privacy policy

effective 11 oct 2026

joygiver is a naira wishlist and group-gifting app for nigeria. this page says what we collect when you use the joygiver app (with its app clip, widgets and extensions) or give through joygiver's web pages, why we collect it, who helps us run the service, how long we keep it, and what you can do about it.

who we are

joygiver ("we", "us") runs the joygiver app and joygiver.app, and decides how the personal data described here is used. you can reach us in the app's help chat (settings → help & support) or at hello@joygiver.app.

what we collect, and why

your phone number

to sign you in. we send a one-time code by text message (or a voice call, if you pick that). we store the code only as a keyed hash, never as the code itself. each sign-in attempt (the number, the ip address it came from and the code's hash) is deleted after 7 days.

your name, photo, handle, city and birthday

your profile. you choose what to add, and you can change it in the app. your name and photo show to the people who see your lists and the gifts you send. friends on joygiver see the month of your birthday, so they know it's coming. profile photos and list covers are kept in a public media store: anyone with the link to the image can open it.

your contacts (only if you allow it)

to show which of your people are already on joygiver. nothing is read until you allow contacts.

• the app sends only the phone numbers saved in your contacts, never names or anything else, over an encrypted connection.
• our server turns each number into a keyed hash (hmac-sha256 with a secret key only our server holds) and keeps just that hash. the numbers themselves are never stored.
• we compare those hashes with the hashes of joygiver members' own numbers to find matches. people you've blocked, or who've blocked you, never match.
• we never message the people in your contacts. (if you invite a co-host by typing their number, we text them the invite you asked us to send.)
• a sync of your whole address book drops the hashes of numbers you've since removed. if you say no to contacts in the app, contacts are switched off for your account and every hash we hold for you is deleted. closing your account deletes them too.

lists, wishes, gifts, notes and thank-yous

this is the service itself. for each gift we record the list and wish, the amount, the name you want shown, your phone number, your note, and whether the gift is secret. if you give on the web without an account, you give us your name and phone number so we can send your receipt by text. photos, videos and voice notes you attach to a note or a thank-you are kept in a private store and only opened through links that expire after 5 minutes.

messages with friends

this is the chat itself. we keep the messages, photos and replies you send in a chat with a friend or in a group chat, so the people in it can read them. photos are kept in a private store and only opened through links that expire after 5 minutes. when you delete a message, its text and photo are removed for everyone. if you report a chat, the last 20 messages you could see go with the report to our safety team.

money in chats

when you send, ask for, offer or sell something, or chip into a pot in a chat, we record who it's from and to, the amount, the note, the title and photo of something for sale, each step (offered, countered, accepted, paid, handed over, received), and any problem the buyer reports, with what both sides tell us. we use these to move the money, to hold a sale's money until the buyer has it, and for our team to decide a problem.

payments

gifts are paid through paystack, by bank transfer, ussd or card. card details are typed on paystack's own checkout page: never in joygiver, and never on our servers. we keep each payment's reference, amount, method, status and the payer's name and bank as paystack reports them. paystack's raw message about a payment (which can include a card's first 6 and last 4 digits) is cut down to the amount, references, status, fees, channel and dates 90 days after we process it.

bank account for payouts

to send you the money on your lists and in your wallet. we check the account with your bank through paystack, and keep the bank, the account name your bank returns, the last 4 digits, and the full account number encrypted. payouts only go to an account in your own name: we compare the account name your bank returns with your name on joygiver, and our team reviews every withdrawal before it's sent. this keeps payouts going to the right person and helps us meet anti-money-laundering rules.

• we don't ask for or collect any id document or id number in this version of joygiver.
• if the names don't match, a person on our team reviews it. the documents you upload for that review (or for a cause's organiser check) are kept with the review.

device identifiers and push tokens

to keep your account secure and to send you notifications. for each phone you sign in on we keep an id the app makes for that install, the device name, platform (ios or android), app version, and the ip address you signed in from. you can see your devices and sign them out in settings → security. to send notifications we keep push tokens: expo's token, and for live activities and widgets the tokens apple and google give the app. signing a device out switches its tokens off.

in-app usage events

to see which parts of joygiver work and to fix the parts that don't. we record events such as "list created" or "share sent" in our own database, with your account id, a random id for the install, the device id, and fixed details such as a list's link name or which app you shared to. events never carry names, phone numbers, notes or any free text, ip addresses or browser details. there is no third-party analytics or advertising code in the app, and we don't track you across other companies' apps or websites. events are deleted after 13 months; daily totals with no personal data are kept.

help chats and reports

when you message us in the help chat, we keep the conversation and any files so we can help you. if you report a list or a person, we keep the report and the reason so our safety team can act on it.

error reports

when something breaks on our servers, an error report goes to sentry. phone numbers, account numbers, codes, pins and secrets are removed from it first, and request bodies are never sent.

secret gifts

when you send a gift as a secret, the list owner sees "a secret giver" instead of your name. we still record who you are, because receipts, refunds and the law need it. the owner (or a partner on the list) gets 3 guesses: a right guess shows you to each other, and you can choose to reveal yourself. 7 days after the list closes, the secret is sealed for good. our support and safety team can see who sent a secret gift when they need to, and every time they do it is logged.

who helps us run joygiver

we share personal data only with these providers, and only for what they do for us:

paystack

payments, refunds, bank account checks and payouts.

termii

sign-in codes and text messages, by sms or voice call.

expo, apple and google

push notifications; apple and google also deliver live activity and widget updates.

cloudflare

storing photos and files (r2), and serving joygiver.app.

heroku

hosting our servers and database, in its eu region.

resend

sending our email.

sentry

server error reports, with personal data removed first.

we don't sell personal data, and we don't share it for advertising. other people on joygiver see only what the app shows them, such as your name and photo on your lists and on gifts that aren't secret.

where your data is stored

our servers and database run in heroku's eu region, so your data is stored outside nigeria. some of the providers above, including expo, sentry and cloudflare, also process data in other countries. we send data to them only for the purposes on this page.

how long we keep it

sign-in attempts

7 days.

sign-in sessions

until they expire (30 days after you last used the app on that device) or you sign out.

profile, contact hashes, push tokens and settings

while your account is open. closing your account deletes or anonymises them (see delete your account).

device records

kept after a device signs out or your account closes, to spot fraud.

usage events

13 months.

paystack's raw payment messages

90 days, then cut down to the amount, references, status and dates.

bank name reviews and the documents you upload for them

kept with the review, including after your account closes.

gifts, payments, payouts, refunds and our ledger

at least 6 years, even after an account closes. these are financial records the law requires us to keep.

messages with friends

until you delete them, or until your account closes, when the messages you sent are erased.

money in chats

like gifts and payments: at least 6 years, even after an account closes. the notes you wrote are cleared when your account closes.

help chats, reports and safety records

kept as records after a chat or case is closed, including after your account closes.

uploads you never finished

24 hours.

your rights

under the nigeria data protection act 2023 you can:

• get a copy of your data. settings → privacy → your data → download my data gives you a file with your profile, settings, devices, lists, gifts you gave, payouts, bank accounts and help chats. you can download it once a day.
• correct it. edit your profile in the app, change your number in settings → security, or ask us in the help chat.
• delete it. close your account in the app. see delete your account for what is deleted and what the law makes us keep.
• take back your consent to contacts. say no to contacts and we delete every contact hash we hold for you.
• object, or ask us to limit how we use your data. chat with us or email hello@joygiver.app.

if you're not happy with our answer, you can complain to the nigeria data protection commission.

children

joygiver is for people aged 18 and over. we don't knowingly collect data about children. if you think a child is using joygiver, tell us and we'll close the account.

security

• every connection to joygiver is encrypted (https only).
• bank account numbers are encrypted in our database. your contacts' numbers and sign-in codes are kept only as keyed hashes, and your withdrawal pin only as a one-way hash.
• review documents, receipts and attachments are kept in a private store and opened only through links that expire after 5 minutes.
• our team signs in with a second-factor code, money actions ask for it again, and their actions are recorded in a log that can't be edited.

no system is perfectly secure. if you find a problem, please tell us at hello@joygiver.app.

changes to this policy

when what we do with your data changes, we'll update this page and the effective date at the top.

contact

chat with us in the app (settings → help & support), or email hello@joygiver.app.