1. Who we are
Ibile Hub is operated by Ibile Hub Games and Media Limited (CAC registration number RC9813581). In these documents, “we”, “us” and “our” mean Ibile Hub Games and Media Limited and “Ibile Hub” is the name of the service.
This policy explains how Ibile Hub (“we”, “us”) handles personal information when you use our games, Stories (our comics), the wallet, the Android and iOS apps, this website and ibile.games/wallet (the “Service”). We are the data controller for the information described here. Our approach follows the Nigeria Data Protection Act 2023 (the “NDPA”) and the regulations and guidance issued under it by the Nigeria Data Protection Commission (the “NDPC”).
You can reach us about anything in this policy at [email protected].
2. The short version
- We collect what we need to run your account, your games, your Stories and your wallet, and to keep play fair and safe.
- We don't sell your personal information and we don't share it with advertisers. We don't show ads.
- We don't send marketing emails. Our emails are about your account.
- Other players can see your display name, avatar, ratings and results. They can't see your email, balances or payments.
- We never see or store your full card number.
- You can download your data, correct it, and delete your account from the app. Some financial records must be kept, and we explain which.
- Ibile Hub is for people aged 18 and over.
3. What we collect
Some of this you give us, some is created when you use the Service, and a little comes from your device or from payment providers.
| What | Examples |
|---|---|
| Account | Your email address; your date of birth (to confirm you are 18 or over); your display name and username; your avatar (a preset, or a photo you upload); a backup email address if you add one, and whether you have confirmed it. |
| Sign-in and security | Sign-in codes (kept only in a scrambled form that can't be turned back into the code, and expiring after a few minutes); records of where you are signed in; a device or browser identifier; the time of each sign-in; and the IP address your connection comes from, used to stop things being done too fast, spot abuse and alert you to a new device. |
| Gameplay | The matches you play and their results; ratings per game; statistics, achievements and badges; daily-reward streaks and missions; Season Pass progress; saved and in-progress games; tournament entries; the items you own and equip. |
| Stories and reading | The series you follow; the chapters you have unlocked or opened and how you unlocked them; your reading progress and streak; chapters you have downloaded; the reactions you leave; puzzles and clues you have solved. |
| Wallet and payments | Your Coin and Cowrie balances and a record of every change to them (top-ups, purchases, unlocks, rewards, gifts, corrections); for each top-up, the amount, the payment method type, the provider, the result and the payment reference; any refund or reversal. Payment providers and app stores collect your card, bank or store account details directly. We never receive your full card number. |
| Social | Your friends and friend requests; messages you send and receive; gifts; referral codes you share or use; reports and blocks. |
| Responsible-play settings | Any top-up, spending or time limit, reminder or break you set, and when it changes. |
| Usage and diagnostics | Events about how the Service is used, such as screens viewed, matches started and finished, store views, chapters opened and top-ups started, each with your account identifier, platform (Android, iOS or web), app version and the time; and crash and performance information. We reject any event that contains an email address, phone number or card detail. |
| Notifications | If you allow notifications, a code that lets us send them to your device, and your notification choices. |
| Support and communications | Messages you send us, the details you give us, and our replies. |
We don't collect your contacts, your precise location, your photos (other than an avatar you choose to upload), your microphone or your camera. We don't collect sensitive categories of personal data such as health, religion or political views, and we ask you not to put them in your display name, avatar or messages.
4. How we use it, and why
The NDPA requires us to have a lawful basis for each use. These are ours.
| Purpose | Lawful basis |
|---|---|
| Providing the Service: signing you in, running matches, calculating ratings and leaderboards, saving games, delivering chapters, keeping your wallet and items, and powering friends, messages and gifts. | Performing our contract with you. |
| Processing payments and crediting what you buy; investigating failed, duplicated or disputed payments; handling refunds and chargebacks (when you ask your bank to reverse a payment). | Contract; legal obligation; legitimate interests. |
| Service messages: sign-in codes, new-device alerts, receipts, confirmations of limit changes, gift and referral notices, support replies, and your data export. | Contract; legitimate interests. |
| Push notifications such as “it's your turn” or “a new chapter is out”. | Your consent, which you can withdraw in the app or on your device. |
| Keeping play fair and safe: preventing cheating, fraud and abuse; moderating messages and names; enforcing our Terms; and applying the responsible-play limits you set. | Legitimate interests; legal obligation; contract. |
| Confirming your age and eligibility. | Legal obligation; legitimate interests. |
| Improving the Service: understanding what works, what breaks and where players get stuck, and tuning rewards, prices and how Coins and Cowries work. | Legitimate interests. |
| Paying creators and licensors: we use aggregate reading and unlock figures, not your identity, to report to the creators of Stories. | Legitimate interests; contract. |
| Meeting legal obligations: keeping financial records, responding to lawful requests, and defending legal claims. | Legal obligation; legitimate interests. |
Where we rely on legitimate interests, we have weighed them against your rights and interests, and you can object (see “Your rights”). We don't use your personal information for advertising, and we don't profile you to sell you things. We may use aggregated or anonymised information that can't identify you for any purpose.
5. Automated decisions
Some decisions are made automatically, by software rather than by a person. These include working out match results and ratings, applying earning limits and responsible-play limits, checking payments for fraud, and flagging or restricting an account that appears to be cheating or misusing Coins, Cowries or rewards. We don't make decisions that have legal or similarly significant effects on you based solely on automated processing without a route to a person. If an automated decision affects you, such as a restricted account or a cancelled result, email us and a person will review it.
6. What other players see
Your display name, username, avatar, equipped looks, ratings, statistics, achievements, Stories badges, streaks and match results can be seen by other players, on leaderboards, public profiles and friend suggestions, and by friends you play with. Your email addresses, date of birth, balances, transactions, reading history and responsible-play settings are never shown to other players. Messages are visible only to you and the friend you are talking to, and to us if a message is reported or flagged. Reactions on a chapter are counted and may be shown as totals, not as a list of who reacted.
7. Who we share it with
We share personal information only as needed to run the Service, and only with:
| Who | Why |
|---|---|
| Payment providers: Paystack and, when Paystack is unavailable, Flutterwave | To take and confirm payments. They receive the amount, your email address and the details you enter at their checkout, and they send us the result. They are independent controllers of the payment details you give them and have their own privacy notices. |
| App stores: Google Play and the Apple App Store | If you pay through a store, the store processes the payment and tells us the result. We don't receive your store payment details. |
| Cloudflare | To protect the sign-in form from automated abuse (Cloudflare Turnstile) where it is switched on, and for network protection. Turnstile may process your IP address and browser details. |
| Google Firebase | To deliver push notifications (Firebase Cloud Messaging) and to store avatar photos you upload. |
| Email delivery provider | To send sign-in codes and other service emails. |
| Hosting, storage and content-delivery providers | To run Ibile, store our data and deliver chapters and game files securely. |
| Professional advisers and auditors | Lawyers, accountants and auditors, under duties of confidentiality. |
| Authorities | Courts, regulators and law-enforcement agencies where the law requires it, or to protect players, ourselves or others from serious harm or unlawful conduct. |
| A successor | If the Service or our business is sold, merged or restructured, the new owner may receive your information and must honour this policy. |
These providers act on our instructions and are bound by contract to protect your information, except where we say they are independent controllers. We do not sell your personal information and we don't share it with advertisers or data brokers. We don't give creators or licensors your personal information.
8. Transfers outside Nigeria
Some of our providers store or process information outside Nigeria, including in the European Economic Area, the United Kingdom and the United States. Where information leaves Nigeria, we make sure it is protected as the NDPA requires, for example by choosing providers in countries with adequate protection or by putting in place contractual safeguards, and by limiting what is sent.
9. How long we keep it
| What | How long |
|---|---|
| Account information, gameplay, Stories and social data | While your account is open. When you delete it, we erase your profile, display name, avatar, backup email, date of birth, settings and achievements straight away. |
| Wallet and payment records | Kept after deletion. The record of Coin and Cowrie movements and of payments is a financial record that is only ever added to, never rewritten, and we need it for accounting, tax, fraud prevention, dispute resolution and legal compliance. We keep it for as long as the law and those purposes require, and then delete it or anonymise it. |
| Match results and ratings | Remain in other players' match histories and on leaderboards after you delete your account, shown as “Deleted account”, with nothing that identifies you. |
| The link between your sign-in address and a deleted account | Kept in a one-way form so a deleted account can't be reopened or taken over and so that deleted-account fraud can be recognised. |
| Sign-in codes | Minutes. They expire and are kept only in scrambled form. |
| Records of where you are signed in, and device records | While you are signed in, and for a short period after you sign out so we can spot abuse. |
| Messages | While both accounts exist, unless reported. Reported messages are kept as long as needed to deal with the report. |
| Usage and diagnostic events | Only as long as we need them to run and improve the Service, and then deleted or aggregated. |
| Support emails | For as long as needed to help you and to deal with any follow-up, and no longer than the related financial or legal records require. |
| Records we are legally required to keep, or need to defend a claim | For as long as the law requires or the claim can be brought. |
10. Your rights
Under the NDPA you have the right to:
- Be informed about how we use your information. This policy is part of that.
- Access the personal information we hold about you and get a copy.
- Correct information that is wrong or incomplete.
- Delete your information, subject to the records we must keep (see “How long we keep it”).
- Restrict how we use your information in some situations.
- Receive it in a portable form: a structured, commonly used, machine-readable copy that you can take elsewhere.
- Object to processing based on our legitimate interests, and to any direct marketing.
- Withdraw consent at any time where we rely on it, such as for push notifications. This doesn't affect what we did before.
- Not be subject to a decision based solely on automated processing that significantly affects you, and to ask for a person to review one.
- Complain to the Nigeria Data Protection Commission.
How to use them. In the app, under Settings → Account:
- Download my data emails you an export of your profile, settings, date of birth, statistics, ratings, achievements, match history, missions, Stories activity, balances and transaction history. It is sent to your confirmed backup email, so add and confirm one first.
- Delete account erases your profile and signs you out everywhere, as described above. We email a code to your sign-in address to confirm it is you. It is immediate and permanent, and any remaining Coins, Cowries and items are lost.
- You can change your display name, avatar and backup email at any time.
For anything else, email [email protected] from your sign-in address. We may need to confirm it is you before we act. We aim to respond within 30 days, and sooner for simple requests. We don't charge for requests, unless they are clearly unfounded or excessive, in which case we may charge a reasonable fee or decline, and tell you why.
11. Your choices
- Notifications. Switch categories on or off in Settings → Notifications, or in your device settings. Quiet hours are on by default.
- Marketing. We don't send marketing emails today. If we ever do, we will ask for your consent first and every message will have an unsubscribe link.
- Waitlist. If you gave us your email on our website to hear about the launch, we use it only to tell you about the launch and to ask you to sign up. Ask us to delete it at any time.
- Responsible play. You can limit your spending and time, or take a break, in Settings.
12. Cookies and local storage
Our public website doesn't use advertising or analytics cookies. When you sign in to the web wallet or reader, we set a small number of strictly necessary cookies to keep you signed in securely, and the apps store a few things on your device so they work as you expect. The details, including each cookie's name and lifetime, are on our Cookies page.
13. Security and breaches
We protect your information with measures that include encrypted connections; sign-in codes kept in scrambled form; the code that keeps you signed in kept out of reach of web scripts (a protected cookie on the web, secure storage in the apps); protection against other websites acting in your name; sign-ins tied to your device; alerts when a new device signs in; secure, short-lived links for paid content; access to production data limited to people who need it and recorded; payment details handled only by our payment providers; and our own passwords and keys kept in a secure vault. No system is perfectly secure. If a breach is likely to put your rights and freedoms at risk, we will tell you without undue delay and will notify the NDPC within the time the NDPA requires, which is currently 72 hours. You can help by keeping access to your email secure and by never sharing your sign-in code. We will never ask for it.
14. Children
Ibile Hub is only for people aged 18 and over. We don't knowingly collect information from anyone under 18. If you believe a child has created an account, email us and we will close it and delete their information.
15. Changes to this policy
We may update this policy as the Service and the law change. We will post the new version here with a new date. For significant changes, we will tell you in the app or by email before they take effect, and where we need your consent for a new use, we will ask for it.
16. Contact and complaints
Questions, requests or concerns about your information: [email protected]. We would like the chance to put things right first. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng) at any time.