Privacy notice

Who we are

Wahala Republic is run by [Company name]. We decide how your personal data is used, so under Nigeria's Data Protection Act 2023 we are the data controller. Write to [email protected] with any question about your data.

What we collect

• Your email address and password. The email is encrypted and never shown to other players. The password is stored only as a one-way hash, so nobody, our staff included, can read it.
• Your birth year and when you confirmed you are 18 or older. We check your full date of birth at sign-up but we don't keep it.
• Your name on the street, your state, your job, your look, and what you do in the game: shifts, money, votes, items, evidence, messages and reports.
• A device ID: a random code we save in a cookie, local storage and IndexedDB on your browser, plus a scrambled fingerprint of a few browser details (browser type, language, screen size, processor count, time zone). We keep the scrambled version only, never the details themselves.
• A scrambled version of your internet (IP) address, used as a weak signal to spot the same device.
• If you turn on notifications: the push address your browser gives us and your quiet hours.
• A session cookie that keeps you signed in, and short records of errors when something breaks.

Why we use it, and on what legal basis

The Data Protection Act asks us to say why we use your data and what lawful basis allows it.

• To run your account and the game you signed up for. Basis: our contract with you.
• To keep the game fair: one ballot per device per election, at most 3 accounts per device each season, and catching cheats, bots and linked accounts. Basis: our legitimate interest in a fair game.
• To keep players safe: chat filters, reports, sanctions and the 18+ rule. Basis: our legitimate interest in a safe game, and our legal duties.
• To email you when you ask for a password reset. We send no marketing email. Basis: our contract with you.
• To send push notifications, only if you say yes. You can turn them off at any time. Basis: your consent.
• To protect our systems and fix what breaks. Basis: our legitimate interest in a working, secure service.

We don't sell your data. Sponsored billboards in the game are counted per slot per day only: no third-party trackers, no profile of you and no targeting by your data.

How we measure play

We count what happens in the game so we can fix it and balance it: shifts, choices, money in and out, purchases, trips, seat races, sign-up steps, how long a session lasts, how fast the game loads and how smoothly it runs. Each record carries a pseudonymous code, not your name or account ID. The code is a keyed scramble of your player ID; only we hold the key. Basis: our legitimate interest in running and improving the game.

These records never hold your email, your internet (IP) address, your chat messages or any device fingerprint, and they never show who you voted for, only that a vote was cast. They are stored in our own Cloudflare R2 storage bucket, not sent to an analytics company, and deleted after 24 months.

You can switch this off: in the game, open Phone, then Settings, and turn off Share play statistics. We also respect your browser's Do Not Track and Global Privacy Control settings.

What other players see

Your name on the street, job, rank, state and what you show off (home, car, outfit, Clout) appear in the game, on your public profile and on the flex board. Share cards show what you choose to share. Your email never appears anywhere.

Who else handles it

A few companies run parts of the service for us and may only use your data to do that work:

• Render: our servers. Neon: our database. Resend: sending email.
• Cloudflare: delivering the website, blocking attacks, the bot check at sign-up, and storing backups and analytics records.
• Sentry: error reports when something breaks.

Some of these services store data outside Nigeria. When they do, we use the safeguards the Data Protection Act requires for transfers abroad. We share data with the police or a court only when the law requires it.

How long we keep it

• Your account: while it is open. When you delete it, your email and personal data go. In-game money records stay with the account made anonymous, so the game's books still balance.
• Chat messages: 30 days. Messages captured in a report are kept with that report.
• Inbox items: 30 days. Sessions: up to 30 days. Password reset links: 30 minutes, and each works once.
• Device records, reports, sanctions and appeals: as long as they are needed to apply the device rules and handle appeals, then deleted or made anonymous.

Your rights

Under the Data Protection Act you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong;
• delete your account and personal data;
• stop or limit a use you object to, or send your data to you in a format you can take elsewhere;
• stop push notifications, by withdrawing your consent.

Email [email protected] from the address on your account and we will answer within 30 days. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission.

How we protect it

Connections are encrypted, emails are encrypted at rest, passwords are hashed, databases sit on private networks, and staff sign in with two-factor and leave an audit trail. If a breach puts your data at risk, we tell the Nigeria Data Protection Commission within 72 hours and tell you without delay.

Players under 18

Wahala Republic is for people aged 18 and over. We don't knowingly collect data from anyone younger. If we learn a player is under 18, we suspend the account at once and remove it. Use Report in the game if you think a player is under 18.

Cookies and browser storage

• A session cookie keeps you signed in.
• The device ID sits in a cookie, local storage and IndexedDB, for the fair-play rules above.
• Your sign-up progress is kept in the browser tab until you finish.
• Cloudflare's bot check at sign-up may set its own cookie. We use no advertising or tracking cookies.

Changes to this notice

If we change this notice we update the date at the top. If a change matters for you, we tell you in the game before it applies.

Contact

[Company name], the team behind Wahala Republic. Email: [email protected].