About this policy
ShineEye helps people across Nigeria stay informed about nearby community reports. This policy explains the personal information we handle, why we use it, who may receive it and how you can exercise your rights. ShineEye is operated by TECHWITHLEE, which is responsible for determining how personal information is used for the service. Privacy and data requests: support@shineeye.ng. ShineEye is not an emergency service. In an emergency in Nigeria, call 112 or contact the appropriate emergency service directly.
Information we handle
Account information includes your phone number, account identifier, verification and security records, and profile information you choose to provide. Phone verification helps us protect accounts and reduce misuse. It does not establish that a report is true. Location information includes the device location used to show nearby reports or check eligibility to respond, the incident location you confirm when submitting a report, and location information used for nearby notifications. Location checks may include accuracy and capture time. Public incident locations are generalised or displaced for safety; authorised systems may process more precise coordinates. Reports and activity include incident categories, descriptions, report times, photos, videos, supporting voice notes, community responses, followed incidents, updates and moderation history. Guest responses use an app-installation reference, your response, the relevant alert and time, and proximity or accuracy information. The service stores a hashed version of the installation reference for response management and abuse prevention. Guest responses are separate from signed-in votes. An eligible response may be associated with your account after phone verification and fresh eligibility checks. A hashed reference is not a guarantee of anonymity. Device and service information includes notification registration identifiers, preferences, app-integrity checks and technical information used to operate and secure the service. Hosting and network services may process IP addresses and request information. We also handle the information you send when requesting support, reporting prohibited content or asking to exercise a privacy right. We may receive information about you from another person's incident report or evidence. This may include information about a victim, witness, child or person alleged to be involved in an incident. Contact us if a report contains inaccurate or unnecessarily identifying information about you.
How and why we use information
We use information to provide accounts, accept and display reports, show relevant locations, manage community responses and follows, deliver notifications, moderate content, prevent misuse and respond to requests. Automated checks help assess proximity, apply submission limits, identify possible duplicates, determine notification eligibility and support report status decisions. For account creation and the reporting, response and follow features you request, we rely on performance of our agreement with you where the processing is necessary to provide those features.
Where a location or other optional use requires consent, we seek it separately. For proportionate security checks, fraud prevention and moderation, we rely on a documented legitimate interest balanced against your rights, unless consent or another basis is required. We rely on legal obligation for processing required by an applicable law or binding legal demand. Information about children and sensitive personal information requires an additional applicable legal condition; an ordinary service agreement does not remove that requirement. Device permission and legal consent are related but different. Granting a camera or location permission does not authorise every possible use of that information. Where we rely on consent, you can withdraw it through the relevant setting or by contacting us. Withdrawal does not make earlier lawful processing unlawful. We do not sell personal information.
Location and notifications
ShineEye uses location to identify nearby information and check participation eligibility. When enabled, the service stores a last-known location and notification preferences to decide which nearby alerts to send. Stored location may become outdated, so notification relevance can change as you move. Push notifications can arrive while the app is closed. This does not, by itself, mean the app is continuously collecting your location. You can manage permissions in your device settings and available notification controls in ShineEye. Turning off a permission may prevent features that need it from working.
Media and evidence
When you choose to capture or select media, ShineEye uses the camera, microphone or system media picker needed for that action. Selected media is uploaded as part of your report. Photos, voices, clothing, landmarks and descriptions may identify people even when names are omitted. Only submit material you have a lawful right to share. Do not upload unnecessary personal details or prohibited content. Signing in to view evidence does not make that evidence private or prevent another viewer from recording it.
Who can see information
Other users and public visitors can see the report information made available under ShineEye's access rules. Reporter identity is not displayed in public alert views, but a report's contents can still reveal who submitted it or who is involved. Some evidence is available only to eligible signed-in users. Authorised TECHWITHLEE personnel may access information needed for moderation, security, support and service operation. Service providers process information for functions such as authentication, hosting, databases, private media storage, maps, messaging and notifications. Current infrastructure includes Google Firebase and Google Cloud, with Cloudflare R2 used for evidence storage. When Firebase phone authentication is used, Google receives and stores the phone number for authentication and spam or abuse prevention across its services, as described in Google's documentation. We may disclose information where required by law or where a lawful, necessary disclosure protects a person, addresses abuse or establishes, exercises or defends a legal claim. Posting an alert does not automatically contact the police or another responder.
International processing and security
Some providers process information outside Nigeria. Google services may use international infrastructure, including US-based Firebase Authentication. Service locations differ by product and configuration; an API region is not the location of every related record. International transfers must have an applicable basis and safeguards under Nigerian data protection law. You can contact us for information about the safeguards relevant to your data. We use access controls, encrypted network connections and private media storage to help protect information. No service can guarantee complete security. Where a personal data breach triggers notification duties, we will notify the regulator and affected people as required by law.
Retention and account deletion
We keep personal information only for as long as needed for its identified lawful purpose. Closing an alert or removing it from an active feed is not the same as deleting its stored data. When completing an approved deletion request, we delete your account and associated personal information unless a specific, lawful retention exception applies. Disabling sign-in alone is not completed deletion. Necessary exceptions can include records required for a legal obligation, a defined abuse investigation or a legal claim. An exception must be limited to the relevant information and purpose, with restricted access and a documented retention or review period. We explain any material exception affecting your request unless law prevents us from doing so. Information that has been genuinely anonymised may remain because it no longer identifies you. Removing your name or replacing it with an identifier does not, by itself, make a record anonymous. Deletion can also involve provider systems and backup copies. We explain relevant completion times and remaining restrictions when responding to your request. We do not treat backups as a reason to keep identifiable information indefinitely. You can start a request through Profile → Privacy → Delete account / data, or email support@shineeye.ng without reinstalling the app. See the account deletion page for instructions.
Your choices and rights
Subject to applicable conditions, you can ask us to confirm whether we process information about you, provide access or a copy, correct inaccurate information, delete information, restrict processing or consider an objection. Where the law provides for portability, you can request your information in a suitable electronic format. You can withdraw consent for processing based on consent. You may also ask for an explanation of automated processing affecting you and challenge a decision where applicable. Contact support@shineeye.ng and identify the relevant report or decision. We may need proportionate information to verify your identity and protect other people's privacy. Do not send a one-time verification code or suspected abuse material. We respond without unreasonable delay and within applicable legal requirements. If we cannot fully grant a request, we explain the reason and available next steps, unless the law prevents disclosure. You can complain directly to the Nigeria Data Protection Commission through https://ndpc.gov.ng. You do not need our permission to contact the regulator.
Children and sensitive reports
Accounts and alert submission are for people aged 18 or older. Reports may nevertheless concern children or other vulnerable people. We apply additional care to such information and assess requests to remove identifying material.
Do not publish a child's home address, school, private contact details or unnecessary images. Where processing relies on parental or guardian consent, it must be valid; where another legal exception applies, it must actually be satisfied. A reporter's acceptance of these terms does not waive another person's rights. Child sexual abuse and exploitation and child sexual abuse material are prohibited. Follow our child safety standards when reporting a concern. Do not send abuse material to support.
Website information and policy changes
Our website and hosting services process technical information needed to deliver and protect pages. Where cookies or similar tools require consent, a privacy policy does not replace the required consent mechanism. Any optional analytics or advertising tools must be identified and disclosed before they are enabled. We update this policy when our practices or applicable requirements change. Material changes receive a new effective date and notice where required. Editorial corrections may carry a separate revision date.