Wetin Dey is a community platform for anonymous civic reports from Nigerian citizens. This policy explains what we collect, what we do not, and your rights under the Nigeria Data Protection Act 2023 (NDPA).
What we collect
Anonymous activity: a random session identifier stored in a signed HTTP-only cookie. No phone number. No email address. Our application does not log IP addresses for anonymous reports, comments, or messages. As with any web service, our hosting and database providers process request metadata (including IP) at the network layer for security and abuse prevention.
Optional account recovery: you may attach an email address or phone number to your session for recovery. This is optional and removable at any time. Reports you post stay anonymous regardless.
Images and video: photos and videos attached to reports and posts, plus avatars for your profile and any Spaces you own. All EXIF metadata (GPS, camera model, timestamp) is stripped before storage.
Audio: voice notes attached to comments and chat messages, and voice broadcasts posted inside Spaces.
Your handle: the @name you choose (or the random one we assign). It is public and appears next to everything you post under a named account.
Coarse location: when you submit a report or post to Talk Am, we store the state or LGA you choose. Nothing finer is stored for public content.
Precise location (Radar safety signals): when you send a Need help or Police stop signal on Radar, your device sends precise coordinates. Those coordinates are visible only to the Circle members you selected for that signal. They are never shown on any public page. While the signal is active, your device sends an updated location every 30 seconds. The moment you tap I'm safe, updates stop and the location is marked as no longer shared. You can also remove the entire signal by asking us to delete your account.
Radar Circle contacts: when you add someone to your Circle, we store a link between your session and theirs so you can send each other signals. Adding someone is one-sided by default; the other person must add you back before either of you can signal the other. You can remove a Circle contact at any time from the Radar page, and deleting your account removes your Circle membership from our system in both directions.
Presence: a last-seen timestamp that powers the online indicator. You can hide it entirely in Settings → Presence.
Push tokens: if you enable notifications, we store the push subscription your browser issues, and on Android we store the Firebase Cloud Messaging (FCM) device token so we can deliver native push. iOS native push (APNs) is on the roadmap, not yet shipped. You can disable notifications anytime in your device settings.
What we do not collect
- Phone numbers (unless you add one for recovery)
- Email addresses (unless you add one for recovery)
- IP addresses for anonymous reports
- Tracking pixels, fingerprinting scripts, or third-party analytics
Who processes your data
- Supabase — database, file storage, realtime, authentication. EU region.
- Vercel — hosting, edge network, and Blob storage for large files. Global edge network.
- Groq — AI formalization of report text, and audio transcription of voice testimony attached to reports and voice comments. Report body text and the relevant audio file are sent to Groq for processing. Groq never receives session identifiers, account data, or any other uploaded files. US.
- Resend — sends verification and password-reset emails on our behalf via Supabase Auth. US.
- Telegram — receives a public mirror of reviewed reports only. No DMs, no user files.
We do not sell your data. We do not run ads on the Talk Am civic feed.
Retention
Reports and comments that comply with our content rules stay in the public archive, attached to a permanent URL. Content that violates the rules (threats, doxxing, hate, sexual content, minors, illegal content, confirmed defamation) is removed from public view within 24 hours and never shown publicly again.
Voice notes and chat messages stay until you or a moderator deletes them. Broadcasts expire automatically after 24 hours.
Deleting your account
When you delete your account we remove your email, phone number, handle, auth record, avatars, broadcasts, followers, blocks, push subscriptions, check-ins, votes, reactions, and Radar signals immediately.
Your reports and comments stay visible in the archive but are detached from your identity — we replace your session id and handle with a placeholder.
Direct messages you sent remain visible to the other participant, because removing them would erase their copy of the conversation too. Their sender id points to a ghost profile with no email, no login, and a generic handle — it cannot be logged into again.
Your rights (NDPA)
Under the Nigeria Data Protection Act 2023 you can:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data
- Withdraw consent for optional processing
Reports and comments that comply with our content rules stay in the public archive. Deleting your account removes your identifying information, but the anonymized report and comment content remains (see the Termsfor the full exception list).
Contact
Questions or requests: support@wetindey.app
Draft notice: this copy is written in plain language and is pending review by a Nigerian lawyer familiar with the NDPA 2023 and the Cybercrimes Act 2015. It is not legal advice.