Privacy Policy

Effective 2 October 2026 · Applies to the Gistpot Android app and the web app at hangtime-dg.web.app

Gistpot is a social app for chatting with friends, playing games together, sharing posts and short videos (Vibes), following channels and checking live scores. It is run by Idris Muhammad, an individual developer in Nigeria ("we", "us"). This policy explains what we collect, why, who helps us run the service, how long we keep it, and the choices you have. We wrote it in plain language; if anything is unclear, contact us (see the end).

The short version. We collect what is needed to run Gistpot: your account, what you share, and basic app activity. We do not show ads, sell your data, or use advertising trackers. We do not access your contacts, location or phone number. Messages are protected by strict access rules and encrypted in transit and at rest, but they are not end-to-end encrypted. You can delete your account and data at any time.

1. What we collect

Information you give us

Account: your email address and password. Passwords are handled by Google Firebase Authentication; we never see them.
Profile: display name, @handle and, if you add one, a profile photo.
Age confirmation: at sign-up you enter your birth year to confirm you are 13 or older. We store only the fact that you agreed to these terms, not your birth year.
What you share: chat messages, photos, videos, documents, reactions and replies; feed posts and comments; 24-hour statuses; Vibes and comments; channel posts; game challenges.
Your connections: friends, friend requests, groups, people you block, chats you mute or clear, channels you follow, matches and people whose posts you turned notifications on for.
Reports: when you report something, we keep the report and a short copy of the reported content so moderators can review it.
Problem reports: if you use "Report a problem", the message you write and technical details about the error.

Information collected when you use Gistpot

Activity: games played, scores, coins, XP, trophies and leaderboard positions.
Presence: when you were last active and whether you are on Android or the web, used to show "online" and "last seen". You can hide both in Settings → Privacy & security.
Notifications: a device token so we can send you notifications, and your notification settings.
Calls: audio and video calls are relayed live between you and the other people in the call. We do not record calls. A short "call" note (for example "Video call · 4:12") is added to the chat.
Crash reports: the app version and technical error details when something goes wrong.

Kept only on your phone

What kinds of Vibes you enjoy (used to order "For you"), your chat wallpaper and bubble choices, and display settings. These never leave your device.

What we do not collect

Your contacts, location, phone number, or advertising ID. We do not use ad networks or advertising trackers.

2. How we use it

To run Gistpot: sign you in, deliver messages and calls, show your posts, Vibes and statuses to the people you choose, run games and leaderboards, and send the notifications you ask for.
To keep Gistpot safe: enforce our Terms, review reports, remove harmful content and stop abuse, and protect children (see our Child Safety Standards).
To fix problems and improve the app.

We rely on the contract with you (to provide the service you signed up for), your consent (for example notifications and camera or microphone access, which you can turn off in your phone's settings), and our legitimate interest in keeping Gistpot safe and working.

3. Who can see what

Chats are visible only to the people in that chat.
Feed posts and statuses are visible to your friends.
Vibes, channel posts and your profile (name, @handle, photo, level) are visible to other signed-in Gistpot users.
Moderators can see content that has been reported to them.
Photos, videos and documents are stored at long, random web addresses. Anyone who has the exact address can open the file, so only share links with people you trust.

4. Service providers (who helps us run Gistpot)

Provider	What they do	Where
Google Firebase (Authentication, Cloud Firestore, Cloud Messaging, Hosting)	Sign-in, database, notifications, web app	Database in Belgium (EU); Google's global network
Render	Gistpot's game and app server	Frankfurt, Germany
Cloudinary	Stores and resizes photos, videos and documents	Cloudinary's cloud (may be outside your country)
LiveKit Cloud	Relays live audio and video calls (not recorded)	LiveKit's global network
YouTube	Plays featured short videos in Vibes through YouTube's embedded player	Google; Google's privacy policy applies to that playback

Public news, sports scores and video feeds are read by our server; your personal data is not sent to those sources. We never sell your personal data. We may share information if the law requires it, or to protect someone from serious harm (for example, reports of child sexual abuse to the authorities).

Some providers are outside Nigeria. They are bound by their own security and data-protection commitments, and we use them only to run Gistpot.

5. How long we keep it

Statuses: 24 hours. News stories: 7 days. Featured YouTube Vibes: about 3 weeks. Score alerts: removed after the match.
Everything else stays until you delete it or delete your account.
When you delete your account we remove your profile, @handle, posts, comments, statuses, Vibes, likes, channels you own, friendships, settings and uploaded photos and videos straight away. Messages you sent stay in your friends' chats, as in other messaging apps. Copies may remain in our providers' backups for up to 30 days before they are overwritten.
Reports and moderation decisions may be kept longer when needed to prevent abuse or meet legal obligations.

6. How we protect it

All connections use HTTPS/TLS. Our providers encrypt data at rest.
Strict database rules decide who can read or change every item (for example only chat members can read a chat; nobody can post as someone else). We test these rules against the live service.
Our server checks your sign-in on every request. Secret keys live only on the server, never in the app.
Uploads are checked for type and size and stored under random names.
You can lock the app with your fingerprint or phone PIN, hide your online status and last seen, hide message previews in notifications, block people, and mute or clear chats.
Limits: Gistpot messages are not end-to-end encrypted, so they could in principle be accessed by us or our providers. We access content only to keep the service safe (for example when it is reported) or when the law requires it. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

7. Your choices and rights

Under Nigeria's Data Protection Act 2023 (and similar laws such as the GDPR where they apply) you can ask to access, correct, download or delete your personal data, object to or restrict some uses, and withdraw consent. In the app you can:

Edit your name and photo (Me → Settings).
Delete posts, statuses, Vibes, comments and messages you sent.
Delete your account: Settings → Account → Delete account, or on the web at hangtime-dg.web.app/delete-account.

For anything else, contact us. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or your local data protection authority.

8. Children

Gistpot is for people aged 13 and older. We do not knowingly collect data from children under 13. If you believe a child under 13 is using Gistpot, report the account in the app or contact us and we will delete it.

9. Changes

If we change this policy we will update the date at the top and, for important changes, tell you in the app.

10. Contact

Idris Muhammad (Gistpot), Nigeria.
In the app: Settings → Help & about → Report a problem.
Email: support address coming soon