Privacy notice · version PN-2026-1
We keep as little as we can, and say exactly what.
This notice explains what personal data Binchika collects, why, how long we keep it, who can see it, and how to use your rights under the Nigeria Data Protection Act 2023 (NDPA). Binchika is a citizen transparency layer. Only INEC declares election results.
- Controller identity and Data Protection Officer: the legal name and registered address of the person or organisation responsible, whether a DPO is appointed, and whether Binchika must register with the NDPC.
- Transfer basis: the legal basis for storing data in the United States (for example contractual safeguards), provider by provider.
- Photo pipeline: removing location data and checking for faces must be built and live before photo intake opens.
- Retention, applications not offered a seat (a period is proposed).
- Retention, seat holders' accounts and pledge records (proposed).
- Retention, result-sheet photos (proposed).
- Retention, contact-form emails (proposed).
- Response time for data requests (one month is proposed).
Nothing on this list has been answered on the owner's behalf. Each point is marked in the text below.
In short
- Minimum data. We never ask for your BVN, NIN, bank details, biometrics, passwords for other services, or a photo of your ID. A voter card number is kept only as a one-way, salted fingerprint plus its last four characters.
- One purpose each. Data collected to screen a verifier is used only for that, and to match the name typed when signing the pledge. It is never used for marketing, sold, or shared with any party, campaign or candidate.
- Anonymous by default. Verifiers are known publicly only by seat number and public ID (for example SZV-073 · V0042). Only the BinchikAdmin can link a public ID to a person.
- Ineligible answers are never stored. If the published screening rules rule you out, you are told why on screen and nothing is saved.
- You have rights. You can ask to see, correct or delete your data, object, or withdraw consent. You can also complain to the Nigeria Data Protection Commission.
1. Who is responsible
The data controller is Binchika to confirm: legal name of the person or organisation, registered address, and whether a Data Protection Officer is appointed or Binchika is registered with the NDPC. For anything about your data, use the contact form and choose “Data request”. It reaches the person responsible directly.
2. What we collect, and why
| Who you are | What we keep | Why | Lawful basis (NDPA) |
|---|---|---|---|
| Anyone visiting the site | No advertising or tracking cookies. Your theme choice (light or dark) is kept only in your own browser. Our host, Cloudflare, processes your IP address to deliver pages and block attacks. We use Cloudflare Web Analytics, which counts page views in aggregate without cookies (its script loads from static.cloudflareinsights.com). | Deliver the site securely. | Legitimate interests (security). |
| Someone who uses the contact form | Your name (optional), email address, message and any attachments are emailed to our inbox; they are not stored in our database. A one-way fingerprint of your IP address is logged to stop spam. | Reply to you; prevent abuse. | Consent (you choose to write); legitimate interests (spam prevention). |
| Citizen reporter (sends a photo of a polling-unit result sheet) | A salted one-way fingerprint of your messaging handle (never the handle or phone number itself), the polling unit, the race, the photo and its SHA-256 fingerprint, your caption and the figures read from it. | Compare citizens' photos with official uploads, and publish the evidence behind each tally. | Consent (you choose to send). |
| Verifier applicant | Full name; email address; state of origin or residence and which one it is; the role you apply for (SZV or NRV); your answers to the eight published screening questions; your voter card number as a salted one-way fingerprint plus its last four characters; the time you consented and the notice version; a one-way fingerprint of your IP address (abuse limits). | Check eligibility fairly, stop duplicate or bulk applications, and offer seats. The full name is used only to match the name you type when signing the pledge. | Consent, including explicit consent for answers about party roles (see section 3). |
| Verifier holding a seat (SZV or NRV) | Account email; a password, stored by our database provider only as a one-way hash; your authenticator-app registration if you add one; seat, public ID and area; your typed-name pledge with its version and time; the flags you raise and their outcomes; sign-in records. | Run the verification work, keep it accountable, and keep accounts secure. | Consent and, while you hold a seat, the volunteer agreement you accept in the pledge. |
| OpsAdmin or BinchikAdmin | As for verifiers, plus a required authenticator-app registration. Admin actions are recorded with the admin's public ID. | Security and accountability for privileged actions. | Legitimate interests; the volunteer agreement. |
Never collected: BVN, NIN, bank or card details, fingerprints or face scans, photo ID, phone numbers (verifiers meet on Signal by username and seat number only), political-party membership details beyond the yes/no screening answers, or anything about how you voted.
3. Answers that touch on political affiliation
Two screening questions ask whether you hold, or recently held, a party or campaign role. Under the NDPA, data revealing political opinions is sensitive personal data. We ask only because verifiers must be independent. We store the answers only for applicants who pass (whose answer is “no”), and only with your explicit consent, given by ticking the consent box before you submit. If your answer rules you out, it is never stored.
4. Automated screening, and a human review
Eligibility is checked by eight published rules (the same code runs in your browser and on our server). Every eligible applicant gets the same score, and ties go to whoever applied first. Choosing “not sure” on the impartiality question sends your application to a person for review. If you think a rule was applied wrongly, ask for a human review through the contact form. No other profiling or automated decision is made about you.
5. Who can see your data
- The public sees seat numbers, public IDs, whether a seat is taken, the public seat history (seat, public ID, pledge version and time, never names or reasons), flags and their outcomes (by public ID), and the evidence ledger.
- Other verifiers see only seat numbers and public IDs.
- OpsAdmins (three seats at most) can see verifier records by public ID to help with reviews. They cannot see applicants' names, emails or answers, read pledge names, or link a public ID to a person.
- The BinchikAdmin (one person, whose sign-in needs an authenticator app) can link a public ID to a person and read pledge names, through server functions that check every request. When choosing whom to invite, the BinchikAdmin sees state, role and application date, not names or emails.
- Nobody else. We never sell, rent or share personal data with parties, campaigns, candidates, advertisers or data brokers. We would disclose data to authorities only where Nigerian law requires it, and we would tell you unless the law forbids it.
6. Service providers, and data outside Nigeria
These providers process data for us under their terms, only to run the service:
- Cloudflare: hosting, server functions, the report database, photo storage, and email forwarding. Pages are served from Cloudflare's worldwide network; the report database and the photo store are located in eastern North America (Cloudflare's "ENAM" region).
- Supabase: the verifier database and accounts, hosted in the United States (Amazon Web Services, us-east-2, Ohio).
- Resend: sending emails from [email protected].
- IPFS pinning: only for published evidence bundles, which contain no personal data. Anything placed on IPFS should be treated as permanent.
This means personal data described in this notice is stored in the United States, outside Nigeria. The NDPA allows this only with adequate protection. to confirm with the reviewer: the transfer basis for each provider, for example contractual safeguards
7. Photos of result sheets
Result sheets are public documents, but a photo can catch people, faces or location data. Before any photo is published, we remove camera and location data (EXIF) and check for faces. Photos that show people are blurred or withheld. Photo storage is private, and published copies are served only after these checks. to confirm: this pipeline is being built and must be live before photo intake opens
8. How long we keep it
| Data | Kept for |
|---|---|
| Ineligible screening answers | Never stored. |
| Failed code attempts; sign-in link requests (fingerprints only) | Deleted after one day. |
| Applications not offered a seat | proposed Deleted within 90 days after INEC declares the final 2027 governorship results, or sooner if you ask. |
| Seat holders' accounts and pledge records | proposed While you hold the seat, then 12 months for accountability. After that, everything except your public ID is deleted. |
| Public seat history and the evidence ledger | Permanently. They contain seat numbers, public IDs and evidence, never names or contact details. The ledger is append-only by design, so corrections are added as new entries. |
| Result-sheet photos | proposed Full resolution for 12 months after the election, then thumbnails only. Published evidence bundles are permanent. |
| Contact-form emails | proposed In our inbox for up to 24 months, then deleted. |
9. Your rights
Under the NDPA you can:
- ask what we hold about you, and for a copy;
- have it corrected;
- have it deleted;
- restrict or object to its use;
- receive it in a portable format;
- withdraw consent at any time (this does not undo processing already done);
- ask for a human to review the automated screening.
Use the contact form and choose “Data request”. We will check it is really you, by replying to the email address on record, and answer to confirm: within one month (proposed). Some data cannot be deleted because it no longer identifies you, such as your public ID in the public seat history or a ledger entry.
You can complain to the Nigeria Data Protection Commission (NDPC) at any time. We would rather you tell us first, so we can put it right.
10. How we protect it
- Encrypted connections everywhere.
- Database rules that let each person read only what their role allows.
- One-way fingerprints for invite codes, voter card numbers, messaging handles and IP addresses.
- An authenticator app required for every admin.
- Admin powers checked again on the server for every request.
- No secrets in our public code.
Our code is open source, so anyone can check these claims.
If a breach puts your rights at risk, we will tell the NDPC and you as the NDPA requires.
11. Age
Verifiers must be 18 or older and hold a voter card. We do not knowingly collect data from children. If you think we have, tell us and we will delete it.
12. Changes to this notice
Every version has an identifier (this one is PN-2026-1), and each application records the version you agreed to. If we change what we collect or why, we publish a new version first and ask for fresh consent where the law requires it.
Binchika is a citizen transparency layer that does the maths in public. It is not an election management body. Only INEC declares official results; local government elections are run by the State Independent Electoral Commissions (SIECs).