The short version. For the beta we hold your phone number, first name, campus, phone type and the email you use for TestFlight or Google Play, plus a few taps about who you'd gift first. We use them to verify you, hold your place in line, unlock your campus, send your beta invite and add you to your campus WhatsApp group, which you opt into. We don't sell any of it. Email privacy@joygiver.app at any time to see it or delete it.
1. who we are
Joygiver (“Joygiver”, “we”, “us”) runs joygiver.app and the Joygiver apps: wishlists and group gifting for birthdays, weddings and every other moment worth celebrating. We are based in Lagos, Nigeria.
For the personal data described in this policy, Joygiver is the data controller under the Nigeria Data Protection Act 2023 (the “NDPA”) and the regulations and directives of the Nigeria Data Protection Commission (the “NDPC”). You can reach us about anything in this policy at privacy@joygiver.app.
2. the beta waitlist (what applies today)
When you get in line for the beta we collect:
- Your phone number, checked with a one-time code sent by WhatsApp or SMS. We store only a scrambled version of the code, and only for 10 minutes.
- Your first name and campus (for example "unilag"), the first names of friends you say you'll bring (optional), and who you'd gift first (a friend, partner, family or coworker).
- Your phone type and store email: iPhone or Android, and your Apple ID email (for TestFlight) or Google Play email (for the Android beta).
- Referrals: your personal link code, who invited you (a friend or a creator we work with, if anyone) and how many people joined with your link. We pay creators based on verified sign-ups from their link; they never see your number.
- Your consent to be added to your campus (or state) WhatsApp group, and when you gave it.
- Usage events: page visits, starting sign-up, verifying, finishing, sharing (which app) and tapping the lobby link. These are tied to a random ID stored in your browser and, once you sign up, to your account. We also note the country and city your connection comes from, as reported by our hosting provider. We don't store your IP address with your account.
- A sign-in cookie, so the "my spot" page knows it's you. It lasts 60 days, and signing out removes it.
We use this to verify you're a real person, hold and show your place in line, count campus progress, credit the people and creators who invited you, send your beta invite when your campus unlocks (or when you bring 3 friends), text you, and add you to your campus WhatsApp group. Other people only see campus totals, never your name or number.
Our legal basis is your consent, which you give when you tick the box and join. You can withdraw it at any time: reply STOP, leave the community, or email us. Withdrawing doesn't affect anything we did before.
If you apply to be a creator
We also collect your full name, campus, the platforms and handles where you post, your rough audience size and your short answer about how you'd bring your campus in. We use them to review your application, prevent fraud (for example, spotting repeated handles) and run the programme. Once you're approved, we collect your bank name, account number and account name to pay you. We count sign-ups that came through your link, but you only see an initial and campus for each, never their number. We keep payout records for as long as financial and tax laws require.
The WhatsApp group
The WhatsApp group is optional. WhatsApp is run by Meta, and when you join, your name and phone number may be visible to other members and to group admins, depending on the group’s settings and your WhatsApp privacy settings. Meta’s own privacy policy covers how WhatsApp handles your data. You can leave the group at any time; leaving the group doesn’t take you off the waitlist, and leaving the waitlist doesn’t remove you from the group.
3. when you use joygiver after launch
Once the app and list pages are live, we’ll collect more, because moving money between people safely needs it. We’ll update this policy before launch and tell you about the changes. In outline:
| What | Why | Legal basis |
|---|---|---|
| Name, phone, email, profile photo, birthday | Create your account, show your lists to the people you share them with, remind your friends about your moment | Contract |
| Your lists, wishes, notes and messages | Run the service | Contract |
| BVN or NIN, bank account name and number | Verify you once before your first withdrawal; make sure payouts only go to an account in your own name | Legal obligation; contract |
| Gift records: who gave, how much, how they paid, payment references | Process gifts, refunds and payouts; prevent fraud. This includes secret gifts: the giver is hidden from the list owner and guests, but Joygiver always keeps a private record of who gave and where the money came from | Contract; legal obligation; legitimate interests (fraud prevention) |
| Contacts you choose to share | Help you find friends already on Joygiver and invite others. Only with your permission, and you can turn it off | Consent |
| Device and usage data, crash logs | Keep the app working and secure, fix bugs | Legitimate interests |
Guests who chip in through a list link without an account give us only what the payment needs (and a name or note if they choose to add one).
4. who we share it with
We never sell your personal data. We share it only with the service providers who help us run Joygiver, under contracts that require them to protect it and use it only on our instructions:
- Hosting and infrastructure: Cloudflare, which hosts this website and stores the waitlist.
- Messaging: an SMS and WhatsApp messaging provider to send your verification code and launch texts, and WhatsApp (Meta) for campus groups and our channel.
- App stores: Apple (TestFlight) or Google (Google Play) receive your store email so they can send your beta invite. Their own privacy policies apply.
- After launch: licensed payment partners, banks and identity-verification providers regulated in Nigeria, to process payments and payouts and to verify your identity.
We may also disclose data when the law requires it (for example, a valid request from a court or a regulator), or to protect people from fraud or harm.
5. data outside nigeria
Some of our providers, including Cloudflare, process data on servers outside Nigeria. When that happens we rely on the transfer grounds allowed by the NDPA, such as the provider’s contractual commitments to protect your data to a standard at least as high as Nigerian law requires.
6. how long we keep it
- Beta waitlist data: until launch, plus up to 6 months to send launch updates, unless you create an account (then the account rules apply) or ask us to delete it sooner. Usage events are kept for up to 12 months.
- Account and gift records (after launch): for as long as your account is open, and afterwards for as long as financial and anti-money-laundering laws require us to keep transaction records (usually at least 5 years).
7. your rights
Under the NDPA you have the right to:
- be told what personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have your data deleted, where we no longer need it or you withdraw consent;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent at any time;
- not be subject to decisions based solely on automated processing that significantly affect you.
Email privacy@joygiver.app from the number’s owner (or tell us the number in your message and we’ll verify it by text). We’ll respond within 30 days. If you’re not happy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
8. keeping it safe
We use encryption in transit (HTTPS everywhere), access controls so only people who need data can see it, and providers with strong security records. No system is perfect; if a breach ever puts your rights at risk, we’ll tell you and the NDPC as the law requires.
9. cookies
This website doesn’t use advertising or third-party tracking cookies. We set one strictly necessary sign-in cookie when you verify your number, and keep a random visitor ID in your browser's local storage to count visits and shares. Our hosting provider may set strictly necessary cookies to keep the site secure (for example, to block bots). We load our font from Google Fonts, which receives your IP address to deliver it. If we ever add analytics or other non-essential cookies, we’ll ask first.
10. children
Joygiver isn’t for children under 18 to use on their own. A parent can make a list for a child’s moment (a naming, a birthday) and manage it themselves. If you think a child has given us their data, email us and we’ll delete it.
11. changes to this policy
We’ll update this policy when Joygiver changes, and always before the app launches. If a change matters, we’ll tell you by text or in the app before it takes effect. The date at the top shows the latest version.