; legitimate interest (safety) |
| Profile photo (optional), encrypted | Stored sealed so the people you chat with can see it. We cannot open it. Deleted when you remove it or delete your account. | Consent |
| Group membership (who is in which group) | To deliver group messages. Group names are encrypted and not stored by us. | Contract |
| Blocks | So messages from people you blocked are not delivered to you. | Contract; legitimate interest (safety) |
| Reports you send, and any messages you choose to include | So our safety team can review abuse, scams and harmful content. A report about someone in a community is also shown to that community's admins, without your name; reports about an admin go only to us. | Legitimate interest (safety); legal obligation |
| When you were last active, and whether you show it (on by default) | To show "online" or "last seen" in 1:1 chats, only to people you have both messaged, never to strangers, and never if either of you has blocked the other. We also note who has sent whom a 1:1 message (not the content) to check this. You can turn it off in Settings, Who can find me. "typing…" travels live between the two of you and is not stored. | Contract; consent, which you can withdraw in Settings |
| Registration lock PIN (optional) | If you turn it on, so a phone that signs in with your number must enter the PIN before it can use your account. We store only a one-way scrambled form (bcrypt) that we cannot turn back into your PIN, and a count of wrong tries. | Consent |
| Chats you have muted, and until when | So we can skip the "New message" notification for them. Messages are still delivered. | Contract |
| Your choice to be found by phone number (off by default) | To let people who know your number find you. | Consent, which you can withdraw in Settings |
| Chat backup (sealed file) and its size and date | If you turn on backup. Sealed on your phone with your 64-digit key, which we never receive. | Consent |
| Backup email (optional) | If you add one in Settings, so you can sign in again on a new phone with a code sent by email instead of SMS. It is never shown to other users. You can change it at any time; it is deleted with your account. | Consent |
| SMS delivery records | To send sign-in codes and stop abuse of the SMS system. | Contract; legitimate interest |
| Technical delivery measurements (timing, sizes, error codes) | To keep the service reliable. These never include message content. | Legitimate interest |
We do not collect your contacts, location, photos you do not send, or the content of your messages. The camera is used only while you scan a GistUp code, and nothing it sees is recorded or sent. Your fingerprint or face is checked by your phone; GistUp never receives it. When Android offers to fill in the sign-in code, GistUp reads only that one SMS, and only if you tap Allow.
4. What stays on your phone
Your message history, downloaded media, private encryption keys and backup key are stored only on your phone, in encrypted storage. Scam warnings are worked out on your phone; the messages are not sent to us for this. Poll votes and event answers are counted on each member's phone, and event reminders are set on your own phone, so we never see them.
5. Who we share data with
We use these service providers, under contracts that require them to protect the data and use it only for us:
- Supabase: database, sign-in and server functions.
- Cloudflare (R2): storage of sealed photos, voice notes and backups.
- Google Firebase Cloud Messaging: delivery of notifications. Chat notifications only say "New message". Gist notifications (which you can turn off in Settings, Notifications) say who liked, commented on, registed or quoted your gist, or followed you, because gists are public.
- SMS provider ([provider name]): sending sign-in codes.
- Email provider ([provider name]): sending sign-in codes to a backup email, if you add one.
We share data with authorities only when Nigerian law requires it, such as a valid court order, and only the data we hold. We cannot provide message content because we do not have it.
6. Transfers outside Nigeria
Some providers store data outside Nigeria ([regions to confirm]). We transfer data only where the NDPA allows it, including with appropriate safeguards such as contract terms, as set out in sections 41 to 43 of the Act.
7. How long we keep data
- Account data: while your account exists. Deleted when you delete your account.
- Waiting messages: until delivered.
- Photos and voice notes: 30 days after sending.
- Backups: until you turn backup off or delete your account. Each new backup replaces the last.
- Live Room messages: 7 days after sending. Pictures shared in Live Rooms: 30 days.
- Search listings: until an admin turns them off, or the community or group is deleted.
- Requests to join: until an admin answers or you cancel. Blocks from a community: until an admin removes them.
- Reports: as long as needed to handle them and meet legal duties. A report stays when the reported account is deleted, without that account's details.
- Records of what our safety staff did (for example, hiding a listing): as long as needed to check that staff acted correctly.
8. Your rights
Under the NDPA you can ask to access, correct or delete your personal data, to receive it in a portable form, to object to processing based on legitimate interest, and to withdraw consent at any time. Most of this you can do yourself in the app: change your name, change who can find you, turn backup off, or delete your account. For anything else, email [privacy email]. We reply within 30 days.
You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
9. Security
We use end-to-end encryption (Signal Protocol), encrypted storage on your phone, encrypted connections, and strict access rules on our servers. Only named Macvertech safety staff can use our moderation tools, and every action they take is recorded. If a data breach puts you at high risk, we will tell you and the NDPC as the law requires.
10. Age limit
GistUp is only for people aged 18 and over. We do not knowingly allow anyone younger to use it. If you believe a child is using GistUp, report it in the app or email [support email], and we will remove the account.
11. Changes
We will post any change here and tell you in the app before an important change takes effect.