Privacy Policy

iCallOn ("we", "us") is an online word game operated from 5 Agbaje Street, Alapere, Ketu, Lagos, Nigeria. This policy explains what personal data we collect, why we collect it, how long we keep it, and what rights you have.

We process your personal data under the Nigeria Data Protection Act 2023 (NDPA). Where this policy says we have a "lawful basis", it means a basis recognised by that law.

You must be 13 years or older to create an account or use iCallOn. We do not knowingly collect data from children under 13. If you believe a child under 13 has given us data, contact us and we will delete it.

We collect only what the game and the service need:

• Account data — email address and the display profile you provide (name, avatar choices, settings). Guests (players without an account) get a guest identity instead of an email.
• Gameplay data — matches you play, answers you submit, flags, progression (XP, levels, badges), and match history. This is the core of the product and cannot be turned off while you play.
• Chat and messages — messages you send in public rooms, level rooms, match chat, and direct messages. Direct messages are private between participants. Staff can only see a direct message if a participant reports it, and that access is logged.
• Device token — we store a random, unguessable token in your browser. It is not a fingerprint and does not track you across other sites. We use it to link accounts that run on the same device, so a ban on one account applies to every account on that device. Clearing your browser storage removes it.
• Analytics data — app opens, sign-ups, and game starts, counted with your account ID (or guest ID) so we can report totals like unique daily visitors. We do not build advertising profiles from this.
• Moderation and support data — reports you file or receive, cases opened about you, moderation actions taken against you (removed messages, mutes, bans, appeals). Removed message content is kept as evidence for the case.
• Advertising data — when you view or click a paid advertisement, we record that event to bill the advertiser. We do not sell your personal data to advertisers, and advertisers never receive your identity.
• Technical data — your IP address is processed transiently to issue guest identities and to secure the connection. Server logs may record it for a short period for security and debugging.

• To run the game (contract): matchmaking, scores, progression, chat.
• To keep the community safe (legitimate interest): reports, moderation, bans, and appeals. We consider this necessary to protect players.
• To run the service (legitimate interest): analytics, capacity planning, fraud and abuse prevention, security.
• To bill advertisers (contract with the advertiser): counting ad views and clicks.
• To answer you (contract / legitimate interest): support cases and email replies.

We do not sell your personal data. We do not use invasive device fingerprinting.

We use service providers (subprocessors) that handle data only on our instructions:

• Supabase — authentication and database hosting (eu-west-1).
• Resend — transactional email (icallon.online).
• Bachs — payment processing for advertisers. They receive what a payment requires, nothing more.
• Contabo — game server hosting (94.72.106.222).

We may disclose data if the law requires it, or to protect players, respond to lawful requests, or investigate abuse of the service.

Support staff may see your account details when handling a case. Only Super Admins can see private contact details such as your email. Your email is never shown to a Moderator.

Under the NDPA 2023 you can, among other things:

• Ask for access to the data we hold about you.
• Ask us to correct data that is wrong.
• Ask us to delete your data.
• Object to how we use your data.
• Withdraw consent where we rely on consent.
• Complain to the Nigeria Data Protection Commission.

Important limitation: if you have been banned, we keep the ban record (and any linked evidence) after an account deletion request. This is necessary to enforce the ban, handle appeals, and prevent a banned player from returning with a new account. We delete everything else we can.

To exercise any of these rights, contact us at support@icallon.online. We respond within the time the law requires.

We protect data with server-side access controls, hashed credentials, and role-based admin permissions checked on the server for every privileged action. No system is perfectly secure. If we learn of a breach that affects you, we will notify you and the regulator as the law requires.

We will update this page when our practices change. The "last updated" date at the top shows the latest change. If a change significantly affects your rights, we will announce it in the app.

Email: support@icallon.online
Post: iCallOn, 5 Agbaje Street, Alapere, Ketu, Lagos, Nigeria

This policy is a working draft. It should be reviewed by a qualified lawyer before it is relied on as final legal advice.