Skip to content
PhoneCity

Privacy Policy

Effective date: August 14, 2026

Last updated: August 14, 2026

This Privacy Policy explains how PhoneCity collects, uses, shares, stores, and protects personal data when you use our mobile application, website, listing share pages, and related services.

1. Who We Are

PhoneCity is operated by PHONECITY TECHNOLOGIES, Registration No. 9338297. For purposes of applicable data protection law, including the Nigeria Data Protection Act 2023, PhoneCity is the data controller for the personal data described in this Policy.

Privacy enquiries and rights requests: privacy@phonecity.ng. General support: support@phonecity.ng.

2. Scope

This Policy applies to PhoneCity's mobile app, phonecity.ng, limited public listing and Reel share pages, account services, moderation and support operations, and communications sent by PhoneCity. It does not govern independent sellers, buyers, payment providers, social-login providers, or other third parties when they process data for their own purposes.

3. Personal Data We Collect

3.1 Data You Provide

  • Account and authentication data, including username, email address, password credentials in protected form, verified phone number, and social-login identifiers.
  • Profile and store data, including store name, profile image, bio, optional private first and last name, state, LGA, and public shop addresses.
  • Listing data, including mobile-phone details, price, location, seller contact number, images, optional Reel video, and additional notes.
  • User content and safety data, including reviews, ratings, reports, report notes, blocks, and communications with support.
  • Boost and Featured-listing purchase and support data, including the selected listing, the product purchased, order status, payment-provider reference, transaction status, amount, currency, payment channel, fees, adjustments, disputes, refunds, reversals, and support notes. PhoneCity does not receive or store your full card, bank, USSD, or other payment-instrument details.
  • Verification and recovery data, including email and SMS OTP activity.
  • Identity and business verification data, when you choose to verify to earn a trust badge: your BVN or NIN for identity verification, and your business registration (RC/BN) number for business verification. These are submitted to our verification provider to confirm a match. PhoneCity does not retain your full BVN or NIN — only the verification outcome, a masked identifier, a one-way reference used to prevent the same identity being reused across accounts, and, for businesses, the registered company name and registration number. For the optional final step, a selfie (biometric facial image) is captured and matched against your NIN photo; the selfie and the re-supplied NIN are sent to our verification provider to run the match and are not retained by PhoneCity — only the match outcome is kept.

3.2 Data Collected Through Use of the Service

  • Contact-reveal records, including the buyer, seller, listing, Call or WhatsApp channel, Listing or Reel source, date and time, IP address where captured, and user agent where captured.
  • Recently viewed listings for authenticated users, limited to the most recent 50 until cleared or deleted.
  • Share counts, listing and Reel status activity, moderation actions, reports, reviews, Boost and Featured activity, payment verification activity, and notification status.
  • Device and technical data, such as device platform, push-notification token, IP address, user agent, request identifiers, security events, and application or server logs.
  • Website and admin cookie data. Essential cookies support security and sessions. Non-essential cookies will be used only in accordance with the cookie choices presented to you.
  • Mobile crash information through Sentry where enabled. PhoneCity configures crash reporting not to intentionally include user PII.

3.3 Data From Other Sources

  • Google, Apple, or Facebook when you choose social login, such as provider account identifier and available verified email information.
  • Our payment providers, Monnify and Paystack, including payment status, reference, transaction identifier, channel, fees, refunds, reversals, disputes, and chargeback-related information.
  • Cloudflare Stream processing status and media metadata for Reels.
  • Our identity-verification provider, QoreID, including the identity, business, and face-match verification outcome and limited derived details such as the registered company name and registration number for a verified business. PhoneCity does not receive and retain the underlying government-record photo, date of birth, or residential address returned during a check.
  • Other users, where they submit reviews, reports, or safety complaints concerning you or your content.

4. Public and Private Information

Your username, store name, profile image, bio, verification badge, state/LGA, shop addresses, active and sold listings, listing images, eligible Reel previews, and received reviews may be public in the app or on limited share pages. First and last name, email, account phone number, and any identity or business verification data you submit are private by default; only the resulting verification badge is shown publicly.

A seller's listing contact number is disclosed only to authenticated mobile-app users who use a controlled contact-reveal action, subject to blocking and rate limits. Once disclosed, the buyer and seller communicate outside PhoneCity, and PhoneCity cannot control how either party uses information shared during that interaction.

5. Why We Use Personal Data

Provide the service

Create and secure accounts; publish and display listings; enable discovery, contact reveal, reviews, reports, blocks, recently viewed listings, Reels, Boosts, Featured listings, payments, and notifications.

Verify and protect

Verify phone numbers and emails; verify seller identity (BVN or NIN), business registration (CAC), and — as an optional final step — a selfie matched against the ID photo, through our verification provider to award trust badges; prevent abuse; enforce rate limits; investigate fraud, stolen or prohibited devices, safety incidents, disputes, and policy violations.

Moderate

Review listings and Reels before publication; handle reports; issue warnings; suspend, ban, decline, hide, or remove content and accounts.

Process Boosts and Featured listings

Initialize and verify checkout with our payment providers; activate Boosts and Featured placements; issue receipts; reconcile payments; handle adjustments, reversals, disputes, and support.

Communicate

Send OTPs, service notices, moderation decisions, Boost, Featured, and payment messages, account warnings, and respond to support requests.

Operate and improve

Maintain security, troubleshoot errors, measure limited operational activity, keep audit records, and improve reliability.

Comply with law

Meet legal, regulatory, tax, accounting, consumer-protection, data-protection, law-enforcement, and legal-claims obligations.

6. Legal Bases

Depending on the activity and applicable law, PhoneCity processes personal data because it is necessary to perform our agreement with you, because you have given consent, because we have a legitimate interest in operating and protecting the marketplace, or because processing is necessary to comply with law, protect vital interests, or establish, exercise, or defend legal claims. Where we rely on consent, you may withdraw it, but withdrawal does not affect earlier lawful processing.

7. How We Share Personal Data

We may share personal data with:

  • Other users and the public, as described in the public-information and contact-reveal sections above.
  • Monnify and Paystack for Boost and Featured checkout, payment verification, refunds, reversals, disputes, chargebacks, and payment support.
  • Cloudflare R2 for listing images and avatars, and Cloudflare Stream for Reel upload, encoding, storage, thumbnailing, and playback.
  • Resend for email delivery, SmarthiveSMS for SMS delivery, and Firebase Cloud Messaging for push notifications.
  • QoreID for seller identity (BVN/NIN) and business (CAC) verification.
  • Google, Apple, and Facebook when you choose their login services.
  • Sentry and hosting, database, security, professional-adviser, and operational service providers used to run and protect PhoneCity.
  • Authorities, regulators, courts, law enforcement, or other parties where required by law or reasonably necessary to protect rights, safety, users, or the public.
  • A buyer, investor, successor, or adviser in connection with a merger, financing, restructuring, sale, or transfer, subject to appropriate protections.

PhoneCity does not sell personal data.

8. International and Cross-Border Processing

PhoneCity launches from Nigeria, but some providers, including Cloudflare, Resend, Firebase/Google, social-login providers, Monnify, Paystack, Sentry, and related infrastructure providers, may process or store data outside Nigeria. Where personal data is transferred across borders, PhoneCity will use lawful transfer mechanisms and reasonable contractual, organizational, and technical safeguards required by applicable law.

9. Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including account operation, safety, moderation, payment support, legal compliance, dispute resolution, and enforcement. Retention depends on the type of record and applicable requirements.

  • OTP, refresh-token, device-token, block, address, and recently viewed records are deleted when no longer needed or as part of account deletion, according to the service design.
  • Recently viewed listings are limited to the most recent 50 and may be cleared by the user.
  • Rolling application file logs are planned for 14-day retention; warning-level database logs and records needed for incidents may be retained longer.
  • Financial, Boost, Featured, payment-adjustment, moderation, report, notification, contact-reveal, and received-review records may be retained after account deletion where needed for legal, accounting, safety, audit, fraud-prevention, or platform-integrity purposes.
  • Soft-deleted records and backup copies may remain for a limited period until securely overwritten or no longer required.

10. Account Deletion and Data Export

You may request a data export through the app. The export is designed to include profile, address, listings, Listing Reels, reviews authored and received, reports submitted, contact reveals, notifications, Boost and Featured orders and windows, payments, and adjustments.

Account deletion is immediate and irreversible from your perspective. You are logged out everywhere, public listings disappear, and your username is freed for reuse. PhoneCity redacts direct PII and deletes certain operational data, but retains the records described above where necessary. There is no restoration path.

11. Your Rights

Subject to applicable law and lawful limitations, you may request access to, correction of, deletion of, or a copy of your personal data; object to or request restriction of certain processing; withdraw consent; and lodge a complaint with the Nigeria Data Protection Commission. We may verify your identity before acting on a request.

To exercise your rights, email privacy@phonecity.ng.

12. Security

PhoneCity uses reasonable administrative, technical, and organizational safeguards, including HTTPS, access controls, password protection, short-lived access tokens, rotated hashed refresh tokens, OTP protections, rate limits, signed or pre-signed media access, payment verification, audit logs, and separate staging and production environments. No system is completely secure, so we cannot guarantee absolute security.

13. Children and Minors

PhoneCity accounts, contact reveal, listing creation, reviews, reports, and Boost or Featured purchases are for persons 18 years or older. Minors may view publicly available PhoneCity content only under the supervision of a parent or legal guardian. PhoneCity does not knowingly permit minors to create accounts or transact through the service. If you believe a minor has provided personal data to PhoneCity, contact privacy@phonecity.ng.

14. Cookies and Similar Technologies

The website and admin services use essential cookies for security, sessions, and core functionality. PhoneCity will present a cookie banner for non-essential cookies and will respect available consent choices. The mobile app may use local storage, device tokens, and similar technologies needed to provide app features.

15. Third-Party Services and Links

PhoneCity may link to payment-provider checkout pages (Monnify or Paystack), WhatsApp, phone dialers, app stores, social platforms, and other third-party services. Their privacy practices are governed by their own policies. Review those policies before providing information to them.

16. Changes to This Policy

We may update this Policy to reflect service, legal, or operational changes. We will post the updated version and revise the effective date. Where required, we will provide additional notice or obtain consent.