How Heed handles your data.

Heed Nigeria collects the minimum personal data needed to run a community safety platform. This policy explains what we collect, how we use it, who can see it, and how you can ask us to remove it. The policy is written to comply with the Nigeria Data Protection Regulation (NDPR).

1. What we collect

Account data

• Email address and (optionally) phone number for sign-in and OTPs.
• Display name and (optionally) a profile photo URL.
• The password hash (never the password itself).
• Session metadata: device user-agent, last IP, login timestamp.

Incident reports

• Category, sub-category, free-text description (up to 1,000 characters).
• GPS coordinates and reverse-geocoded address.
• Optional photos you choose to attach.

Emergency SOS data

• The list of trusted contacts you save (names + phone numbers).
• Live location pings during an active alert and for 10 minutes after.
• Delivery receipts for each SMS / email sent on your behalf.

2. How we use it

Account data drives authentication and prevents abuse. Incident reports power the public safety map and area risk profiles. SOS data is relayed to your trusted contacts and stored for 30 days for audit, then deleted. We never sell your personal data and we don't run third-party ad trackers.

3. Who sees what

• Your incident reports appear on the public map at ~100 metre precision. Your exact GPS coordinates stay server-side only. Anonymous reports remove the link to your account.
• Your SOS goes to the contacts you saved, plus (optionally) the account holder's email. Nobody else.
• Your account (email, phone, name) is never shown publicly on a report. Moderators may see it to investigate abuse.

4. How long we keep it

• Incident reports: kept indefinitely. They are the platform's long-term safety record.
• Account data: until you delete the account.
• SOS alert logs (including recipient phone numbers): 30 days.
• OTP codes: discarded after use or 10 minutes, whichever comes first.

5. Your rights (NDPR §3.1)

• Access: email hello@heed.ng and we'll send a structured export within 14 days.
• Correction: update your name, email, and phone number from /settings. For other corrections, write to us.
• Deletion: open /settings→ Account & Security → Delete account. You'll be asked to confirm via email OTP. Your reports are anonymised (the link to your account is removed) but the data itself stays on the map, since other users have relied on it.
• Portability: bundled with the access export above.
• Object: you can turn off any notification channel in /settings.

6. Security

Connections are HTTPS-only with HSTS. Sessions are HttpOnly cookies, SameSite=Lax, signed with an HS256 JWT. Database traffic is TLS pinned to the Aiven project CA. Passwords are hashed with bcrypt (cost 10). OTP request flow is rate-limited and OTP codes are bcrypt-hashed in the database.

7. Children

Heed is intended for users 16 years and older. We don't knowingly collect data from anyone younger.

8. Contact

Data Protection Officer · hello@heed.ng · Heed Nigeria, Abuja, FCT.