Privacy Policy

Show Up is built to get you out of the house and into a real place with a real person. We collect only what we need to make that work, and we never sell your data. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use the Show Up mobile application, website, and related services (together, the "Service").

1. Who we are

Show Up ("Show Up", "we", "us", "our") operates the mobile application and website at weshowup.app from Abuja, Nigeria. We are the data controller responsible for your personal data. This policy is issued under the Nigeria Data Protection Act (NDPA) 2023 and other applicable data protection laws.

For privacy questions, contact our Data Protection Officer at [email protected].

2. Where this policy applies

This policy applies to all services operated under the Show Up brand, including the mobile app (iOS and Android), the website at weshowup.app, and any related services, communications, or events. If a specific feature has its own supplementary privacy notice, that notice will govern together with this policy.

3. Data we collect

3.1 Data you provide to us

3.2 Data generated or automatically collected

3.3 Voice notes - special handling

Voice notes are encrypted on your device before upload using a key derived from your match session. We store only ciphertext on our servers. We do not hold the decryption key - only your match's device can decrypt and play the audio. Voice notes are deleted when the associated match is fully resolved. See Section 9 (Data retention) for details.

3.4 Data about others

If you use the "find friends" feature, we process hashed phone numbers from your device contacts. If you report another user, you may provide information about them. We treat data about others in accordance with this policy.

3.5 Data from third parties

If another user reports you or provides feedback about a meetup with you, we may receive information about you. We may also receive information from service providers that help us detect fraudulent or abusive behaviour.

4. How we collect data

• Directly from you - when you create an account, edit your profile, send messages, create collections, leave tips, submit feedback, or contact support.
• Automatically - when you use the Service, through server logs, WebSocket connections, and essential operational data.
• From your device - location data (with your permission), contacts (if you enable the feature), push notification tokens, and a hashed device fingerprint for security and hardware-ban enforcement.
• From other users - reports, blocks, and meetup feedback involving you.
• From service providers - mapping services, verification providers, and infrastructure partners.

5. How we use your data

6. Legal bases for processing

We process your data on the following legal grounds, depending on the type of data and the purpose:

• Contractual necessity - to provide the Service you have requested, including creating your account, matching you, delivering chat and voice notes, and operating the reliability system.
• Consent - where you have given clear consent, such as for accessing your device contacts, sending push notifications, or processing precise location data. You can withdraw consent at any time through device settings or the app.
• Legitimate interests - where processing is necessary for our legitimate interests or those of a third party, and your rights do not override those interests. This includes: improving and securing the Service; analysing usage trends; preventing fraud and abuse; enforcing our Terms and Community Guidelines; and responding to user reports.
• Legal obligation - where we need to comply with a legal or regulatory obligation, such as responding to a valid law enforcement request or retaining data for tax or accounting purposes.
• Vital interests - where processing is necessary to protect someone's life or physical safety, such as in an emergency.

7. Who we share data with

We do not sell your personal data. We do not share your data with advertisers. We share limited data only as described below:

7.1 With other users

7.2 Service providers

We share limited data with third-party service providers who help us operate the Service. They process data only on our instructions, under contract, and for the specific purposes described:

• SMS & WhatsApp provider - to send verification codes.
• Email provider - to send verification codes, notifications, and service emails.
• Mapping services - Google Maps and Apple Maps, to display locations, search for places, and provide directions. Your use of these services is also subject to their respective privacy policies.
• Hosting & infrastructure - to run the Service, store data, and deliver push notifications.
• Real-time infrastructure - to deliver chat messages, voice note metadata, and Instant Meetup updates in real time via WebSocket connections.
• Analytics - to understand how the Service is used and identify issues. We use privacy-respecting analytics; no advertising identifiers are collected.

7.3 Legal & safety disclosures

We may disclose data where required by law, such as in response to a valid court order, subpoena, or law enforcement request. We may also disclose data to protect the rights, property, or safety of Show Up, our users, or the public - for example, in an emergency, or to detect and prevent fraud or abuse. Where permitted by law, we will notify you of such disclosures.

7.4 Business transfers

If Show Up is involved in a merger, acquisition, reorganisation, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

7.5 Aggregated or de-identified data

We may share aggregated or de-identified data that cannot reasonably identify you for research, reporting, or service improvement purposes.

8. Cross-border data transfers

Show Up is based in Nigeria, and our servers are located in the European Economic Area (EEA) and the United States. Your data may be transferred to and processed in countries other than your country of residence. When we transfer data across borders, we ensure appropriate safeguards are in place - such as standard contractual clauses approved by relevant data protection authorities - to protect your data to the standard required by applicable law.

If you are in the EEA, UK, or Switzerland, we rely on European Commission adequacy decisions or standard contractual clauses for transfers to countries without an adequacy decision. You may request a copy of these safeguards by emailing [email protected].

9. Data retention

We keep your data only as long as needed for the purposes described in this policy:

After the retention period, data is deleted or irreversibly anonymised. We may retain de-identified or aggregated data indefinitely for service improvement and research.

10. Your rights & choices

10.1 Access, correction & deletion

Depending on your jurisdiction, you may have the right to:

• Access your personal data and obtain a copy.
• Correct inaccurate or incomplete data.
• Delete your data ("right to erasure").
• Object to processing based on legitimate interests.
• Restrict processing in certain circumstances.
• Data portability - receive your data in a structured, machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Opt out of targeted advertising or the "sale" or "sharing" of data (as defined by applicable US state laws), though Show Up does not sell data or use targeted advertising.

You can exercise many of these rights directly in the app - edit your profile, adjust Discovery visibility, manage notification preferences, control location permissions, or delete your account. For requests that cannot be completed in-app, email [email protected]. We will respond within the timeframe required by applicable law. We may need to verify your identity before fulfilling certain requests.

10.2 Device permissions

You can control the following through your device settings at any time:

• Location - disable to stop sharing location data. Core matching requires neighbourhood-level location; precise location is only used for Discovery radar.
• Contacts - disable to prevent the "find friends" feature from accessing your address book.
• Push notifications - disable to stop receiving push notifications from Show Up.

10.3 Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority. In Nigeria, this is the Nigeria Data Protection Commission (NDPC). In the EEA, you may complain to your national Data Protection Authority. In the UK, you may complain to the Information Commissioner's Office (ICO). We encourage you to contact us first so we can try to resolve your concern.

11. Cookies & tracking

Our website uses essential cookies for security and functionality. We do not use advertising cookies, tracking cookies, or third-party analytics cookies on our website. The mobile app uses only essential device identifiers (such as push notification tokens) to deliver the Service. See our Cookie Policy for details.

12. Automated decision-making

We use automated systems to suggest matches based on your vibe tags, interests, availability, and location. These systems assist but do not make final decisions - you always decide whether to accept or pass on a match. Our reliability system automatically applies strikes for cancelled meetups and pauses matching when strike thresholds are reached. If you believe an automated decision has significantly affected you, you may request a human review by contacting [email protected].

13. Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit - all communications between the app and our servers use TLS.
• End-to-end encryption for voice notes - encrypted on your device before upload; we store only ciphertext and do not hold decryption keys.
• Hashed verification codes - one-time codes are hashed before storage.
• Access controls - strict internal access policies; only authorised personnel can access production data.
• Infrastructure security - servers are hosted with reputable providers and follow industry best practices.

No system is perfectly secure. If we become aware of a data breach that affects your personal data, we will notify you and relevant authorities as required by law.

14. Children's privacy

Show Up is for adults only. You must be 18 years or older to create an account. We do not knowingly collect or process data from anyone under 18. If we learn that someone under 18 has created an account, we will terminate it immediately and delete their data. If you believe a user is under 18, please report them through the in-app tools or email [email protected].

15. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will update the "Last updated" date above and provide additional notice - such as an in-app notification or email - before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree, you must stop using the Service and delete your account.

16. Contact & complaints

For users in the EEA, UK, or Switzerland, you may also contact our representative: [email protected].