1. Who We Are

HoodPadi is a neighbourhood social network operated by HoodPadi (the "Service"). We connect residents of Lagos estates and neighbourhoods so they can share safety alerts, buy and sell locally, and message their neighbours. Our registered contact address is Lagos, Nigeria. For all privacy enquiries, reach us at privacy@hoodpadi.com.

2. Data We Collect

We collect information in the following categories:

Account & Identity

Email address, display name, and password (stored as a PBKDF2-HMAC-SHA256 hash; we never store your plain-text password). An account does not need a phone number. If you add a WhatsApp number to a listing or a phone number to a business page, neighbours who view it can see it.

Neighbourhood & Address

Your residential neighbourhood (e.g. Lekki Phase 1) and, where provided, your street address or estate name. This is the core data that scopes your access to your specific community. Other members only see the profiles of people in their own neighbourhood; HoodPadi administrators can see all profiles for moderation.

Content You Post

Posts, safety alerts, marketplace listings, comments, direct messages, and event details you create. A location is stored only when you choose to add one, using your device's location permission. Incident reports keep the exact point you choose so neighbours can find the hazard. For alerts, listings, events and help requests we round the location to an area of about 200 metres before storing it, so a pin never shows your door.

Usage & Technical Data

Standard server logs (IP address, browser type, pages visited, timestamps) retained for up to 30 days for security and debugging. We do not use third-party analytics trackers or advertising cookies.

3. How We Use Your Data

To create and manage your account and neighbourhood membership
To scope all content (posts, alerts, listings, messages) to your verified neighbourhood — content is never shown outside your area
To send transactional emails: account verification codes, password reset OTPs, and notification digests
To enforce community safety: detecting spam, abuse, and policy violations
To improve the Service based on aggregated, anonymised usage patterns

We do not sell your data. We do not use your data for advertising. We do not build profiles for third-party marketing.

4. Third Parties & Processors

Cloudflare

Our infrastructure runs on Cloudflare Workers, D1 (database), R2 (media storage), and Email Workers. Cloudflare processes data on our behalf under their Data Processing Addendum. Data is stored in Cloudflare's European and US data centres.

DiceBear (Avatars)

Default profile avatars are generated by DiceBear's public API using only a hash of your user ID. No personal data is sent to DiceBear.

No other third parties receive your personal data.

5. Your Rights (NDPR)

Under the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023, you have the right to:

Access — request a copy of all personal data we hold about you
Rectification — correct inaccurate or incomplete data at any time via your Profile settings
Erasure — request deletion of your account and all associated data
Portability — receive your data in a machine-readable format (JSON)
Object — object to any processing you did not consent to
Withdraw consent — for any processing based on consent, at any time

To exercise any right, email privacy@hoodpadi.com. We will respond within 30 days.

6. Data Retention

Account data is retained for as long as your account is active. Posts, listings, and comments you delete are removed immediately. If you delete your account, all personal data is permanently erased within 30 days, except where retention is required by law. Server access logs are purged after 30 days.

7. Security

Passwords are hashed using PBKDF2-HMAC-SHA256 with 100,000 iterations and a unique random salt per user. All data is transmitted over HTTPS/TLS. Access to the database is restricted to our Cloudflare Worker service — no direct public database access exists. We conduct periodic security reviews.

8. Cookies

HoodPadi does not use tracking cookies or advertising cookies. A JSON Web Token (JWT) stored in your browser's localStorage is used solely to authenticate your session. It contains your user ID and expires after 7 days.

9. Children

HoodPadi is not directed at or intended for use by persons under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has registered, contact us immediately at privacy@hoodpadi.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via an in-app notification and/or email at least 14 days before they take effect. Continued use of the Service after that date constitutes acceptance of the updated policy.

11. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Federal Republic of Nigeria, including the NDPR 2019 and the Nigeria Data Protection Act 2023. Any disputes shall be subject to the exclusive jurisdiction of the courts of Nigeria.

12. Contact

For any privacy-related questions, requests, or complaints:

HoodPadi Privacy Team

Lagos, Nigeria

privacy@hoodpadi.com