Privacy Policy

Effective date: 1 August 2026  ·  Version: 1.0

1. Who we are

Friend Indeed (the "App") is operated by Friend Indeed Limited ("we", "us", "our"), a company incorporated in Nigeria and the data controller of the personal information described in this policy. For any privacy question, contact privacy@friendindeed.app; our registered office, Privacy Officer, and EU/EEA and UK representatives are listed in Section 26.

2. Scope, summary & our Terms

Friend Indeed is a private, closed-circle social notification utility. It lets a person who needs help post a request and notifies that person's mutual contacts — people who have saved the person in their phone and whom the person has saved in return — so that those contacts may choose to help, including by sending a personal gift of money directly to one another using their own external payment methods.

Global availability. Friend Indeed is available worldwide, and this Privacy Policy applies to all users globally. The general protections described in this policy apply to everyone, wherever they use the App; the country- and region-specific notices in Sections 21–24 add rights for users in those places and supplement, rather than replace, those general protections.

This policy applies to the Friend Indeed mobile applications and any related websites or support channels we operate that link to it. It does not apply to third-party services (for example, your bank, mobile-money provider, or any payment app) that you use to send or receive money — those services have their own privacy policies.

2.1 Relationship to our Terms & Conditions

This Privacy Policy is part of, and should be read with, our Terms & Conditions, which contain binding provisions stating that Friend Indeed is not a money transmitter, does not provide escrow or wallets, does not take custody or control of funds, and strictly prohibits the solicitation or repayment of loans. The Terms & Conditions govern all use of the App and are available at https://www.friendindeed.app/terms. Our Community Guidelines and Safety & Fraud Policy also apply.

3. Information we collect

We practise data minimisation and collect only what the App needs to work. The categories below identify what we collect, whether it is required or optional, and why.

3.1 Information you give us at sign-up (required)

3.2 Information you may choose to add to your profile (optional)

3.3 Information generated when you use the App

• Help-request content — the text, amount, reason and any images you include in a request. Because a request signals that you may be in financial hardship (and can sometimes reveal health, family or other personal circumstances), we treat request content as sensitive information (see Section 9).
• Receiving account details (optional) — if, on a particular request, you choose to show helpers how to send you a gift, the account details you enter for that request (for example, a bank account number or mobile-money handle, together with the account name and payment method). You enter these per request, and they are stored with that request — never saved to your profile. They are purely your instruction for receiving a gift; we do not use them to move, process, or verify any money, and you are responsible for ensuring they are accurate and appropriate to share with your contacts. See Sections 4 and 14.
• Help-request status & amounts — the status of a request (for example, open, closed, or fulfilled) and its amounts: the amount requested and the amount gifted (and, until you acknowledge a gift, an amount pending your acknowledgement). These figures are user-reported — a helper logs the gift they say they sent, you acknowledge it, and the App totals the acknowledged gifts against the amount you requested. As explained in Section 4, the App does not process, receive, hold, or verify any actual payment, so these figures reflect what users report to one another and may not correspond to money actually sent or received.
• Transaction receipts (optional) — you and the other party to a transaction may attach receipts or proof of transfer (for example, to reconcile an amount claimed against the amount actually received). Receipts can contain financial details such as account numbers, transaction references, dates and amounts, so we treat them as sensitive information. A receipt is visible only to the two users involved in that transaction; no one else — including your other contacts — can see it. We do not verify, authenticate, or adjudicate receipts; they are simply a tool for those two users to reconcile any discrepancy between themselves. We keep receipts only for as long as they are needed: they are deleted as soon as the requester acknowledges the gift or, where a discrepancy has been flagged, once that discrepancy is reconciled.
• Contact-matching data — keyed one-way digests (HMAC-SHA256) of the telephone numbers in your device address book, computed on your device and used solely to find your contacts. Only phone numbers are turned into digests (never your contacts' names or other fields); unmatched digests are discarded, and for a matched contact we keep only a link between your account and theirs — not their phone number. This is described in detail in Section 5.
• Activity & engagement data — requests you post; contacts you are matched with; contact lists you create; your feed and notification preferences; reports you submit or receive; contacts you block; and engagement events on requests you can see (for example, that a request was delivered to you, that you opened it, that you started the help flow, or that you revealed a requester's account details). A requester can see aggregate engagement counts for their own request and, for opens, which of their contacts have viewed it.
• Device & security data — your region/country (derived from your phone's international calling code at sign-up) and push-notification tokens (one per device you sign in on). To secure your account on your device, the App also stores your PIN as a SHA-256 hash and, if you enable it, a biometric-unlock setting; these stay on your device and are never sent to us.
• Optional-purchase records — if you buy an optional in-app feature (a request-expiry extension or the annual premium subscription), Apple or Google process the payment and tell us only that a purchase or renewal occurred. We receive a transaction/receipt identifier and status; we never receive your card or bank details.
• Feedback — if you use our in-app feedback form, the feedback you submit and, optionally, your email address. Your email address is the only contact detail collected there; providing it is optional, we use it solely to reply to you about your feedback if needed, and we do not share it with anyone outside our organisation.
• Membership & slot sharing — if you subscribe to Angel membership, we store a membership record (platform, product, and the store receipt token — never your card details). If you give your monthly request slot to a contact, we record the link between you, the beneficiary, and the month. You may choose to remain anonymous, in which case the beneficiary is not shown your identity; and you may choose whether you are told which of your eligible contacts received your slot. If you receive a shared slot, the giver may be shown that you were the recipient where they have chosen to be told.
• Manual contact adds — if you prefer not to grant access to your device address book, you can add a contact manually by entering their phone number and a name for them. These entries are saved on your device, exactly like device contacts, and are not sent to our servers. As with device contacts, only the keyed HMAC-SHA256 digest of the number is sent to us for matching and is then discarded; the name and the raw number stay on your device.
• Phone-number changes — if you change your account phone number, we keep an internal record of the change (old number, new number and date) to enforce cool-down limits and protect against abuse. This log is not shown to other users.

The specific third-party service providers and software development kits (SDKs) we use to provide, secure and analyse the App are listed in Section 10. Data these tools collect on our behalf is treated as our collection and is disclosed here and in our Google Play Data Safety form and Apple App Privacy label.

4. Information we do not collect

To remove any doubt about our role, we confirm that Friend Indeed does not:

• process, hold, transmit, escrow, or take possession, custody, or control of funds at any point in a transaction;
• collect or store payment-card numbers, CVV/CVC codes, card expiry dates, or online-banking login credentials;
• operate a wallet, stored-value balance, or payout facility; or
• collect precise GPS location, biometric data, or government-ID numbers.

The optional receiving account details you may include on a request (Section 3.3) are stored only so they can be displayed to your contacts as your instruction. They are your account details for receiving gifts — not a payment instrument we operate — and we do not use them to initiate or verify any transaction.

5. Contacts & how mutual-matching works

The heart of Friend Indeed is its closed circle: a help request is only ever shown to, and can only be answered by, your mutual contacts — people whom you have saved in your phone and who have also saved you in theirs. Strangers never see or respond to your requests.

To make this work, with your permission the App reads your device address book to identify which of your contacts also use Friend Indeed. (We do store your own phone number on our servers — it is your account identifier and is needed to verify you and to match you — but we never display it to other users; the steps below are designed to protect your contacts' numbers.) We have engineered this to be privacy-protective:

• Raw numbers never leave your device. With your permission, the App reads your device address book and, on your device, extracts and normalises the phone numbers and converts each into a keyed one-way digest (HMAC-SHA256). Only these irreversible digests are sent to our server; your contacts' actual phone numbers, names, email addresses and all other fields never leave your device.
• Matching is done on digests. The digests travel over TLS/HTTPS, and the server compares them against the digests of registered users to find matches. The server cannot recover a phone number from a digest, so it never learns the numbers of your contacts who are not registered users.
• We keep only matches; the rest is discarded. For a contact who matches a registered Friend Indeed user, we store only a link between your account and theirs. Digests that do not match a registered user are discarded and never stored.
• Your contacts' numbers are never shown to anyone. Matches are used only to work out mutual relationships; they are not displayed to you or to any other user. (We never send your own number to other users either; a contact viewing your profile sees only the number already saved in their own phone — see Section 10.)
• Mutual matching. A contact can see your request only if each of you has the other's number saved — this two-way check (performed on these digests) is what defines your closed circle.
• Manual adds. If you prefer not to grant contacts access, you can add a contact manually by entering their phone number and a name for them. These are stored on your device — just like device contacts — and are not sent to us; only the HMAC-SHA256 digest is sent for matching and then discarded, exactly as described above.
• Legal basis and non-user safeguards. We rely on your consent and our legitimate interests to perform contact matching. Because only irreversible digests — never readable numbers or names — are transmitted, people who are not registered users cannot be identified or contacted by us through this process, and unmatched digests are discarded rather than stored.

6. How and why we use information

• Create and secure your account and verify your telephone number;
• Identify you to your contacts and operate the mutual-contact model;
• Display your help requests to — and deliver notifications to — your contacts;
• Provide optional features you choose to buy (request-expiry extension; annual premium subscription);
• Detect, prevent and investigate fraud, impersonation, abuse and other prohibited activity, and keep the service safe (see Section 7);
• Provide customer support and respond to your requests;
• Maintain, troubleshoot, analyse and improve the App;
• Comply with law and respond to valid legal requests; and
• Send you service messages and, only where permitted, optional updates (see Section 19).

7. Automated processing, content checks & verification

We use a combination of automated checks and human review to keep the App safe:

• Before a request is posted, we run an automatic check on your draft — on your device and on our own systems, without sending it to any third party — to catch prohibited or offensive content. If something needs changing, the App tells you what to fix so you can edit and post. This is a correctable check at the moment you create a request, not a final or significant decision about you.
• After a request is posted, content moderation and any decision to remove content or to warn, restrict, or suspend an account involve human review (for example, following a report). We do not take such significant actions by automated means alone.
• We may also use automated systems to detect spam, fraud, impersonation, or other suspicious activity; these assist human review and do not, by themselves, produce legal or similarly significant effects about you.

We may use personal information to investigate impersonation, identity theft, fraudulent help requests, or other misuse of the platform, and we may ask you for additional information to verify your identity, investigate suspected misuse, enforce our policies, or comply with legal obligations.

8. Legal bases for processing (GDPR, UK GDPR & NDPA)

Where the EU/UK GDPR or Nigeria's NDPA 2023 applies, we rely on the following lawful bases:

9. Sensitive information

A help request inherently signals possible financial hardship, and you may choose to include health or other personal details (for example, "help with surgery costs"). Under the GDPR/UK GDPR this can be special-category data (Art. 9); under the NDPA it is sensitive personal data; and under California law it is sensitive personal information. Before you publish a request that contains health, disability, mental-health, medical, or other special-category information, we ask you to give your explicit consent through a separate, specific confirmation at the time you create the request; we do not treat the act of posting a request, by itself, as that consent. We share it only with your selected contacts, never publicly. You can delete a request at any time, and you should include only what you are comfortable sharing with your contacts. We do not use sensitive information to infer characteristics about you for advertising.

10. How information is shared

We share personal information only as described here.

10.1 With your contacts

What is shared here is controlled by you: you choose who can see each help request — within your closed circle of mutual contacts — and who can see your profile, from everyone to no one. On your profile, people who have you in their contacts can see your name, profile picture, any social-media handles you add, and any badge or status indicator shown on your profile. You can independently control who sees your name, photo and social links — everyone, only your contacts, or no one. We do not share your telephone number with other users: any number a contact sees next to your profile is the one already saved in their own device's address book — the App surfaces their own contact entry and never transmits your number to them. When you post a help request, the request itself — together with any receiving account details you include so your contacts know how to send help — is shown to your contacts as part of that request (not on your profile). Your contacts also see the request's status (for example, open, closed, or fulfilled) and its amounts — the amount requested, the amount gifted, and an amount still pending your acknowledgement. When a contact logs a gift toward your request, the amount they log is shared with you so you can acknowledge it; until you do, it counts toward the pending total, and once acknowledged it moves into the amount gifted shown to the circle. Your other contacts see only these aggregate totals — not who gifted or how much any individual gave. These figures are user-reported and are not amounts the App processes or verifies (Section 4). A request you post using an Angel slot also carries an indicator, visible to your contacts, showing that it was enabled by an Angel slot. This sharing is the core purpose of the App.

10.2 With service providers (processors / sub-processors)

We use a limited set of service providers who process personal data only on our instructions and are bound by contract to protect it. We maintain an up-to-date list; the current categories are:

Firebase handles phone number verification (OTP/SMS) on our behalf as part of its authentication service. Payment for in-app purchases is handled entirely by Apple or Google; we receive only the store receipt token, never your card details.

10.3 With Apple and Google

Only in connection with optional in-app purchases, which they process. We do not receive your payment details from them.

10.4 For legal and safety reasons

We may disclose information to regulators, courts, or competent law-enforcement, judicial, regulatory and financial-intelligence authorities where we reasonably believe, after reviewing the request, that disclosure is required or permitted by applicable law or is necessary to prevent fraud, harm, or unlawful activity. We review legal requests and disclose information only to the extent we reasonably believe is lawful.

10.5 In a corporate transaction

If we are involved in a merger, acquisition or asset sale, subject to this policy and applicable law.

11. We do not sell your information or use it for targeted advertising

12. International data transfers

We are based in Nigeria and use Google Cloud (Cloud Run) and Firebase (Google LLC) to store and process your information. Your data is hosted in Google Cloud data centres in the United States and the European Union. This means your information may be transferred across borders, including outside Nigeria, the EEA and the UK, where data-protection laws may differ and where it may, in some circumstances, be accessible to foreign authorities under local law.

When we transfer personal information internationally we use appropriate safeguards, including:

• the European Commission's Standard Contractual Clauses (SCCs) for transfers from the EEA;
• the UK's International Data Transfer Addendum (IDTA) for transfers from the UK;
• an adequate-transfer mechanism, Commission-approved instrument, or your consent, as required under NDPA ss.41–43, for transfers from Nigeria; and
• contractual and technical protections with our providers.

You may request a copy of the relevant safeguards using the contact details in Section 26.

13. Data retention

We keep personal information only as long as needed for the purposes in this policy:

• Active accounts — for as long as your account exists.
• Help requests & transfer history — retained as part of the shared record between you and the people you transact with; after account deletion they remain in anonymised form (your identity removed) so the other parties keep an accurate history (see Section 17).
• Transaction receipts (proofs) — deleted immediately when the requester acknowledges the amount; otherwise deleted after 30 days, except while a transfer is flagged with a discrepancy, when they are kept until the discrepancy is reconciled.
• Contact-match records — for a matched contact we keep only a link between your account and theirs (refreshed each time your contacts sync, and removed when you delete your account); unmatched digests are discarded, as described in Section 5.
• Feedback — kept to help us improve the App and deleted when you delete your account.
• After account deletion — your profile is anonymised and your contacts, contact links, blocks, device tokens, settings and inbox are deleted; Section 17 sets out exactly what is deleted and what is retained in anonymised form.
• Backups — residual copies in secure backups are overwritten on our routine backup cycle of 7 days.

14. Security & data breaches

We use appropriate technical and organisational measures to protect personal information, including keyed one-way hashing (HMAC-SHA256) of contact telephone numbers on your device, TLS/HTTPS for data in transit, on-device protections (a hashed PIN and an optional biometric lock), access controls and least-privilege permissions, monitoring and logging, and secure, reputable cloud infrastructure. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Data breaches. We maintain a data-breach response process and will notify you and the relevant supervisory authority within the timeframes required by law — for example, within 72 hours of becoming aware of a notifiable breach for the supervisory authority under the GDPR/UK GDPR (Arts. 33–34), and as required under the NDPA (ss.39–40) and PIPEDA.

Receiving account details. The optional receiving account details you provide are displayed to your contacts as text instructions. While we protect this data with the measures above, you are responsible for verifying a recipient's details before sending any money outside the App, and we are not liable for transfers sent to incorrect, out-of-date, or fraudulently altered account instructions.

15. Cookies & similar technologies

The App itself does not rely on advertising cookies. We and our service providers use device identifiers and similar technologies within the App (for example, for authentication and push notifications, as listed in Section 10). Any website we operate that links to this policy may use strictly necessary and, with your consent where required, analytics cookies; where that applies, a separate cookie notice will be provided on the website.

16. Your privacy rights

We make these core privacy rights available to all users globally, subject to identity verification and applicable law. Region-specific detail is in Sections 21–24.

• Access / know — obtain confirmation of, and a copy of, the information we hold about you and how we use it.
• Rectification / correction — correct inaccurate or incomplete information.
• Erasure / deletion — ask us to delete your information.
• Restriction & objection — restrict or object to certain processing, including processing based on legitimate interests.
• Portability — receive certain information in a portable format.
• Withdraw consent — withdraw consent at any time, without affecting prior processing.
• Opt out of sale/sharing — though we do neither (Section 11).
• Non-discrimination — we will not discriminate against you for exercising your rights.
• Complain — lodge a complaint with your data-protection authority (Sections 21–24).

To exercise any right, contact us (Section 26) or use the in-app controls. We will verify your identity and respond within the time limits set by applicable law. You may use an authorised agent where the law allows.

17. Deleting your account and data

You can delete your account at any time from within the App (Settings → Other → Delete Account); a web-based route is also available at https://www.friendindeed.app/delete-account.

When you delete your account, we anonymise your profile rather than keep it: your first and last name are replaced with a generic label, and your phone number, phone-matching digest, profile photo, receiving/bank details and social links are removed. We permanently delete your synced contact links, your blocks, your device push tokens, your app settings and preferences, your saved requests, your notification inbox (including notifications you generated in other users' inboxes), your phone-change history, your feedback (including any feedback email), and your on-device data (your PIN and biometric setting). We also delete your authentication account so your login cannot be reused.

We retain, in anonymised form where they refer to you, the records that others rely on or that we must keep: your past help requests and the transfer history between you and the contacts you transacted with; notifications that already sit in other users' inboxes; your Angel membership and in-app-purchase records (kept for financial and tax audit); records of any Angel emergency slots you gave or received; and any content reports involving you (kept for our moderation audit trail). We keep these to preserve the integrity and accuracy of other users' records and to meet legal, tax, safety and fraud-prevention obligations.

18. Children's privacy

You must be 18 or older to use Friend Indeed. We do not knowingly collect personal information from anyone under 18, regardless of any local law that may define a "child" by a younger age. If we learn that we have collected information from someone under 18, we will delete it promptly. Contact us (Section 26) if you believe a minor has provided us information.

19. Notifications and messages

The App's core function is to notify your contacts of help requests and certain account changes such as a phone-number update, and to notify you of activity relevant to you — such as when your own request is fulfilled or expires, or activity on a transfer you are involved in — by push notification and/or SMS. By creating an account and enabling notifications you consent to receive these service messages, which are necessary to provide the App. Where required by law (including the U.S. Telephone Consumer Protection Act), we obtain your express consent before sending messages and honour opt-outs. You can control push notifications in your device settings; some service messages are essential to the App and cannot be switched off while you hold an account. Any optional marketing messages are sent only with your separate consent and you can opt out at any time.

20. Sanctions & access restrictions

We may restrict or refuse access to the App where required by applicable sanctions, export-control laws, or similar legal restrictions.

21. United States privacy notice (California & other state laws)

This section supplements our policy and applies to residents of U.S. states that have enacted comprehensive consumer-privacy laws — including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states as their laws take effect. It serves as our notice at collection under applicable state law.

21.1 California (CCPA / CPRA)

The following applies to California residents.

Categories of personal information collected (last 12 months)

Sources: you; your device; and your selections within the App. Business/commercial purposes: as in Sections 6–7. Disclosures: to the service providers and recipients in Section 10. Sale/share: we do not sell or share personal information, including sensitive personal information, for cross-context behavioural advertising, and we do not use sensitive personal information beyond the purposes permitted by the CPRA.

Your California rights: to know, to delete, to correct, to opt out of sale/sharing (not applicable as we do neither), to limit use of sensitive personal information (we already limit it), and to non-discrimination. California's "Shine the Light" law: we do not share personal information with third parties for their own direct marketing. To exercise rights, contact us (Section 26); we will verify and respond within statutory timeframes, and you may use an authorised agent.

21.2 Virginia, Colorado, Connecticut, Texas & other states

Depending on your state of residence, you may have the right to: confirm whether we process your personal information and to access it; delete it; correct it; obtain a portable copy of it; and opt out of the "sale" of personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects. We do not sell personal information, serve targeted advertising, or carry out such profiling, so these opt-outs have nothing to apply to. Where a state law requires opt-in consent to process sensitive data (for example, information about health or a request that reveals it), we obtain that consent, as described in Section 9. You also have the right to appeal a decision on your request, and the right to be free from discrimination for exercising your rights.

Other U.S. states. Residents of other states may have additional privacy rights as new state laws come into force. Where required by law, we will honour those rights and provide mechanisms to exercise them. To exercise any right, contact us (Section 26); we will verify your request, respond within the timeframe set by your state's law, allow an authorised agent where permitted, and provide an appeal route where required.

22. EU/EEA & UK privacy notice (GDPR / UK GDPR)

The data controller is Friend Indeed Limited (Section 1). Our lawful bases are in Section 8. You have the rights in Section 16, including to lodge a complaint with a supervisory authority. As explained in Section 7, we do not use your personal information for automated decision-making that produces legal or similarly significant effects about you without human involvement. International transfers are addressed in Section 12.

• EU/EEA users — you may complain to your local Data Protection Authority. Our EU representative under GDPR Art. 27 is ---.
• UK users — you may complain to the Information Commissioner's Office (ICO) at ico.org.uk. Our UK representative under UK GDPR Art. 27 is ---.

23. Canada privacy notice (PIPEDA & Quebec Law 25)

We handle personal information in accordance with PIPEDA's ten fair-information principles, including accountability, identifying purposes, consent, limiting collection/use/retention, accuracy, safeguards, openness, individual access and challenging compliance. Meaningful consent: enabling contact-matching requires your express, opt-in action; consenting to this policy does not, by itself, authorise access to your address book. Cross-border processing: as noted in Section 12, your information may be stored or processed outside Canada (in Google Cloud data centres in the United States and the European Union) and may be subject to the laws of those countries, including lawful access by their authorities. Challenging compliance: you may direct questions or complaints to our Privacy Officer at privacy@friendindeed.app; if unsatisfied, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), and Quebec residents may contact the Commission d'accès à l'information.

24. Nigeria privacy notice (NDPA 2023)

We process personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and applicable directives, and we recognise the authority of the Nigeria Data Protection Commission (NDPC). We provide the information required by s.27, rely on the lawful bases in s.25 (and, for sensitive data, s.30), and obtain consent that is informed, specific, freely given, unambiguous and withdrawable (s.26). You have the data-subject rights in s.34 and the rights of withdrawal and objection in ss.35–36. Cross-border transfers are made under ss.41–43 (Section 12), and we handle security and breaches under ss.39–40. Where we are required to appoint a Data Protection Officer or to register with the NDPC, we do so.

Friend Indeed is a social-notification platform for help between mutual contacts. It does not pool, hold, manage, invest, transmit, or control user funds, and does not operate as a regulated crowdfunding or securities offering. If you believe your data has been handled in violation of the NDPA, you may lodge a complaint with us (Section 26) and with the NDPC.

25. Changes to this policy

We may update this policy from time to time. We will revise the version and effective date above and, for material changes, give you notice in the App or by other reasonable means before they take effect. Where a material change affects how we use your information in a way that requires your consent, we will ask for your renewed consent (for example, through an in-app notice requiring you to review and accept) rather than relying on continued use alone. Otherwise, continued use after an updated policy's effective date means the updated policy applies to your future use of the App, except where additional consent is required by law.

26. How to contact us

Friend Indeed Limited (RC 9646567)
Registered office: 30 Ugo Eronini Street, Off Arab Road, Kubwa, Abuja, FCT, Nigeria
Privacy Officer: Dare Adekunle — privacy@friendindeed.app
General support: support@friendindeed.app
EU representative (GDPR Art. 27): ---
UK representative (UK GDPR Art. 27): ---