ALLOWANCE SAAS LTD

RC 9615473

Privacy Policy

Allowance · Last updated 30 September 2026

This policy explains what Allowance collects, why, who else sees it, and what you can do about it. It is written to describe how the app actually works rather than to cover every imaginable case.

1. What we collect

We do not collect or store your card details. Card and bank information is entered with our payment provider and never reaches Allowance's servers.

2. Health details, and why they are treated differently

Age, height, weight and blood group are sensitive personal data under section 30 of the Nigeria Data Protection Act 2023. We handle them differently from everything else:

• They are optional. The app works without them.
• We rely on your explicit consent, given separately rather than bundled into your agreement to these terms.
• You can remove them at any time from your profile, and doing so deletes them.
• They are never shared with vendors, advertisers or other users.

3. Your phone's contacts

There are two separate things here, and neither happens unless you start it.

Sharing one contact into a chat. Your phone's own contact picker opens and only the single contact you tap is sent to us — as a name and a number, inside that message.

Finding who is already on Allowance. If you tap Import contacts, your phone asks your permission first, and you can refuse and keep using everything else.

When you do allow it, the phone numbers are turned into unreadable fingerprints on your phone before anything leaves it. We receive the fingerprints, never the numbers. We compare them with fingerprints of the numbers already on Allowance and tell your phone which ones matched. A fingerprint that matches nothing tells us nothing, and we do not keep it.

We only match a number when exactly one account claims it. If two accounts have entered the same number, neither is offered to you, because we cannot say which is the real owner.

The name you saved somebody under is stored only for people who are already on Allowance, so their name appears the way you know them. It is visible only to you — never shown to them, never shown to anyone else, and never used for advertising. You can remove it in the app, and it goes when your account does.

People who are not on Allowance are not stored at all. When you invite one, your phone opens WhatsApp with a message you send yourself. We do not message your contacts and we keep nothing about them.

4. Calls

Voice and video calls run over a real-time connection provided by LiveKit. While a call is in progress your audio and video pass through their servers to reach the other person.

• We do not record calls. No audio or video from a call is stored by Allowance.
• We do keep a call log — who called whom, when, and how long it lasted — so it can appear in your chat history.
• Calls need microphone access, and video calls need camera access. Both are requested at the moment you place or answer a call.
• The screen is kept awake during a call so it does not lock mid-call.

5. How your content is protected — stated plainly

What is true:

• Everything travels over encrypted connections (HTTPS/TLS), and is encrypted at rest on our provider's servers.
• Database access rules mean one user cannot read another user's private messages through the app or its API.
• However, because we hold the keys, your messages are technically readable by us. We access them only where we must: to investigate a report of abuse, to fix a fault, or where the law requires it.
• Do not send anything through Allowance that you would not want a platform operator to be capable of reading.

6. Anonymous gists

Sending a gist anonymously is the one place in Allowance where what we store and what we show are deliberately different, so it gets its own section.

• What is stored — the words you wrote, which campus you are on, the time, and a reference to your account.
• What a reviewer sees — the words, the campus and the time. Not you. The queue a reviewer reads does not return the sender at all, so there is nothing there for a careless query to expose.
• When the reference can be opened — by an administrator only, with a written reason, and the act of opening it is written to a permanent log before the answer is given. We do it only where something submitted breaks the law, puts somebody in danger, or where we are legally required to identify a sender.
• Why we keep it at all — because a platform that cannot identify the sender of an unlawful post has no way to stop it and no way to answer a court. Our lawful basis is our legitimate interest in keeping the platform safe, and our legal obligation where we are ordered to act.
• How long — for as long as your account exists. Delete your account and the whole submission record goes with it, including the reference to you. A gist already published stays up with nothing left connecting it to you: it belongs to the campus account that published it, not to your profile.

7. House accounts and third-party content

Some accounts are run by us rather than by a student, and carry a blue star. They post news and gist gathered from public sources — posts on X, publishers' public feeds — with a link to each source.

• They do not process your personal data. They do not read your profile, they are not targeted at you individually, and nothing you do in the app changes what they post.
• Pictures are copied onto our own storage before publishing, so your device never requests anything from X or from a news site — neither of them learns your IP address or that you are an Allowance user.
• A campus account reaches one university. Its notification goes only to people whose profile says they are at that university. Turn push notifications off and you get none of it.
• We do not pay for, and are not paid by, any of these sources.

8. Why we use your data

9. Who else receives your data

We do not sell your personal data. We share it only with the providers who make the app work:

Other users see what you choose to show them: your profile, your posts, your store and anything you send them. A delivery agent you send an order to also sees the phone number on your profile, on the order and on the notification, so they can call you if the app cannot — nobody else does, and no number means nothing is shared. And three things a game shows on its own: anyone, signed in or not, may watch a Challenge or a league fixture you play, thirty seconds behind; other players see your record and rank; and a comment you post in the stands is public. We may also disclose data where we are legally required to, or to protect someone's safety.

10. Where your data is stored

Our database and files are hosted in the European Union, and some providers above operate globally. Transferring personal data out of Nigeria is permitted under section 41 of the NDPA where the destination offers adequate protection or appropriate safeguards are in place; we rely on our providers' contractual data protection terms for this.

11. Age

Allowance is for people aged 16 and over. If you are under 18, you may use Allowance only with the consent of a parent or guardian, as required by section 31 of the NDPA.

Certain parts of the app are restricted to users aged 18 and over, including selling on the marketplace, receiving payouts, and any feature involving a financial transaction in your own name.

We do not knowingly collect data from anyone under 16. If you believe a child has given us their data, contact us and we will delete it.

12. How long we keep things

• Your account — until you delete it.
• Messages and media — until you or the sender delete them, or the account is deleted.
• Messages on a free account — hidden from everybody about 24 hours after they are sent. Hidden is not deleted: we still hold them, and subscribing to Allowance Plus makes the conversations in your chats visible again. We do not promise to keep hidden messages for any particular length of time, so save anything you need permanently.
• Contact names you imported — until you remove them or delete your account.
• Games played in a chat — kept with the conversation they were played in.
• Challenges and league fixtures — the result stays as your record while your account exists; the move-by-move game is kept so the game history can show it, and goes with the account.
• Role applications — while your account exists, so a repeat application can be read against the last one.
• Stories and moments — removed automatically when they expire.
• Call logs — kept with your chat history.
• Transaction records — kept for up to 6 years, because tax and accounting law requires it. This survives account deletion.
• Anonymous gist submissions — including the reference to the sender, while that sender's account exists. Deleting the account destroys the record; a gist already published stays up with nothing connecting it to anyone. See section 6.
• Reports of abuse — kept as long as needed to act on them and prevent repeat harm.

13. Your rights

Under the NDPA 2023 you may ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything inaccurate;
• delete your data, subject to the retention periods above;
• restrict or object to how we use it;
• withdraw a consent you gave — for location, notifications or health details — without affecting what we did before you withdrew it;
• receive your data in a portable form.

Email allowancemobileapp@gmail.com. We respond within 30 days. If you are not satisfied, you may complain to the Nigeria Data Protection Commission.

Deleting your account

You can delete your account from Settings on your profile in the app (then Xtreme stuff, then Delete account). This removes your profile, posts and messages. Transaction records are retained as described above.

14. Security

• Encrypted connections everywhere, and encryption at rest.
• Row-level database rules so one account cannot read another's data.
• You can see every device signed into your account and sign any of them out remotely, from the account switcher.
• No card details are ever held by us.

No system is perfectly secure. If a breach affects your rights, we will notify you and the Nigeria Data Protection Commission as the NDPA requires.

15. Ambassador applications

If you apply to ACRAP or the Campus Ambassador programme from the Register screen, we collect what you type into the form: your full name, phone number, school, department or faculty, level, why you want to join, whether you are 18 or over (or under 18 with a parent or guardian who will co-sign), and, for ACRAP, roughly how many students are in your class.

We use it only to review your application, contact you about it, and run the programme if you are accepted. It is read by the Allowance staff who review applications and is never shown to other users. If you are accepted, the Ambassador badge beside your name is public — that is what it is for. Bank details for any Ambassadorship Fund payment are collected separately, under your signed agreement, and are not part of this form.

Your applications are kept with your account and are deleted with it.

16. Website storage

The Allowance website stores data in your browser to keep you signed in and remember your preferences. It is not used for advertising or cross-site tracking.

17. Changes

We will update this policy as the app changes, and will tell you in the app when a change is significant. The date at the top always reflects the current version.