Who we are
TrovaStep is operated by GhostAxis in Nigeria, which is the data controller for the TrovaStep mobile app and the website at trovastep.ng. This notice applies to both.
Information you provide
- Account: your Nigerian phone number, a username, and confirmation that you are 18 or older.
- Challenges: challenges you create or join, invitations you share, and your chosen entry amounts.
- Payout details: the bank and account number you save, and the account name your bank returns.
- Support: anything you send us when asking for help.
Card and bank-transfer payments are entered on Paystack's checkout. We never see or store your full card number.
Device and usage information
We record an app install identifier, phone model, operating-system and app version, sign-in times, crash reports, and device-integrity results from Google Play Integrity or Apple App Attest. We also record in-app events such as opening a challenge, identified only by an internal ID, never by your phone number or name.
Health and step data
With your permission, we read step counts, and the time and source app of each record, from Health Connect or Apple Health, or from your phone's step counter. We read up to 30 days of history to set your baseline goal. We do not read location, heart rate, weight or any other health type, and we do not use health data for advertising.
You can withdraw step permission at any time in Health Connect or the Health app. Without it, you can browse but cannot take part in challenges.
How we use it
- To create your account and sign you in by SMS or WhatsApp code.
- To set fair goals, score each challenge day and settle results.
- To take entries, pay out winnings and keep accurate financial records.
- To detect cheating, shared accounts and payment fraud.
- To send challenge reminders between 06:00 and 21:00 WAT, which you can switch off.
- To fix bugs, answer support requests and improve the app.
Legal bases and consent
Under the Nigeria Data Protection Act 2023, we process account, challenge and payout data to perform our contract with you; financial records to meet legal obligations; fraud and security data under our legitimate interest in fair challenges; and health data only with your explicit consent, which you can withdraw at any time without affecting earlier processing.
Who we share it with
We do not sell personal data. We share only what each provider needs:
- Paystack for collecting entries, verifying bank accounts and sending payouts.
- SMS and WhatsApp messaging providers to deliver sign-in codes.
- Our cloud hosting and database provider to run the service.
- Sentry for crash and error reports.
- Google and Apple for device-integrity checks and push notifications.
Other challenge members see your username, daily progress and result. We may disclose data where the law requires it.
International transfers
Our servers are in London, United Kingdom, and some providers process data in the UK, the EU or the United States. We rely on the adequacy and contractual safeguards recognised under the Nigeria Data Protection Act.
Retention
- Account, step and health data: until you delete your account.
- Payment and payout records: six years, as required by Nigerian tax and financial rules.
- Fraud-review records: 180 days, then kept only in aggregate.
- Sign-in codes: 10 minutes. Crash reports: 90 days. Backups: 35 days.
Security
Data is encrypted in transit and at rest. Sign-in codes are stored hashed, sessions are tied to your install and expire, and financial records cannot be edited once written. Access is limited to the people who run the service. No system is perfectly secure, and we will notify you and the regulator of a breach as the law requires.
Your rights
You can ask to access, correct, move or delete your data, object to or restrict some processing, and withdraw consent. Email privacy@trovastep.ng. We respond within 30 days and may first confirm your identity with a code to your phone.
Account deletion
Delete your account in the app under Profile, then Settings, or by email. See account deletion for what is removed and what we must keep.
Children
TrovaStep is for people aged 18 and over. We check age at sign-up and delete any account we learn belongs to someone younger.
This website: cookies and telemetry
trovastep.ng sets no cookies, runs no analytics and loads nothing from third parties. Our host may keep standard server logs, such as IP address and page requested, for up to 30 days for security.
Changes to this notice
We will update the effective date above when this notice changes, and tell you in the app before any significant change takes effect.
Complaints
Please contact us first so we can put it right. You can also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
Contact
Privacy questions: privacy@trovastep.ng. Everything else: Support.