Privacy policyIwu nzuzo

1Who we are

Nkata ("Nkata", "we", "us") is a chat app made in Enugu, Nigeria, available on the web, as an Android app and on iPhone (added to the Home Screen). The person responsible for your personal data (the "data controller") is the owner of Nkata, based in Enugu State, Nigeria.

Contact for anything about privacy: Settings → Report a problem, inside Nkata.

This policy explains what personal data Nkata collects, why, who it is shared with, how long it is kept, and the rights you have. It applies to the Nkata website, the Android app and the iPhone web app, and follows the Nigeria Data Protection Act 2023 ("NDPA").

2Definitions

In this policy, words have the meaning given in the NDPA. In particular:

• "Personal data" means any information that identifies you or can be linked to you, such as your name, email address, @username, photo or device.
• "Processing" means anything done with personal data: collecting, storing, using, sharing or deleting it.
• "Data controller" means the person who decides why and how personal data is processed; for Nkata, that is the person named in section 1.
• "Data processor" means a company that processes personal data for us, on our instructions (see section 6).
• "End-to-end encryption" means a message is locked on the sender's device and can be unlocked only on the devices of the people it was sent to, not by Nkata.
• "NDPC" means the Nigeria Data Protection Commission, the regulator under the NDPA.

3What we collect

a) What you give us

• Account: display name, @username, email address and password. The password is stored only as a one-way hash (bcrypt), never as the password itself.
• Profile (optional): photo or emoji avatar, "about" line, birthday, language, theme and chat background.
• Messages and media: text, photos, voice notes, stickers, polls, contact cards you choose to share, and documents you send. Chats, groups and status updates are end-to-end encrypted: Nkata receives them locked and cannot read them (see section 5).
• Location: only when you choose to share your location (or live location) in a chat. Nkata never tracks your location in the background.
• Feed posts, status updates, events and channels you publish, with likes, comments and replies.
• Payments: what you bought (coins or Nkata Plus), the amount, the date and the payment reference. Your card or bank details go straight to Paystack and never reach Nkata.
• Messages to us: problem reports and emails you send.

b) What is created when you use Nkata

• Contacts and chats: who is in your contacts, your groups, who you blocked, and delivery and read ticks.
• Call history: who called whom, when, and for how long. Nkata does not record calls.
• Games: scores, wins, leaderboards, coin balance and coin history.
• Devices and security: the devices signed in to your account (device type and the IP address used), the public encryption key of each device (the private key never leaves the device), a notification token for your phone, failed sign-in attempts, and a log of the last 500 security events (for example "password changed").
• Online status: whether you are online and when you were last seen (you control who sees this).
• Service data: how much data the server sends in total, by type (for example "photos" or "calls"), so the owner can keep within the hosting allowance. This does not include what your messages say.

c) On your phone

The app saves your chats, photos and settings on your own phone so they open quickly and work offline. Nkata does not read your phone's address book, SMS or call log.

4Why we use it (and the legal basis)

Under the NDPA, we may use personal data only with a lawful basis. We use yours:

• To provide Nkata (contract): create your account, deliver messages and calls, show your posts to the people you chose, run games and leaderboards, deliver what you paid for, and send notifications.
• To keep Nkata safe (legitimate interests): stop break-ins and spam, limit repeated attempts, keep a security log, act on reports (including the last messages a reporter's phone sends, see section 5), and suspend accounts that break the Terms.
• For "Forgot password" (contract): send you a one-time code by email.
• To show ads to people without Nkata Plus (consent where required, otherwise legitimate interests). See section 8.
• To keep records required by law (legal obligation), such as payment records for tax.
• For optional features you switch on (consent): location sharing, Google Drive backup, notifications, camera and microphone. You can withdraw consent at any time in the app or in your phone's settings.

We do not sell your personal data, use it to build advertising profiles of our own, or make decisions about you by automated means that have legal or similarly significant effects.

5End-to-end encryption, reports and backups

Your chats, groups and status updates are end-to-end encrypted. They are locked on your phone and can be unlocked only on the phones of the people you send them to. Nkata's server only passes the locked copy along. Nobody at Nkata can read them, and neither could anyone who broke into the server.

a) How it works

• Every phone or browser where you use Nkata makes its own pair of keys. The private key never leaves that device. A browser keeps it where no script can read it out; the Android app keeps it locked with your phone's secure key store (Android Keystore), so a notification can be opened while Nkata is closed. It is deleted when you log out. Only the public key is sent to Nkata, so that others can lock messages for you.
• When you send something, your phone locks it with a new key (AES-256-GCM), then locks that key separately for each device of each person in the chat (ECDH P-256). The server receives only the locked envelope.
• What is locked: the words of messages, photos, videos, voice notes and documents, polls, one-time shared locations, contact cards, replies, forwarded messages and scheduled messages (they wait on the server locked until it is time to send them).
• Status updates are locked for exactly the people you choose in Settings → Privacy → Status privacy: My contacts, My contacts except…, or Only share with…. Other people don't receive them at all. A reply to a status goes privately into your chat with that person.
• Notifications: a locked message travels through Google (Android) or your browser's notification service still locked, with the key copies made for your own devices only. Neither Google nor Nkata can read it; your phone opens it and shows the words on your screen. If your phone can't, or the message is too long, the notification says only "New message" or the kind of message, such as "📷 Photo". Turn off Settings → Notifications → Show message text to keep the words off your lock screen; locked chats never show them. "Reply" on a notification is locked too.
• Calls use WebRTC and are encrypted end to end (DTLS-SRTP), including group calls. When two phones can't connect directly, an encrypted relay (TURN) server passes the call along but cannot listen to it.
• Large videos go directly from phone to phone and are never stored on the server.

b) What is not end-to-end encrypted

• Who you talk to, the groups you are in, group names and photos, and when messages are sent, delivered and read. The server needs these to deliver messages and show ticks.
• Reactions, poll votes, live-location updates, stickers and coin gifts.
• Your profile, Feed posts, comments, events and channel posts. These are meant to be seen by others, so they are protected by HTTPS and database encryption instead.
• Announcements from the Nkata Team, including their photos and videos. They come from Nkata, not from another member.
• There is not yet a way to compare security codes with a contact, so you rely on Nkata handing out the right public keys.

c) Older versions of the app

Old versions of Nkata can't lock messages. For 14 days after encryption was switched on, messages to or from someone using an old version are sent without end-to-end encryption, and the app marks them with 🔓. After those 14 days, old versions must be updated before they can send or read messages.

d) Reports: the only time anyone else sees your messages

If someone reports a person from a chat, the reporter's own phone sends the last 10 messages of that chat to Nkata's admins so they can check. These are messages from both sides, including photos, videos and voice notes, but never view-once media. The person reported is not told. Only admins can open these messages, after entering a separate admin password and a code from an authenticator app, and every time one is opened it is logged. They are deleted after 90 days. Because they come from the reporter's phone, admins treat them as the reporter's evidence.

e) Where your messages are kept

• On your phone, not on our server. A new message waits on the server, locked, only until every phone in the chat has saved it. Then it is deleted from the server. A small record (time, ticks, reactions) stays for up to 60 days so ticks keep working. If a phone never comes back, the message is deleted after 30 days. If someone in the chat still uses an old version of the app that can't save chats, the locked message stays on the server until they update.
• Disappearing and view-once messages are deleted when their timer runs out, or after they are viewed.
• Backups are yours. In the Android app you can save a backup to your own Google Drive, in a hidden folder that only Nkata can use. On any device you can download a backup file. Backups are encrypted before they leave your phone, with a key linked to your Nkata account, so you can restore them on a new phone. Nkata never receives your backup file and cannot open your Drive. This backup lock is not end-to-end: it protects the file from anyone who doesn't also have access to Nkata's server.

6Who we share it with

Other people on Nkata see what you choose to share: your profile (as allowed in Settings → Privacy), messages you send them, Feed posts, status updates (only the people you chose), events, channel posts, game results and leaderboard scores. Nkata's admins see the messages attached to a report, as described in section 5.

Service providers who process data for us, only as needed to run Nkata:

The law: we may disclose data if a Nigerian court, regulator or law-enforcement body lawfully requires it, or to protect someone's life or safety. We check every request and disclose only what is required.

If Nkata changes hands (for example sold or merged), your data would pass to the new owner under this policy, and you would be told first.

7Data sent outside Nigeria

Nkata's server and database are in the European Union (Germany), and some providers above are based in the USA. The NDPA allows this where the destination gives adequate protection or appropriate safeguards are in place. The EU is covered by the GDPR, one of the strictest data laws in the world, and the other providers protect data under their own data-processing terms and standard contractual clauses. Data is always encrypted in transit, and the database is encrypted at rest.

8Ads, cookies and local storage

• Nkata itself uses no tracking cookies. The app keeps your sign-in and settings in your browser's or phone's local storage so you stay signed in.
• Google ads: people who don't have Nkata Plus may see ads from Google AdSense. Google and its partners may use cookies or similar technology to show ads, limit how often you see them, measure them and prevent fraud, and possibly to personalise them. Learn how Google uses data at policies.google.com/technologies/partner-sites, and turn off personalised ads at adssettings.google.com.
• Nkata Plus has no ads.

9Phone permissions (Android app)

The app asks for each permission only when you use the feature, and you can say no or change it later in your phone's settings:

• Microphone: voice notes and calls.
• Camera: photos, video calls and status.
• Photos and videos: to send pictures you pick (Android can share only the ones you select).
• Location: only when you share your location in a chat.
• Notifications, full-screen alerts and running in the background: so messages arrive and incoming calls can ring, even on the lock screen.
• Wi-Fi state: for calls and big-video transfers between phones on the same Wi-Fi.

10How long we keep it

When you delete your account (Settings → Account → Delete account), we immediately remove your profile, email, password, contacts, posts, stories, events, comments, likes, signed-in devices and coin balance. Messages you already sent stay with the people who received them, shown as "Deleted account", because they are part of those people's chats. Payment records are kept as the law requires. Backups in your own Google Drive stay there until you delete them.

11How we protect it

• HTTPS (TLS) for everything sent between your device and Nkata.
• The database and stored media are encrypted (AES-256-GCM) with keys kept apart from the data.
• Passwords are hashed with bcrypt. Sign-in locks after 5 wrong attempts, and you can turn on 2-step verification.
• A strict browser security policy, rate limits, and a tamper-evident security log.
• Chats, groups, status updates and calls are encrypted end to end, and backups are encrypted before they leave your phone.
• Admin tools need a separate admin password kept only in the server's settings, plus a fresh 6-digit code from an authenticator app, on each phone (again after 30 days or after signing out), and then the phone's own fingerprint or screen lock each time. Admins must use 2-step verification. Admins cannot read chats.
• Only the owner can reach the server's settings, and secret keys are stored encrypted.

No system is perfectly secure. If a breach puts your rights at risk, we will tell the Nigeria Data Protection Commission within 72 hours and tell you without undue delay, with advice on what to do.

12Your rights

Under the NDPA you have the right to:

• be informed (this policy);
• access your data and get a copy;
• correct it (most of it you can edit yourself in Settings);
• delete it (Settings → Account → Delete account, or ask us);
• restrict or object to how we use it, including for ads;
• data portability: receive it in a common format (the backup file is one way);
• withdraw consent at any time, without affecting what was done before;
• not be subject to decisions made solely by automated means that have legal or similarly significant effects;
• complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

To use any of these rights, write to Settings → Report a problem, inside Nkata, from the email on your account or with your @username. We may ask you to confirm it's you. We reply within 30 days, and it's free.

13Age

You must be at least 13 years old to use Nkata, like WhatsApp. Under the NDPA, anyone under 18 is a child, so if you are between 13 and 17 you may use Nkata only with your parent's or guardian's permission, and by signing up you confirm you have it. If we learn that an account belongs to someone under 13, or to a child without that permission, we will delete it. Parents and guardians can write to us at Settings → Report a problem, inside Nkata.

14Changes to this policy

We may update this policy when Nkata changes or the law requires it. The new version will appear here with a new date. If a change is important, we will tell you in the app before it takes effect.

15Contact

Nkata, Enugu State, Nigeria
Email: Settings → Report a problem, inside Nkata