Privacy Policy

1. Who we are

Heurekka is a community app for people who build in tech. It's run by Deebug [Confirm: full legal entity name, RC number and registered address], which is the data controller for your information. Questions about privacy go to privacy@heurekka.org.

We follow the Nigeria Data Protection Act 2023 (NDPA). [Confirm: the Data Protection Officer's name or role, and NDPC registration if required]

2. What we collect

• Your account: name, email, a hashed password (we never see the password itself), or the ID Google or Apple give us if you sign in with them.
• Your profile: handle, photo, bio, headline, interests, the Spaces and Labs you join, and badges you earn.
• What you post and send: threads, replies, images, short video clips, voice notes and direct messages. Buzz sessions (live audio and video) are not recorded.
• How you use Heurekka: cheers, follows, friends, the days you were active, and which devices you're signed in on (a short label such as “Pixel 8, Android 16”) and their push notification tokens.
• Sparks: every movement of your Sparks (earned, bought, bonus, tips, purchases, Quest rewards, cash-outs).
• Payments: when you buy Sparks on our website, Paystack processes your card, bank transfer or USSD payment. We keep the reference, the amount and how it was paid (for example the card's last 4 digits and bank); we never see or store full card numbers. In the apps, Apple or Google takes the payment; we receive the purchase's ID, the pack and the price, never your payment details.
• Cash-out checks: to cash out, you give your legal name, date of birth, an optional TIN, a photo of an ID document and a selfie. A person on our finance team checks them; the photos are deleted as soon as they decide. We keep the name, date of birth and the result.
• Payout account: the bank or wallet name, the last 4 digits and the account name. Paystack holds the full account number.
• Certificates: if you add a Deebug Institute certificate, we look it up in the Institute's public registry. We compare the email on it with yours but don't store that email.
• Quests: which Quests you start and finish, and any proof you send (a short answer or screenshot).
• Safety records: reports you make or that are made about your content, and any action our team takes, with the reason.
• Business accounts: for advertisers, the business name, website, CAC number, the team's work emails, and invoices.

We don't use advertising trackers or sell your information. We don't use third-party analytics in the app.

3. Why we use it, and our legal basis

• To run Heurekka for you (our contract with you): your account, posts, messages, notifications, Sparks, the Shop, Quests and cash-outs.
• To keep people safe (legitimate interests): moderation, stopping spam and fraud, rate limits, and checking that cash-outs and certificates are genuine.
• Because the law requires it (legal obligation): keeping payment and payout records, and answering valid court orders.
• With your permission (consent): push notifications and the weekly email. You can turn these off in Settings at any time.

4. Who sees what

Other members see your profile, your posts in the Spaces you join, and what you show them in messages. Advertisers never see who you are: Quest proofs reach them without your name, handle or email, and results are totals.

We use these companies to run Heurekka. Each only gets what it needs for its job:

• Render: hosts our servers and database in Frankfurt, Germany.
• Cloudinary: stores images, videos, voice notes and (privately, until checked) ID photos.
• Paystack: processes payments on the website and sends cash-outs.
• Apple and Google: process purchases made in the apps.
• LiveKit: carries live Buzz audio and video (not recorded).
• OneSignal: delivers push notifications.
• Our email provider [Confirm: name, e.g. Google Workspace]: sends sign-in codes, receipts and notices.
• Google and Apple: only if you choose to sign in with them.
• Deebug Institute: only the credential ID of a certificate you add, to check it.

Some of these are outside Nigeria (in the EU and the US). We only use providers that protect personal data to a standard the NDPA accepts. [Confirm: the transfer safeguard relied on, e.g. standard contractual clauses]

Police, courts and regulators: we only share information when given a valid court order, and we log every request.

5. How long we keep it

• Your account and content: until you delete your account.
• When you delete your account: it's signed out everywhere and hidden at once, and after 30 days your account, posts, messages, images and voice notes are removed for good. Logging in during those 30 days cancels the deletion.
• Payment and cash-out records: kept after deletion, without your name attached to the account, for as long as tax and payments law requires [Confirm: the period, e.g. 6 years].
• ID photos for cash-out: deleted as soon as they're checked.
• Server logs: [Confirm: the period Render keeps logs for]. We don't log passwords, tokens or payment details.

6. Your rights

• Get a copy: Settings → Privacy & safety → Download your data gives you everything we hold about your account, at once.
• Correct it: edit your profile, name and email in Settings.
• Delete it: Settings → Delete account.
• Object or withdraw consent: turn off push notifications and the weekly email in Settings, or write to us.
• Complain: to us first at privacy@heurekka.org, and to the Nigeria Data Protection Commission (NDPC) if you're not happy with our answer.

We answer requests within 30 days.

7. Age

You need to be at least 18 to use Heurekka [Confirm: the minimum age. The NDPA treats under-18s as children whose data needs a parent's consent]. Cash-outs always need you to be 18 or older.

8. Security

Passwords are hashed, connections are encrypted, staff sign in with two-factor codes and can only see what their role needs, and every staff action is logged. No system is perfectly secure; if something goes wrong that affects you, we'll tell you and the NDPC as the law requires.

9. Changes

If we change this policy in a way that matters, we'll tell you in the app before it applies. The date at the top shows the latest version. See also our Terms.