Privacy Policy

Mbube.io is a digital platform dedicated to the cultural preservation and community connection of the Mbube people of Nigeria. We operate under Nigerian law and are committed to protecting your personal data in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and its 2023 Act, as well as internationally recognised data protection principles.

References to “we”, “us”, or “Mbube.io” in this policy mean the operators of this platform.

• Account data: display name (handle), full name (optional), email address, password (hashed, never stored in plain text), community affiliation.
• Profile data: biography, location, avatar image uploaded to Cloudinary.
• Content data: posts (text, images, audio), comments, translation contributions, reactions, and connections you make on the platform.
• Usage data: pages visited, features used, timestamps, and general interaction patterns — collected via Google Analytics 4 (GA4) with IP anonymisation, and only after you accept our cookie/terms banner. See §6 (Cookies) and §6a (Analytics) below for details and opt-out.
• Device & technical data: IP address (truncated by GA4), browser type, operating system, and access times — collected automatically for security and service improvement.
• Communications: messages you send to other users via the platform’s messaging feature.

• To create and manage your account.
• To display your posts, translations, and contributions to the community.
• To send you notifications about activity on your content.
• To moderate content and enforce our Community Guidelines.
• To improve the platform’s features and performance.
• To comply with legal obligations and respond to lawful requests from authorities.
• To send important service-related communications (we do not send marketing emails without consent).

• Contract: processing necessary to provide the service you signed up for.
• Legitimate interests: security, fraud prevention, platform improvement.
• Legal obligation: compliance with Nigerian law and valid court orders.
• Consent: for optional features such as email notifications.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

We may share data with:

• Cloudinary — for image and audio storage (your uploaded media).
• OpenAI — anonymised text submitted for AI-assisted translation (no account data is shared).
• Resend — email address + first name are shared with our transactional email provider (Resend) to deliver sign-in links, notifications, and (with your consent) promotional emails.
• Google Analytics 4 — anonymised usage data (page views, session length, device/browser type, approximate country) after you accept our cookie banner. IP is anonymised at collection time.
• Law enforcement — only when required by a valid Nigerian court order or legal process.

Mbube.io uses two categories of cookies:

• Essential cookies (always on) — keep you signed in and maintain your session. Set the moment you sign in. You can clear them via your browser settings, which will sign you out.
• Analytics cookies (opt-in) — set by Google Analytics 4 only after you accept our terms & cookies banner. Cookie names begin with _ga and _gid. They record anonymised page views and session behaviour so we can understand how the site is used. We do not use these for advertising, personalisation, or profiling.

Advertising cookies: we do not use them. There are no ad networks or third-party ad trackers on Mbube.io.

Withdraw analytics consent at any time by clearing your browser’s local storage for mbube.io — the terms banner will reappear on your next visit and you can decline. You can also opt out globally with Google’s Google Analytics Opt-out Browser Add-on.

We use Google Analytics 4 (GA4) to understand which pages get used, how people navigate through the site, and where our translation contributors come from. This helps us improve the platform without needing to interview every visitor.

GA4 is loaded with Consent Mode v2:

• Before you accept our terms banner, all analytics storage is denied — no cookies are set and no events are collected.
• After you accept, GA4 begins collecting page views, session duration, device/browser type, and approximate country (derived from IP with the last octet truncated).
• We enable IP anonymisation at the config level. Full IP addresses never reach Google’s servers or ours from GA.
• We do not enable any GA4 advertising features — no ad personalisation, no audience remarketing, no Google Signals.

Google is the data controller for GA4 data — see Google’s Privacy Policy for how they process it. Data is retained by Google for 14 months, our configured minimum.

• Active account data is retained for as long as your account exists.
• When you delete your account, your profile data is anonymised within 30 days. Your public posts and translation contributions may be retained in anonymised form to preserve the community’s language corpus.
• Server logs are retained for up to 90 days for security purposes.

Under Nigerian data protection law, you have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Object to certain processing activities.
• Request data portability in a machine-readable format.

To exercise any of these rights, contact us at legal@admin.mbube.io or via our Contact page.

Mbube.io is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child under 13 has created an account, contact us and we will delete it promptly.

We implement industry-standard security measures including passwordless magic-link authentication, JWT-based sessions, HTTPS, and access controls. No system is 100% secure — if you discover a vulnerability, please report it responsibly to legal@admin.mbube.io.

We may update this policy from time to time. We will notify registered users of material changes via an in-app notification or email. Continued use of the platform after changes constitutes acceptance of the updated policy.

For privacy-related enquiries, email legal@admin.mbube.io or visit our Contact page. We aim to respond to all data requests within 30 days as required by the NDPR.