Privacy Policy

1. Who we are

Konqua runs the Konqua app and the apps inside it, including Trenches Troopers and Konqua Bank, and is the data controller for your personal data. We follow the Nigeria Data Protection Act 2023 (NDPA). This policy explains what we collect, why, who we share it with and the choices you have.

Questions, requests or complaints? Email us at support@konqua.com. We aim to reply within 30 days.

2. What we collect

Account details:

• username and display name
• password and Konqua Bank PIN, stored only as one-way hashes that can’t be turned back into the original
• email address, and your Google account ID if you sign in with Google
• your avatar, outfits and gear
• when you joined and when you were last active

Game and Konqua Bank activity:

• coins, XP, rank, kills, deaths, wins and the items you own
• your Konqua Bank statement, including coin transfers, who they were to or from, and any note you added
• match records: mode, map, length and number of players

Social:

• your contacts, friend requests and blocked players
• direct messages, your Comms posts and your thumbs up or down
• who invited you, if you joined from an invite link

Voice: if you turn on your mic in a match, your voice is sent through our server live to players near you. It is not recorded or stored.

Real money, if offered and you use it: your date of birth and country, the coins you buy and cash out, money-match stakes and results, the bank details you give for cash-outs, and payment references from our payment partner. We also log each money action (like a purchase, a cash-out or an ID check) with the time and the IP address it came from, to stop fraud.

Identity check, before your first cash-out: depending on the check, either you scan a Nigerian ID and take a live selfie on our identity-check partner’s page, or you give your NIN and the partner looks it up in the NIMC records. From the result we keep: the name and date of birth on the record or ID, the type of document, whether the check passed and why not, and the ID number (your NIN when the ID shows it) as a one-way scrambled code plus its last 4 digits. The code, with the name and date of birth, is how we stop one person verifying two accounts. We never receive your ID photos or selfie. The partner handles them under its own privacy policy.

If you advertise: your business contact details (phone, WhatsApp or email), your ad text, images and links, bookings, quotes and payment status.

Ad counts: for each ad we count daily views and clicks, and note which accounts saw a campaign each day so we can count unique reach and avoid showing you the same sponsored notification too often. Advertisers only see totals, never who you are.

Technical: your IP address (used to stop abuse and limit too many requests; we save it in our database only with money actions, as above, but our hosting provider may keep it in short-lived server logs), basic browser information needed to load the app, a random visitor ID in your browser for counting daily visits, and a record of which days your account was active.

Analytics and session recordings (PostHog): which screens and apps you open, buttons you tap, errors the app hits and messages it logs, your device and browser type, screen size, approximate location worked out from your IP address, and recordings of the screen while you use Konqua (on stronger phones, this includes a few low-quality frames per second of the game). When you’re signed in, these are linked to your account ID, username, display name, level, rank and when you joined. We never send PostHog your password, PIN, email, real name or ID details. Everything you type is masked in recordings, private messages and chat previews are hidden, and recordings don’t include network requests or their contents.

Unless you cash out, we don’t ask for your real name or ID. We never ask for your phone contacts or your precise location, and we don’t use advertising trackers.

3. Why we use it

Under the NDPA we need a lawful basis for each use:

• To run your account, the game, Konqua Bank, chat, friends and invites, because that is the service you asked for (contract).
• To keep the game fair and safe, stop cheating, fraud and abuse, moderate chat, find and fix bugs, and understand how the Service is used so we can improve it (including with analytics and session recordings), because we have a legitimate interest in doing so. You can object to analytics at any time (see section 9).
• To verify your email address (with a code we email you, or through Google sign-in) and to use your microphone, because you chose to (consent). You can remove your mic permission in your browser at any time.
• To check your age before you use real money, to verify your identity before you cash out, and to keep money records, because the law requires it (legal obligation) and to stop fraud and money laundering (legitimate interest).
• The live selfie and face match in an ID check use biometric data, which the NDPA treats as sensitive. Our partner processes it only with your explicit consent, which you give when you start the check (consent).

An ID check is decided automatically by our partner. If it turns you down, you can contact us and a person at HQ will look at it. We don’t make any other decisions with legal or similarly big effects on you using automated processing alone.

4. Who can see your data

• Other players: your display name, username, avatar and outfit, rank and stats, coin total on the Leaderboard, and your Comms posts. Direct messages go only to the player you send them to.
• Advertisers: only totals (views, clicks, reach), never your identity.
• Service providers who work for us under contract: cloud hosting and database providers (currently Render and Turso); Google, if you sign in with Google: it confirms your email address and tells us your Google account ID and email, and nothing else; Resend, which delivers our emails (your email address and the email we send you); PostHog, our product analytics service (data held in the EU), which receives the analytics and recordings described in section 2; for real money, our payment partner; and for cash-outs, our identity-check partner (currently Didit, which runs the ID scan and selfie, or Dojah, which looks NINs up in the NIMC records).
• Authorities, when the law requires it, or to protect the safety and rights of players or us.
• A business that takes over the Service, which must keep protecting your data as this policy says.

We never sell your personal data.

5. Data sent outside Nigeria

Our servers and providers may be outside Nigeria (for example in the United States or Europe). When we transfer data abroad, we rely on the safeguards the NDPA allows, such as adequate protection in the receiving country or contract terms with the provider.

6. How long we keep it

• Guest accounts with fewer than 3 matches, unused for 30 days: deleted automatically, with their contacts, messages and statement.
• Sign-in sessions: end after 90 days or when you sign out.
• Sponsored notification records: 7 days.
• Analytics events and session recordings in PostHog: kept for up to 12 months, then deleted.
• Saved accounts: while your account is open.

When you ask us to delete your account, we delete or anonymise your data within 30 days. We may keep some records for longer where the law requires it (like payments, cash-outs and identity checks) or to settle disputes and stop fraud. Anonymous totals, like daily match counts, may be kept.

7. Children

Konqua is for players aged 13 and over. Players under 18 need a parent or guardian’s permission. Buying coins, money matches and cashing out are for adults only. We use the date of birth you give (and the one your ID check confirms) to block anyone under 18, and keep it so the check can’t be bypassed.

If you’re a parent or guardian and think your child under 13 is using Konqua, or you want to review or delete your child’s data, contact us and we’ll help.

8. Security

We use HTTPS, store passwords, PINs, NINs and ID numbers as one-way hashes (NINs and ID numbers with a secret key, so they can’t be guessed back), keep the sign-in cookie out of reach of page scripts, and limit who at HQ can access personal data. No system is perfectly secure, so keep your password and PIN to yourself.

If a breach puts your rights at high risk, we will tell the Nigeria Data Protection Commission within 72 hours and tell you without undue delay, as the NDPA requires.

9. Your rights

Under the NDPA you can:

• get a copy of your personal data;
• correct data that is wrong (you can change your display name and verify or change your email in Settings);
• ask us to delete your data;
• ask us to limit or stop using your data, or object to how we use it;
• get your data in a common, machine-readable format to move it elsewhere;
• withdraw consent you gave, without affecting what we did before;
• object to analytics and session recordings, and ask us to delete what PostHog holds about you; and
• complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

To use any of these rights, email support@konqua.com with your username. We may ask you to prove the account is yours. We reply within 30 days.

You can also stop analytics yourself: content and tracker blockers in most browsers block PostHog, and Konqua keeps working without it.

10. Changes to this policy

If we make an important change, we’ll tell you in the app. The version and date are at the top.

11. Contact

Questions, requests or complaints? Email us at support@konqua.com. We aim to reply within 30 days.