Privacy

Wetin we store, why, and how you fit stop am.

Template. This page na plain-language draft, not legal advice. Make a lawyer review am before you rely on am. Last updated 2 October 2026.

The short version

• You fit play without account, without email, without cookies.
• No ad tracking. Billboard ads for the city fit get a link card; we only count how many times a card show and how many taps e get, with no name, no ID, no profile. We no dey sell or rent your data to anybody.
• Analytics (Google Analytics 4 + PostHog) only run if you say yes, and you fit change your mind any time.
• If your browser sends Global Privacy Control or Do Not Track, we take am as no. We no go even ask.

Who we be

Surviving Nigeria (gta.koha.wtf) is run by Attention Factory LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States ("we", "us"). We are the controller of the personal data described here. Questions, or to use your rights: hello@weekendsofai.com.

What we store and why

Needed to run the game (no consent needed)

• Sign-in session cookie (gta.*, Better Auth): only if you sign in. Keeps you signed in. Lasts up to 60 days, renewed while you play.
• Your account: email, name, in-game money and stats, settings and mail preferences, so your progress follows you to any device.
• Live game data: your name, position, actions and text chat go to our servers and the players around you while you play.
• On your device (localStorage, never cookies): your name, a random player id, character look, volumes, radio, vibration, install and feedback reminders, and your analytics choice. Clearing site data removes them.
• Security: our host, Cloudflare, processes your network (IP) address to deliver the game and stop abuse. For guest feedback limits we keep only a daily-salted hash of it, not the address.

Only with your yes: analytics

• Google Analytics 4 and PostHog count pages and game events (joining, deaths, entering a motor, sharing, installing), with device, browser and rough location from your IP. Never your name, chat or exact money.
• Cookies and storage: _ga, _ga_*, ph_*. Before you say yes, none of these exist and the scripts are not even loaded.
• Google Consent Mode: ad storage, ad user data and ad personalisation stay denied always; Google signals are off.

Things you switch on yourself

• Voice (protest and street voice) runs through LiveKit. Your mic is only used when you turn talk on, audio goes live to people in your room, and we don't record it.
• Email goes out through ZeptoMail or Resend (Cloudflare Email as backup): sign-in codes, a welcome mail, and only if you turn them on, game updates and "your idea don land" notes. Every one has an unsubscribe link; Menu → Account turns them off too.
• Feedback: your posts, votes and any screenshot you attach are stored with Cloudflare (R2) and shown on the public board.
• NPC brains: some NPC decisions (like a police bribe) come from an AI service that gets the game situation, not your email or account.

How long we keep am

• Session cookie: up to 60 days.
• Account, stats and feedback: until you ask us to delete them (or we remove a post).
• Analytics: the retention set in GA4 and PostHog for this game; your browser's analytics cookies go the moment you say no.
• Live game state: only while the match runs.

Change your mind

Use the switch at the top of this page, or in the game: Menu (Esc or ☰) → Privacy → Analytics. Turning it off stops counting at once and deletes our analytics cookies from your browser. Want what was already sent deleted too? Email us and we'll handle it with Google and PostHog.

Your rights (NDPA and GDPR)

Under Nigeria's Data Protection Act 2023 (NDPA) and, where it applies, the EU/UK GDPR, you can ask to see, correct, delete or take a copy of your data, object to how we use it, and withdraw consent any time without it affecting what came before. We rely on: our contract with you (running the game and your account), legitimate interests (security and stopping abuse), and your consent (analytics and update emails). You can complain to the Nigeria Data Protection Commission (NDPC) or your local data protection authority, but please talk to us first.

Our providers (Cloudflare, Google, PostHog, LiveKit, ZeptoMail, Resend) may process data in the United States and other countries, under their own data protection terms.

The game is not meant for children under 13. If we change what we collect, we update this page and ask you again before counting.