Privacy Policy

1. WHO WE ARE

Spektt is a creative community platform built for photographers, videographers, 3D animators, sound engineers, digital artists, and other creatives.

• Legal Entity: Axlume Tech Limited
• Registration: Corporate Affairs Commission (CAC), Federal Republic of Nigeria
• Tax Identification Number: 2623715363203

Contact:

• General: hello@spektt.com
• Support: support@spektt.com
• Privacy requests: legal@spektt.com (subject line: "Privacy Request")
• Website: spektt.com

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

Account & Identity

• Full name and username (unique handle)
• Email address and password (password is hashed by Firebase Authentication — we never store it in plain text)
• Profile photo (avatar)
• Date of birth (required for age verification, Showdown eligibility, and legal compliance)
• Creative category / role (e.g., photographer, videographer, 3D animator)
• Location display text (the city or region you choose to show on your profile)
• Country and region (ISO codes — derived from your GPS location during onboarding)

Creative Content

• Photos and videos you upload, including captions, descriptions, and tags
• Comments and replies you post on other users' uploads
• Collections and Spotlight selections

Contest & Showdown Participation

• Contest entries submitted to Showdowns
• Votes you cast on contest entries
• Judge scores (if you are assigned as a judge in a Premium Showdown)
• Prize payment details: If you win a cash-prize Premium Showdown, we collect your bank name, account number, account name, and optional Tax ID solely to pay your prize. This data is stored only as long as necessary to complete payment and comply with Nigerian financial and tax regulations.

Clusters

• Clusters you create or join, your role, and join date
• Posts you make within a Cluster
• Moderation actions you take as an admin or moderator (bans, suspensions, content removals)

Direct Messages

• The content of messages you send and receive
• The message request text (first message when initiating a conversation)
• Conversation metadata: participant identities, timestamps, read status, unread counts, and conversation status

Subscriptions

• Spektt Pro subscription status, start and expiry dates
• Payment processing is handled entirely by Apple (App Store) or Google (Google Play) and RevenueCat. We never receive or store your card number or billing address.

Feedback & Support

• Feedback and bug reports you submit through the App
• Messages you send to us by email (support@spektt.com or legal@spektt.com)

Reports & Appeals

• Reports you submit about other users, uploads, or Clusters, with the reason and any detail you add
• Appeals you submit if your account is suspended

2.2 Information We Collect Automatically

Location Data

• Precise GPS coordinates collected during onboarding (with your permission), reverse-geocoded into a city/region/country. Raw coordinates are not stored.
• Public IP address — stored only as a SHA-256 hash for fraud detection and vote manipulation prevention. The raw IP is never stored.

Device & Technical Data

• Device type, operating system, OS version, app version, language preference
• Genuine-app check: your phone asks Google Play Integrity (Android) or Apple DeviceCheck (iOS) to confirm that requests come from the genuine Spektt app on a real device. We receive only that verdict — not your contacts, files or other personal data.
• Banned-device protection: on Android we store a SHA-256 hash of your device's Android ID (unique to Spektt on that device; it resets on a factory reset), linked to the accounts used on that device (the most recent five), and count new accounts per device per day (at most three). On iOS we store no device identifier — Apple keeps a small flag for Spektt on the device (DeviceCheck). If an account is permanently banned for a serious violation of our Community Guidelines, the devices it was used on can no longer be used with Spektt; the ban is lifted if an appeal succeeds.

Gamification & Engagement Data

• XP earned, current level, tier, earned badges
• Weekly and monthly XP totals, total views, votes received and cast
• Counts of the views and votes your work received from other established accounts, and of the members your Cluster gained (used to award XP and badges)
• Views, likes and comments your uploads receive

Push Notification Tokens

• Push tokens (per device, for delivering push notifications): a Firebase Cloud Messaging token on Android and an Apple Push Notification service token on iOS. Removed immediately upon logout or account deletion.

Error & Crash Data

• Crash reports sent to Sentry include error type, stack trace, app version, and device OS. They do not include your name, email, or message content.

3. HOW WE USE YOUR INFORMATION

What we do NOT do:

• We do not sell your personal data to any third party
• We do not read, scan, or analyse private message content for advertising or machine learning
• We do not use your private messages to train algorithms or personalise your feed
• We do not share your prize payment details beyond what is required by Nigerian law
• We do not retain raw GPS coordinates — location is captured once during onboarding, geocoded, and the raw coordinates discarded

4. SHARING YOUR INFORMATION

We do not sell your personal data. We share your information only in the following circumstances:

With other users (by design)

• Your profile (username, avatar, creative category, follower/following counts, XP tier) is visible to all signed-in users
• Your uploads, comments, and Cluster activity are visible according to each feature's scope
• Your Leaderboard rank, XP tier, and badge count are publicly visible on your profile
• Your username appears alongside contest entries during Showdowns

With our service providers

With law enforcement or regulators

We may disclose your information if required by law, court order, or governmental authority, or to prevent fraud or protect the safety of our users.

In connection with a business transfer

If Axlume Tech Limited is acquired or transfers its assets, your data may be transferred to the acquiring entity. We will notify you before your data becomes subject to a different privacy policy.

5. DIRECT MESSAGING

5.1 How Messaging Works

To start a conversation, you must send a message request that the recipient must accept before a full conversation can begin. This protects all users from unsolicited contact.

5.2 What We Store

• The full content of messages you send and receive
• The request message text (the first message used to initiate a conversation)
• Conversation metadata: participant identities, timestamps, read status, unread counts, and conversation status
• Block and report actions taken within conversations

5.3 Who Can Read Your Messages

Your messages are accessible only to you and the other participant, and to authorised Spektt safety moderators only when a message has been reported. We do not proactively read or scan private conversations.

5.4 Push Notification Previews

Turning off "Messages" in the App's Notification Settings (Settings → Notifications) disables message push notifications entirely — including the preview — rather than just hiding the preview text. You can also manage notification content visibility (e.g. hiding it on your lock screen) through your device's OS-level notification settings.

5.5 Anti-Spam Protection

A user whose message request you decline cannot contact you again for 30 days. This record is automatically purged after the 30-day cooldown. Blocked users cannot message you at all.

5.6 Message Deletion

Deleted messages are replaced with "This message was deleted" for both participants and permanently purged from our servers within 30 days. Deleted conversations are removed from your view immediately and purged within 30 days.

5.7 Minor Users

Users identified as minors have restricted access to direct messaging. Age determination is based on the date of birth entered during account setup.

6. CLUSTERS (COMMUNITY GROUPS)

When you join or create a Cluster, we collect and store your membership record, role, and join date. Posts you make within a Cluster are visible to all Cluster members. If you are banned from a Cluster, your membership record and ban reason are retained for moderation purposes.

If you are a Cluster admin, your username appears publicly as the administrator. Moderation actions (bans, suspensions, content removals) are logged in an immutable audit trail including the moderator's username, reason, and timestamp.

Admin inactivity is monitored — after 30 days of inactivity you receive a warning; after 45 days, ownership is automatically transferred to protect the community.

7. SHOWDOWNS AND PRIZE PAYMENTS

• Entry data: Your Showdown entry and username are visible to all participants during the Showdown. Vote counts are hidden until the Showdown ends.
• Judging: If you are assigned as a judge, your individual scores are private until results are announced.
• Results: Winner usernames and placements are publicly announced. Your bank details and Tax ID are never publicly disclosed.
• Prize claims: You have 14 days to submit your claim. A 10% withholding tax is deducted in line with Nigerian tax regulations. Cash prize payments are currently available to Nigerian bank account holders only.
• Forfeiture: Unclaimed prizes are forfeited after 14 days. Forfeited prize records are retained for internal accounting.
• Retention: Prize payment details (bank info) are retained for the period required by Nigerian financial regulations after payment, regardless of account deletion.

8. CHILDREN'S PRIVACY

Spektt is intended for users aged 16 and above. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has created an account, we will delete that account and its associated data promptly.

For users aged 16–17 (minors), additional restrictions apply:

• Minors cannot enter any Showdown (Pulse or Premium)
• Direct messaging is restricted for minor users
• Cash prize participation requires the user to not be flagged as a minor

If you believe a child under 16 has created an account, contact us at legal@spektt.com.

9. YOUR RIGHTS

To exercise any of the rights below, contact us at legal@spektt.com with the subject line "Privacy Request."

9.1 Right to Access

You can request a copy of the personal data we hold about you.

9.2 Right to Correction

You can update most profile information directly in the App (Profile → Edit Profile or Settings). For data you cannot edit in-app, contact us.

9.3 Right to Deletion (Account Deletion)

Delete your account at any time from Settings → Delete Account.

• Grace period: Your account is immediately locked and scheduled for permanent deletion in 30 days. Your uploads and contest entries stay visible until the deletion completes
• Cancellation window: Log back in within 30 days to cancel the deletion and restore your account
• After 30 days: Profile info (name, username, email, avatar), uploads, DMs, Cluster memberships, saved entries, watch history and vote records are permanently deleted, and your username becomes available again. Comments are anonymised, and reports you filed stay on record without your name. A minimal account record is kept so awards and audit logs still resolve: your user ID, your creative role, and your XP, level, tier and badges. It holds no contact details, date of birth, location, IP address or device data. Likes and views you gave remain only as counts tied to that anonymous ID. The device links of a deleted account are deleted too — except that if the account was permanently banned, the ban on its devices stays in force (the hashed Android ID, the banned account's ID and the reason), so deleting an account is not a way around a ban.

9.4 Right to Opt Out

• Push notifications: Disable in device settings or in-app Notification Settings
• Analytics / crash reporting: Sentry captures anonymised crash data only; contact us if you have concerns

Leaderboard ranking is a core part of the Spektt experience for every active user and is not an optional feature you can be excluded from while keeping your account active.

9.5 Nigerian Users (NDPA 2023 / NDPR)

Under the Nigeria Data Protection Act 2023 and the NDPR, you have the right to know what data we hold, correct inaccurate data, request deletion, withdraw consent, and lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

9.6 Other International Users (GDPR and equivalents)

If you are located in the European Economic Area or a jurisdiction with equivalent data protection law, you additionally have the right to data portability and to lodge a complaint with your local supervisory authority.

10. DATA RETENTION

11. DATA SECURITY

We implement industry-standard security measures to protect your personal data:

• All data is stored in Google Firestore with strict security rules — clients can only read and write data they are explicitly authorised to access
• Passwords are handled entirely by Firebase Authentication and are never stored in plain text by Spektt
• Secret keys and credentials (media, email, push and payment-webhook keys) are stored server-side and are never included in the App; the App contains only public, client-safe keys (such as its Firebase configuration and RevenueCat SDK key)
• Media files are served through our CDNs — Cloudflare Images (photos) and Bunny.net Stream (video) — with DDoS protection and encrypted delivery (HTTPS/TLS)
• Admin and moderator actions are logged in an immutable audit trail in Firestore
• IP addresses used for fraud detection are stored only as SHA-256 hashes — the raw IP is never persisted

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

12. INTERNATIONAL DATA TRANSFERS

Spektt is operated by Axlume Tech Limited in Nigeria. Your data is primarily stored on Google Firebase / Firestore servers, which may be located in the United States or European Union. Cloudflare (images) and Bunny.net (video) distribute media globally. Google and Apple (push notifications), Amazon Web Services (SES), RevenueCat, and Sentry also process data on servers outside Nigeria.

By using the App, you consent to the transfer of your information to these servers. Where required by law, we implement appropriate safeguards for such transfers.

13. LEGAL BASIS FOR PROCESSING (NDPA 2023 / GDPR)

14. THIRD-PARTY LINKS

The App may contain links to external websites. This Privacy Policy applies only to the Spektt App and the spektt.com website. We are not responsible for the privacy practices of third-party websites.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document
• Post the updated policy at spektt.com/privacy
• Where required by law, notify you via in-app notification or email

Your continued use of the App after the updated policy is posted constitutes your acceptance of the changes.

16. CONTACT US

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

• Email: legal@spektt.com (subject: "Privacy Request")
• Website: spektt.com/contact
• Company: Axlume Tech Limited, Federal Republic of Nigeria

For Nigerian users, you may also contact the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you believe your rights under the Nigeria Data Protection Act 2023 have been violated.