Privacy Policy

Japa.to ("we", "us", "the platform") is a community platform for people planning, making and settling into international moves. This policy explains what personal data we collect, why we collect it, how long we keep it, and the control you have over it.

It applies to japa.to and its sub-domains (including the academy, docs and tools surfaces), the mobile apps, and any feature that links back to this page. If you do not agree with this policy, please do not use the platform.

1. What we collect

We collect only what the platform needs to work:

• Account data — email address, username, password (stored only as a cryptographic hash), and optional sign-in provider identifiers.
• Profile data — what you choose to add: display name, bio, avatar, journey stage, origin and destination countries.
• Content you create — posts, comments, wiki edits, stories, form submissions, messages you send, and files you upload.
• Usage data — pages visited, features used, searches, and aggregate interactions, used to keep the service fast and relevant.
• Technical data — IP address, device and browser type, and timestamps, used for security, abuse prevention and rate limiting.
• Approximate location — country-level location inferred from IP (GeoIP), used to surface relevant destinations and content. We never collect precise GPS coordinates unless you explicitly share them.
• Payment metadata — when you buy credits, our payment processors (Paystack/Stripe) handle card details directly. We receive only the transaction reference, amount and status — never your card number.

2. How we use your data

• Provide and secure the platform — authentication, sessions, feeds, messaging, tools.
• Personalise content — for example geo-aware destination suggestions (you can override this in Settings).
• Operate credits, payments and marketplace features.
• Send service emails (verification, security alerts, receipts) and — only if you opt in — newsletters.
• Moderate the community: investigate reports, prevent scams, spam and abuse.
• Understand aggregate usage to improve the product. Analytics are privacy-friendly and self-hosted where possible.
• Comply with legal obligations — for example responding to lawful requests.

3. Legal bases (GDPR)

Where the GDPR or similar laws apply, we process personal data under: contract (providing the service you signed up for), legitimate interests (security, fraud prevention, product improvement — balanced against your rights), consent (optional features like newsletters, which you can withdraw at any time), and legal obligation (records we must keep).

4. Who we share data with

We do not sell personal data. We share it only with:

• Infrastructure providers — hosting, database, file storage and email delivery, bound by data-processing agreements.
• Payment processors — Paystack and Stripe, for credit purchases only.
• AI providers — limited content context when you use AI features such as JapaBot, never your private messages or full account data.
• Other members — content you publish publicly (posts, profile fields marked public) is visible per your visibility settings.
• Authorities — only when legally required, and we push back on overbroad requests.

5. International transfers

Our community is global, so data may be processed in countries outside yours — including where our infrastructure or processors operate. Where required, transfers are protected by standard contractual clauses or an equivalent safeguard.

6. How long we keep data

• Account data — kept while your account is active; erased within 30 days of a confirmed deletion request, except records the law requires us to keep (e.g. payment receipts).
• Public content — remains until you delete it; on account deletion it is anonymised or removed as described below.
• Logs and technical data — retained for a limited period (typically up to 90 days) for security, then aggregated or deleted.
• Support conversations — kept while needed to resolve your request and for a short period after.

7. Your rights

You can exercise these at any time — most are self-serve in Settings, and all are available via the contact form (choose "Privacy & data"):

• Access — get a copy of your data (Settings → data export).
• Correction — fix inaccurate profile data yourself, or ask us.
• Erasure — delete your account; personal data is erased and public contributions anonymised.
• Portability — your export is a machine-readable file you can take elsewhere.
• Objection & restriction — opt out of newsletters and optional processing.
• Complaint — you may also complain to your local data protection authority; we would appreciate the chance to fix things first.

8. Security

Passwords are hashed, sessions use short-lived tokens, two-factor authentication is available, and access to production data is restricted and audited. No system is perfectly secure — if you suspect a breach or find a vulnerability, please report it via the contact form under "Report abuse" immediately.

9. Children

Japa.to is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

10. Cookies

We use a small set of cookies for sign-in, security and preferences — the full list and your choices are in the Cookie Policy.

11. Changes to this policy

If we change this policy we will update the date above, and for significant changes we will notify you in the product or by email. Continuing to use Japa.to after a change means you accept the updated policy.

12. Contact

Privacy questions, requests or complaints: use the contact form and choose the "Privacy & data" topic.