Privacy Policy
In short: we collect only what we need to run your account and your cases. We do not show advertising, we do not use advertising or analytics trackers, and we do not sell your personal data. You can ask us to access, correct or delete your data at any time by emailing [email protected].
1. Who we are
Naija Chase (“we”, “us”, “our”) is a free online detective game set in Nigeria. We are the data controller for personal data processed through the Naija Chase website at naijachase.com (the “Website”) and the game at naijachase.app (the “Game”). Together these are the “Service”.
You can contact us about privacy at [email protected].
2. What this policy covers
This policy explains what personal data we process when you visit the Website, create an account, or play the Game, why we process it, who receives it, and what rights you have. We process personal data in line with the Nigeria Data Protection Act 2023 (the “NDPA”) and, where it applies to you, other data protection laws.
3. Data we collect
3.1 The Website (naijachase.com)
The Website is a static information site. It does not require an account, does not set cookies and does not contain analytics or advertising scripts. Like any web server, ours automatically records basic technical data when a page is requested: your IP address, the time of the request, the page requested, your browser’s user-agent string and the response status. See section 3.4.
3.2 Data you give us
| Data | When | Why we need it |
|---|---|---|
| Email address | Registration | To create and confirm your account, send account emails (confirmation and password reset) and contact you about your account. |
| Username | Registration | To identify you in the Game, including to members of private groups you join. |
| Home base (a Nigerian state or the FCT) | Registration | It sets your starting jurisdiction in the Game. |
| Password | Registration, login | To protect your account. We never store your password in readable form. We store only a one-way hash created with the Argon2id algorithm. |
| Avatar choice | When you choose one | To show your chosen avatar in the Game. |
| Group names and membership | When you create or join a private group | To run private groups and weekly challenges. |
| Messages you send us | When you email us | To reply to you and handle your request. |
Please do not use your real full name, a phone number or other directly identifying information as your username or group name.
3.3 Data created while you play
- Your cases, the stops you visit, the witnesses you question, your travel choices, your dossier entries, warrants, arrests and results.
- Your case budget use, scores, career points, rank, achievements, tokens earned in the Game and weekly-challenge results.
- Timestamps of actions, so the Game can apply deadlines, travel times and anti-cheating checks.
This is gameplay data about a fictional investigation. We do not use it to profile you for advertising.
3.4 Technical and security data
- Your IP address, browser and device type, and the dates and times of requests, recorded in server logs.
- Session information for each device you sign in on (for example when a session was created and last used, and the browser or device type) so you can review and sign out of your devices.
- Request counts used for rate limiting and abuse prevention.
3.5 Data we do not collect
We do not collect your precise location, contacts, photos, payment card details, government identification numbers or biometric data. We do not currently run advertising, and checkout is not enabled.
4. How and why we use it
Under the NDPA we must have a lawful basis for processing. Ours are:
| Purpose | Lawful basis |
|---|---|
| Creating and running your account; saving your progress; operating cases, groups and weekly challenges; sending confirmation and password-reset emails | Performance of our contract with you (the Terms of Use) |
| Securing the Service, preventing cheating, fraud, abuse and attacks, rate limiting, debugging and keeping logs | Our legitimate interests in running a safe and fair service, which do not override your rights |
| Complying with law and responding to lawful requests from authorities | Legal obligation |
| Anything else that needs your permission (for example, optional features that we may introduce) | Your consent, which you may withdraw at any time |
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Automated checks in the Game, such as deadlines and anti-cheating rules, affect only your game results.
We do not sell your personal data and we do not use it for third-party advertising.
5. Cookies and browser storage
We use only what is strictly necessary to provide the Game you ask for, so we do not show a consent banner for it.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
nc_session | Cookie (HttpOnly, SameSite=Lax, Secure) | Keeps you signed in. It holds an opaque, random token rather than your details. | Until it expires, is rotated, or you sign out |
nc-music, nc-music-track, nc-scene, nc-settings | Local storage | Remember your music, track, 2D/3D scene and display preferences on your device. | Until you clear your browser data |
nc-case, nc-rank and scene “seen” markers | Session storage | Remember which case you are viewing and which animated intros have played during this visit. | Until you close the tab or browser |
You can clear or block these in your browser settings, but the Game will not work properly without the sign-in cookie. We do not use advertising cookies, analytics cookies or social-media tracking pixels, and the Website sets no cookies at all.
6. Who we share it with
We share personal data only where needed to run the Service:
- Email delivery. We use Cloudflare’s email sending service to deliver account emails. Cloudflare receives your email address and the content of the message, which is a confirmation or password-reset link.
- Hosting and infrastructure. Our servers, database, backups and network providers process data on our behalf under confidentiality and security obligations.
- Other players. If you join a private group, its members can see your username, avatar and weekly results in that group. Groups are private and invitation-only. We do not publish your email address to other players.
- Authorities and legal reasons. We may disclose data when required by law, court order or a lawful request, or to protect the rights, safety and property of our users, the public or ourselves.
- Business changes. If the Service is transferred to another operator, your data may be transferred too. We will tell you first and the same protections will continue to apply.
Our service providers may use your data only for our instructions and not for their own purposes, except where they act as independent controllers as the law requires.
7. International transfers
Some of our providers, including our email provider, may process data outside Nigeria. Where we transfer personal data abroad, we do so only where the NDPA allows it, for example to a country or provider that gives an adequate level of protection, or under appropriate safeguards such as contractual protections.
8. How long we keep it
- Account and gameplay data: for as long as your account exists. Inactive accounts that have not been used for 24 months may be deleted after we notify you by email.
- Server logs and security data: up to 90 days, unless we need them longer to investigate abuse or a security incident.
- Sessions: until they expire or you sign out. Revoked sessions are removed in the ordinary course.
- Backups: deleted data may remain in routine encrypted backups for up to 90 days until they are overwritten. We will not restore deleted data except to recover from a failure, and will re-delete it if we do.
- Legal claims and obligations: we may keep specific records for longer where the law requires or to establish, exercise or defend legal claims.
When you delete your account we remove or irreversibly anonymise your personal data within 30 days, except what we must keep as described above.
9. Security
We protect personal data with measures that include hashing passwords with Argon2id, opaque revocable session tokens, rotating sessions and revoking a whole session family if an old token is reused, HTTPS for all connections, rate limiting, restricted access to servers and databases, and keeping secrets out of source code. The Game also keeps answers and hidden case information on the server and not in your browser. No system is completely secure, and you should choose a strong, unique password and sign out on shared devices. If a personal data breach is likely to put your rights at risk we will notify the Nigeria Data Protection Commission and, where required, you, within the time the law requires.
10. Your rights
Under the NDPA you may have the right to:
- be informed about how we use your data (this policy);
- access the personal data we hold about you and get a copy;
- correct inaccurate or incomplete data;
- ask us to delete your data, or restrict its use;
- object to processing based on our legitimate interests;
- receive your data in a structured, commonly used, machine-readable format (portability);
- withdraw consent at any time, without affecting earlier lawful processing; and
- not be subject to a decision based solely on automated processing that significantly affects you.
To use any of these rights, email [email protected] from the address registered to your account. We may ask you to verify your identity first. We will respond within one month, or sooner if the law requires. We will not charge a fee unless a request is clearly unfounded or excessive. You can also change your avatar and sign out of any device from inside the Game.
11. Children
The Service is not intended for children under 13 and we do not knowingly collect their data. If you are under 18, you may use the Service only with the permission and supervision of a parent or guardian, who consents to our handling of your data on your behalf. If we learn that we hold data of a child under 13, or of a minor without the required parental consent, we will delete it. Parents and guardians who believe this has happened can contact us at [email protected].
12. Changes to this policy
We may update this policy when our practices or the law change, for example if we add paid cosmetic items, new features or analytics. We will update the date at the top. If a change is material, we will notify you by email or inside the Game before it takes effect, and ask for consent where the law requires it.
13. Contact and complaints
Questions or requests: [email protected].
If you believe we have not handled your data properly and we have not resolved your concern, you have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng). If you live elsewhere, you may also contact your local data protection authority.