Privacy & cookies

• Account: your name, username, password (stored only as a secure hash), optional email, and date of birth (to confirm you’re 18 or older; never shown to anyone).
• Your citizen: avatar look, traits, bio, home area and everything you do in the game: wallet and ledger history, jobs, businesses, homes, rent, elections, policies and in-game location.
• Social: messages, friends, blocks and reports you send or receive.
• Payments: if you buy V₦, the order, amount, status and the provider’s reference. Card or bank details go to the payment provider, not to us.
• Security and sign-up: a salted, one-way hash of your IP address when you sign up (to limit mass sign-ups; we can’t read your IP back from it), sign-in sessions, when you were last online, and a record of important actions (an audit log).
• Errors: if something breaks, a technical error report (what went wrong, your browser type, your account ID). We strip out emails, IPs, cookies and message text before it’s sent.

• Your real-world location (GPS). “Where you are” in OurNaija is only in the game.
• Your contacts, photos or microphone.
• Advertising trackers or data from other websites. We don’t sell your data.

• To run the game you signed up for (contract): your account, the economy, homes, elections, messages and purchases.
• To keep OurNaija safe and fair (legitimate interests): stopping cheating, spam, fake accounts and abuse; handling reports; fixing errors.
• To meet the law (legal obligation): keeping payment and tax records, and answering lawful requests.
• With your consent, where we ask for it (for example, optional features). You can withdraw consent at any time.

We use one cookie: nr_session, which keeps you signed in. It’s strictly necessary, so it doesn’t need consent; without it, you can’t sign in.

We also save a few preferences on your device (not cookies, and never sent to anyone): graphics quality, sound, phone banners, whether the home panel is hidden, your unfinished sign-up, and short notes shown after deleting or recovering an account. You can clear them in your browser settings.

If the “I’m human” check is switched on, Cloudflare Turnstile runs on the sign-up page to stop bots. It doesn’t track you across websites.

• Other players see what the game shows publicly: your username, name, avatar, bio, home on the map, whether you’re online, and things like election results and treasury records.
• Service providers who process data for us under contract: hosting, our payment provider (for purchases), Sentry (error reports), and Cloudflare (the sign-up bot check).
• Authorities, when the law requires it or to protect someone from serious harm.
• A new owner, if OurNaija is sold or merged, under the same protections.

Some providers may process data outside Nigeria. When they do, we rely on contracts and safeguards that the Nigeria Data Protection Act allows.

• Your account data, for as long as your account exists.
• Sign-in sessions, until they expire or you sign out (30 days at most).
• Error reports, for up to 90 days.
• Payment and ledger records, for as long as financial and tax law requires (usually at least 6 years), linked only to an anonymised account after deletion.
• Backups, for up to 14 days.

In Phone → Settings you can delete your account. You’re signed out and hidden straight away. If you log in within 7 days, it’s cancelled. After 7 days we permanently anonymise the account: your name, email, date of birth, bio and avatar are erased, your username becomes “deleted_…”, your messages read “Message deleted”, and your tenancies, homes and business are closed under the game’s rules. Ledger and payment records stay, without your personal details, because the law requires them.

Messages are stored on our servers so you can read them on any device. They aren’t end-to-end encrypted. Staff read messages only when they’re reported, or to investigate serious abuse.

Some checks run automatically, such as limits on new accounts from one network, account age before sending V₦, and the sign-up bot check. They can stop an action, but they don’t close accounts on their own: suspensions and bans are decided by a person. You can ask for a person to review any decision.

We use encrypted connections (HTTPS), hashed passwords, access only for staff who need it, audit logs and regular backups. No system is perfectly secure; if a breach affects you, we’ll tell you and the regulator as the law requires.

Under the Nigeria Data Protection Act 2023 you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct data that’s wrong;
• delete your data (most quickly, in Settings), or limit how we use it;
• give you your data in a format you can take elsewhere;
• stop processing based on our legitimate interests, or withdraw consent.

Email [email protected]. We’ll reply within 30 days. You can also complain to the Nigeria Data Protection Commission.

OurNaija is only for people 18 and older. If we learn an account belongs to someone younger, we’ll close it and delete their data.

If you add an email, we use it for your account (for example, sign-in and important changes). We won’t send marketing without your permission, and you can opt out at any time.

We’ll update this policy when what we collect or how we use it changes, and tell you in the game if the change is important.