Privacy Policy

Account: your first and last name, email address, phone number and password. Passwords are stored only as a bcrypt hash, so we never hold the password itself.

Profile: your photo, bio and the city or area you enter. Listings: photos of your space, its address, description, capacity, pricing and amenities.

Identity verification, if you list a space: a photo of the front and, where applicable, back of a government-issued ID; a selfie taken with your camera, which our team compares with the ID photo; proof of a bank account in your name; and, for business hosts, your CAC certificate.

Payments: the amount, reference and status of each transaction and, when you withdraw, your bank name, account number and account name.

Content: messages you send other users, reviews you write, and any report you file.

Location: if you allow it, your approximate location is used to show spaces near you. We ask before using it, it is used only while the app is open, and you can refuse and search by address instead. We do not store a history of where you go.

Device: a push notification token and whether your device is iOS or Android, so we can tell you about your bookings.

Website visits: we count page views and button presses with Umami, an analytics tool we run on our own servers. It sets no cookies and records no personal information, and we don't use it to recognise you from one visit to the next.

The app uses no analytics or advertising SDK. We do not collect an advertising identifier, we do not track you across other apps or websites, and we do not build an advertising profile of you.

To run your account and sign you in; to publish listings and take bookings; to process payments, payouts and refunds; to verify identity, which protects everybody transacting on the platform; to notify you about bookings, payments and verification decisions; to answer support tickets; to investigate reports of abuse, fraud or unsafe listings; and to meet our legal obligations.

We do not sell your personal information, and we do not use it for advertising.

Only the service providers needed to run the platform, each handling data on our instructions: Paystack for payments (card details go directly to Paystack and never reach our servers); Cloudinary for photo and document storage; Google for Sign in with Google and address autocomplete; Apple for Sign in with Apple; Firebase Cloud Messaging and Expo for push notifications; Resend for transactional email; and Railway for hosting.

We also share the minimum necessary with the other party to a booking: a host sees the guest's name and booking details, and a guest sees the host's name and listing.

We will disclose information if the law requires it, or to protect the rights and safety of our users.

Your ID and selfie are visible only to the trained reviewer handling your case. They are stored privately, are never delivered from a guessable address, and every single time a document is opened it is recorded in a tamper-proof log with the reviewer's identity and the time.

They are never shown to hosts, guests, or anyone else using the platform.

Account and profile information: until you delete your account.

Identity verification documents: five years from the decision, after which the files are automatically and permanently destroyed. Anti-money-laundering rules require this period.

Transaction records: for the period required by Nigerian tax and accounting law. When you delete your account these are stripped of your bank details and no longer identify you.

Verification decision log: retained. This log cannot be altered or deleted by anyone, including us. That is deliberate: it is what makes the verification process auditable.

In the app, go to Profile → Delete Account. It completes straight away and you do not need to contact us.

If you no longer have the app installed, request deletion at circleground.com/delete-account. That page works without signing in.

Deleted: your name, email, phone number, photo, bio, messages, reviews, saved spaces, listings and their photos, and any identity documents. Kept, stripped of anything identifying you: transaction and verification records for the periods above, and the verification decision log.

Deletion is permanent and cannot be undone. If you have money in your wallet or an unfinished booking, we will ask you to settle those first.

Under the Nigeria Data Protection Act 2023, and comparable laws elsewhere, you can ask us to give you a copy of your data, correct it, delete it, or stop a particular use of it. You can also withdraw a permission you previously gave, such as location or notifications, in your device settings at any time.

Email privacy@circleground.com and we will respond within 30 days.

Traffic between the app and our servers is encrypted in transit. Passwords are hashed with bcrypt. In the app, session tokens are held in the device keychain or keystore; on the website they are kept in your browser's storage for this site, and signing out removes them. Verification documents are stored with authenticated delivery and are reachable only through links that expire within minutes.

No system is perfectly secure. If a breach ever affects your personal data, we will tell you and the regulator as the law requires.

Circle Ground is for adults. You must be 18 or older to create an account. We do not knowingly collect information from anyone under 18, and we delete such an account as soon as we learn of it.

If we change this policy we will update the date above and, where the change is significant, tell you in the app before it takes effect.