Legal

Privacy Policy

Last updated 11 October 2026

PACEPOT LTD (“PacePot”, “we”, “us”) runs the PacePot app and playpacepot.com, and is responsible for your personal data under the Nigeria Data Protection Act 2023. This policy explains what we collect, why, who we share it with, and the choices you have.

The short version

We collect what PacePot needs: your sign-in details, your steps and your payments.
We read your step count and nothing else from your health app.
We never sell your data, and we don't use advertising or analytics companies. We use one service to catch app crashes.
People in your pots see your username, avatar and steps.
You can delete your account in Settings, or by email.

This summary helps you read the policy. It doesn't replace it.

01What we collect

Sign-inYour name and email address from Google or Apple, and your account ID. Google also shares a link to your profile photo. If you use Apple's “Hide My Email”, we only see the relay address.

ProfileYour username, the avatar you pick, your daily step goal, and where you heard about PacePot.

StepsYour step counts for each hour, read from Health Connect or Apple Health. We only read them while you're in a pot that has started, and each time we read the last 96 hours. We also keep your total for each day of a pot.

MoneyYour wallet balance and history: payments, entries, payouts, refunds, promo credit and withdrawals. The bank account you withdraw to: bank, account number and the account name your bank returns. Your wallet PIN, stored only in a scrambled form that can't be turned back into the PIN.

Your phoneAn install ID we create, your phone's brand and model, operating system, app version and screen size, when you last used the app, which phones you've used PacePot on, and a push notification token.

PhotosA cover photo, only if you choose one from your photo library for a pot you create.

InvitesThe invite code you used, who invited you, the people you invited and the bonuses earned.

SupportWhat you send us when you contact us.

Crash reportsWhen the app crashes or hits an error: what went wrong, the screen it happened on, the app version, and your phone's model and operating system. Your PIN, bank details, sign-in tokens and step data are removed before a report leaves your phone.

We don't collect your BVN, NIN, date of birth, location or contacts, and PacePot doesn't use your camera or microphone. You type card and bank transfer details on our payment partner's page, so we never see your full card number.

02How we use it, and why we're allowed to

Running PacePotYour account, your pots, counting steps, settling results and your wallet. We need this to provide the service you signed up for.

Payments and withdrawalsTaking payments, sending payouts and keeping financial records. We need this for the service and to meet our legal duties.

Keeping pots fairSpotting impossible step reports, keeping one phone per account and reviewing bonuses when accounts share a phone. This is in our and other users' legitimate interest.

NotificationsMessages about your pots, results, money and account. We don't send marketing messages. If we start, we'll ask you first.

Fixing crashesCrash and error reports help us find and fix problems in the app. This is in our legitimate interest, and yours.

Support and the lawAnswering you, handling disputes, and responding to lawful requests from authorities.

Step dataRead only with the permission you give in Health Connect or Apple Health. You can take it back at any time.

03Step data

We ask Health Connect and Apple Health for permission to read your step count only. We don't read any other health data, and we never write to your health app.
We use step data only to run pots, show your progress, settle results and check for cheating.
We never use step data for advertising or marketing, never sell it, and never share it with data brokers.
Steps sync while PacePot is open. We don't read them in the background.
You can turn off access at any time in Health Connect or the Health app. Your steps then stop syncing, so you may miss days in a pot.

04What other people can see

People in your pots see your username, avatar, entry, total and daily steps, place, prize and status.
Public and sponsored pots can be viewed by anyone, even without signing in.
Your pacer profile shows your username, when you joined, your badges and up to 100 past pots with entries, prizes and steps. For private pots, people outside the pot only see the dates and your result.
Your rank badge reflects how much you've paid into PacePot overall, and other users can see it.
Your invite code shows your username and avatar to anyone who opens it. People you invite are shown to you by username, with whether they've joined a pot.
Cover photos you add to a pot can be seen by anyone with the link.
Share cards show your username, result, prize, steps and place, but only when you choose to share one.

We don't sell your data. We share only what each of these needs to do its job for us:

SupabaseHosts our database, sign-in and file storage.

MonnifyTakes card and bank transfer payments and sends withdrawals. For a payment it gets the amount, the name on your profile and a reference made from your account ID. For a withdrawal it gets your bank, account number and account name.

Google and AppleSign you in. They also deliver push notifications, through Expo and Firebase Cloud Messaging or the Apple Push Notification service. These get your push token and the notification text, which can include pot names, amounts and usernames.

SentryReceives crash and error reports, with your PIN, bank details, sign-in tokens and step data removed. Stored in the EU.

Hetzner and CloudflareRun servers and network links for us, including the connection to our payment partner and the invite and share links on playpacepot.com.

AuthoritiesOnly when the law requires it, such as a court order or a request from a regulator or law enforcement.

A new ownerIf PacePot is sold or merged, your data would move to the new owner under this policy.

Some of these providers store or process data outside Nigeria. When data leaves Nigeria, we rely on the safeguards the Nigeria Data Protection Act allows, such as contracts that require providers to protect it.

06How long we keep it

We keep your data while your account exists.
Messages in your in-app inbox are deleted after 90 days.
Crash reports are deleted within 90 days.
When you delete your account, we delete your name, phone number, email, username, Apple or Google sign-in, PIN, saved bank accounts, step data, inbox, badges, invite code and phone details. If you signed in with Apple, we also remove PacePot from your Apple ID. Signing in again starts a new, empty account.
Your results in finished pots, and pots you created, stay so other players' pots still add up. Other players see "Closed account" instead of your name.
We keep the IDs of phones used on your account, without your name, so new-player bonuses can't be claimed twice.
What we keep stays linked to a closed account with no name, phone or email on it.
Cover photos you uploaded aren't removed automatically. Email us and we'll delete them.

07Security

Data travels encrypted between the app and our servers. Money only moves through our servers, never from the app on your phone. Your wallet PIN is stored scrambled, and only people who need data for their work can reach it. No system is perfectly secure. If a breach puts your data at risk, we'll tell the Nigeria Data Protection Commission within 72 hours, and we'll tell you without delay.

08Your rights

Under the Nigeria Data Protection Act 2023, you can ask us to:

give you a copy of your data,
correct data that's wrong,
delete your data (you can also delete your account in Settings, or by email),
limit or stop some uses of your data,
send your data to you or another service in a usable format.

You can withdraw permission to read steps at any time in your health app. Email admin@playpacepot.com to use any of these rights, and we'll reply within 30 days. If you're unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission.

09Children

PacePot is only for people aged 18 and over. If we learn that an account belongs to someone younger, we'll close it and delete their data.

10Our website

playpacepot.com doesn't use advertising or tracking cookies, and it loads its fonts from our own server.

11Changes to this policy

We'll update this policy when what we collect or how we use it changes, and change the date at the top. We'll tell you in the app before an important change takes effect.

12Contact

PACEPOT LTD
Email: admin@playpacepot.com
Website: playpacepot.com