Draft for legal review — not in force

Privacy

BallotGuard is not INEC. This draft describes the data the website and the Android app handle. Counsel should replace it before it is presented as a binding policy. A public HTTPS copy of the final policy is required for a Play Store listing.

Account

Sign-in stores an email address, a name, and a password hash. The credit ledger stores purchases made on the website, spends, expiries, and adjustments. The Android app can show that balance. It does not collect a card number and it does not start a payment.

Observer reports

If you attach a photo or a device location to an observer note, that image and those coordinates are stored with the note. The note waits on the device until it can be sent. Observer notes are unverified and do not change a tally. Do not include someone else’s private contact details.

Push and device

The Android app may register a Firebase Cloud Messaging token so an in-app alert can also be delivered as a notification. The website keeps alerts in the account. Paywall events store a hash of the IP address, not the raw address.

Sharing

The operator does not sell this data. Website payments are processed by Paystack or Flutterwave. The Android build that ships to Play does not send you to those processors. Hosting, storage, and push delivery use the operator’s infrastructure providers.

Deletion

Ask the operator, from the account email, to delete the account, observer photos, and push tokens. Credits already spent stay in the ledger as historical rows with the account removed where the operator can do so.