On this page
Who we are
The Gistmo app, gistmo.app and Gistmo Cash are run by [TO BE FILLED BY THE OWNER: legal entity name, RC number and registered address] (“Gistmo”, “we”, “us”). We are the data controller for the personal data described here.
Data Protection Officer: [TO BE FILLED BY THE OWNER: DPO name and email]. Until a DPO is named, write to privacy@gistmo.app about anything in this policy.
Registration with the Nigeria Data Protection Commission: [TO BE FILLED BY THE OWNER: NDPC registration number, or remove this line if not required].
What we collect, why, and on what basis
The lawful bases are those of the Nigeria Data Protection Act 2023 (NDPA), section 25: contract (we need it to give you the service you signed up for), legal obligation, legitimate interest (balanced against your rights) and consent (which you can withdraw at any time, in the app’s settings or your phone’s). [NEEDS LEGAL REVIEW: confirm each basis below]
| Data | Why | Basis |
|---|---|---|
| Account: your email address and, if you add one, your phone number; if you use Google sign-in, the name and email Google shares with us. | To create your account, sign you in and send sign-in codes and a welcome email. | Contract |
| Profile: display name, @username, photo, cover, bio, area, colour and initials. | So people can recognise and find you. Your email and phone number are shown only to you. | Contract |
| Messages and what you share in them: text, voice notes, photos, videos, files, stickers, GIFs, polls, events, link previews, contact cards and locations you choose to send; reactions, read receipts, stars, pins and reports. | To deliver your conversations. Files are kept in private storage that only members of the conversation can open. | Contract |
| Status, Snaps and stories: what you post, who you chose to show it to, and who viewed or liked it. | To show your posts to the people you picked. | Contract |
| Friends and blocks: friend requests, friendships and the people you block. | To decide who can message you and see your profile and posts. | Contract |
| Calls: who called whom, when, for how long, and call quality figures (not the call’s sound or picture, which we do not record). | To connect calls, show your calls list and fix call quality. | Contract; legitimate interest (quality) |
| Location (only if you allow it): your most recent position, and when you were last online, if you choose to show it. | To show friends nearby on the map. Others see only an approximate area and distance, never your exact position. Ghost mode turns this off. | Consent |
| Gistmo AI: what you write, say (in AI voice calls) or send (photos, documents) to Gistmo AI, and in games the questions you ask the talking computer. | To answer you. Web searches Gistmo AI makes for you send the search words, not your identity. | Contract |
| Games: moves in games you play, and your best scores. | To referee games fairly and show scores to you and your friends. | Contract |
| Gistmo Cash (only if you use it; it is not open to the public yet): your wallet and account number, balance, payments, money requests, payout bank accounts (bank, last four digits, account name); for identity checks your BVN or NIN, date of birth, address, phone number and, for higher tiers, an ID document and selfie. | To run your wallet and payments and to meet know-your-customer and anti-money-laundering law. BVN, NIN and document numbers are sent to Anchor for checking; we keep only the last four digits and an encrypted copy where required. | Contract; legal obligation |
| Transaction PIN and Face ID / fingerprint: a salted one-way hash of your PIN, and a hash of a key held by your phone. Your face or fingerprint never leaves your phone. | To approve payments and account deletion, and lock them after repeated wrong guesses. | Contract |
| Devices and sessions: sign-in sessions with the app or browser identifier and IP address; push notification tokens and your notification settings. | To keep you signed in, let you sign out other devices, and send notifications. | Contract |
| Error reports: what went wrong in the app, the screen, the app version and phone model, and your account id. | To find and fix crashes. | Legitimate interest |
| Website visits: the page, the kind of device, and the rough place the visit came from (city level, about 10 km). No IP address is stored and a visit is not tied to an account. | To understand how many people visit and from where. | Legitimate interest |
| Safety reports: what you report and, with it, the reported messages. | To deal with abuse and keep people safe. | Legitimate interest; legal obligation |
We do not read your address book. When you share a contact, only the contact you pick is sent, into the chat you choose. We do not sell personal data, share it with advertisers or use it for ads.
Who processes it for us
These companies process personal data on our behalf, under contract, only to provide the parts of Gistmo listed. [NEEDS LEGAL REVIEW: confirm a data processing agreement is in place with each]
| Processor | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions: almost all the data above. | London, United Kingdom (AWS eu-west-2) |
| Fly.io | The game server that relays live game moves and in-game voice set-up. | Johannesburg, South Africa |
| Hetzner | Servers that carry voice and video calls (LiveKit). Call sound and picture pass through and are not recorded. | Nuremberg, Germany |
| Vercel | Hosts the website and the web app, and sees the requests made to them. | Global edge network; [NEEDS LEGAL REVIEW: confirm region] |
| Expo (650 Industries) | Sends push notifications to phones and delivers app updates. | United States |
| Google (Firebase Cloud Messaging) and Apple (Push Notification service) | Deliver notifications to Android phones and iPhones. A notification may carry the sender’s name and, if you allow previews, the start of the message. | United States and elsewhere |
| “Continue with Google”, only if you choose it, to confirm who you are. | United States and elsewhere | |
| OpenAI | The AI model behind Gistmo AI, AI voice calls and the talking computer in games: it receives what you send to Gistmo AI. [NEEDS LEGAL REVIEW: confirm OpenAI’s API data-use and retention terms (API data is not used for training by default) and record them here] | United States |
| Resend | Sends our emails, such as the welcome email. | [NEEDS LEGAL REVIEW: confirm region] |
| Anchor (Anchor Technologies) | Gistmo Cash bank accounts, payments and identity checks (BVN, NIN, documents). Only for people who use Gistmo Cash; while Cash is in testing, only for invited testers. | Nigeria |
Some features also contact other services directly from your phone or our servers, which then see your phone’s or our server’s IP address and what was asked: map tiles from OpenFreeMap; GIF search and GIF images from GIPHY; link previews, where our server fetches the page you are linking to (and TikTok or YouTube for their videos) and may look the site’s name up through Cloudflare DNS; and Wikipedia for some Gistmo AI answers. We send them no account details.
We disclose personal data to authorities only when the law requires it.
Sending data outside Nigeria
Most of our processors store or process data outside Nigeria (see the table above). Under NDPA sections 41 to 43 we send personal data abroad only where the destination has adequate protection, or with appropriate safeguards such as contractual clauses in our agreements with each processor, or where another lawful ground in section 43 applies. [NEEDS LEGAL REVIEW: confirm the transfer basis for each processor and country (UK, South Africa, Germany, United States) and whether NDPC-approved clauses are needed]
How long we keep it
We keep your data while your account exists, unless a shorter period is listed. [NEEDS LEGAL REVIEW: every period in this table must be confirmed]
| Data | How long |
|---|---|
| Profile, friends, chats, stories, settings | Until you delete them or your account. A message deleted for everyone is wiped from our servers at once. Disappearing messages are removed when they expire. |
| Gistmo AI chats | Until you delete your account; deleted with it. |
| Call quality figures | 30 days [NEEDS LEGAL REVIEW: proposed] |
| Error reports and operations logs | 90 days [NEEDS LEGAL REVIEW: proposed] |
| Gistmo Cash records: wallet, payments, identity checks, payout accounts, audit log | As long as financial and anti-money-laundering law requires, including after your account is deleted. [NEEDS LEGAL REVIEW: period, e.g. five years after the relationship ends, to be confirmed] |
| Identity-check selfies and documents | Deleted once the check is complete, after a short buffer, unless the law requires keeping them. [NEEDS LEGAL REVIEW: buffer and any legal minimum] |
| Record that an account was deleted (its id, when, what was removed) | [NEEDS LEGAL REVIEW: period], as proof we carried out the request. |
| Backups | Data deleted from the live system can remain in our hosting provider’s encrypted backups until they expire. [NEEDS LEGAL REVIEW: backup retention period] |
Deleting your account
In the app: Settings → Security → Delete account. You confirm with your transaction PIN or a code we email you. You can also ask on the web at gistmo.app/delete-account.
- Deleted: your profile, photo, friends, friend requests, blocks, chat memberships and settings, reactions, stars, stories and Snaps, calls list, game scores, location, push tokens, PIN, Gistmo AI chats and the reports you filed; and the photos, videos, voice notes, files, locations and contact cards you sent (those messages show as deleted in other people’s chats). Your sign-in is deleted and every device is signed out.
- Kept for others: text messages you sent stay in the chats of the people you sent them to, because they are part of those people’s conversations, but they are no longer linked to your account.
- Gistmo Cash: you can’t delete your account while there is money in your wallet or a payment is still going through; withdraw your balance first. Afterwards your Gistmo Cash records are kept as the law requires (see above), and nothing else.
Download a copy of your data first if you want one: Settings → Security → Download my data.
Your rights
Under the NDPA (sections 34 to 38) you have the right to:
- be told how your data is used (this policy);
- get a copy of your data, in a format you can take elsewhere (in the app: Download my data);
- have wrong data corrected (most of it you can edit in the app);
- have your data deleted (in the app: Delete account);
- restrict or object to processing based on legitimate interest;
- withdraw consent at any time (for location: turn it off in the app or your phone’s settings), without affecting what was done before;
- not be subject to a decision based only on automated processing that significantly affects you (see below).
For anything you can’t do in the app, write to privacy@gistmo.app from the email on your account. We answer within 30 days [NEEDS LEGAL REVIEW: confirm the response period]. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Security
Data travels over encrypted (TLS) connections and is stored encrypted by our hosting providers. Database rules let an account read only conversations it belongs to and only its own Gistmo Cash data; payments need your PIN on our servers, not just in the app; identity numbers are encrypted. Today the app keeps your sign-in in its own private storage on your phone; a coming version moves it into the phone’s secure keystore (Keychain on iPhone, Keystore on Android). Messages and calls are not end-to-end encrypted; we will say so clearly if that changes.
If something goes wrong
If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it (NDPA section 40) and, where the risk to you is high, tell you directly and without undue delay, with what happened and what you can do. [NEEDS LEGAL REVIEW: confirm]
Automated decisions
Gistmo Cash uses automatic rules to spot payments that may be fraud or money laundering. A flagged payment is held for a person to review; it is never refused for good by the rules alone. Gistmo AI’s answers are generated automatically and can be wrong.
Children
Gistmo is not for children under 13. Gistmo Cash and identity checks are for people 18 and over. [NEEDS LEGAL REVIEW: confirm minimum ages under NDPA section 31 (child is under 18) and whether parental consent is needed for 13 to 17]
Changes
If we change this policy we will update the date above and, for meaningful changes, tell you in the app before they take effect.
Questions about your data?
Write to us from the email on your account. We will get back to you within 30 days [NEEDS LEGAL REVIEW: confirm the response period].