Draft for legal review. This text is not in force yet. It describes how DOE works today and will be finalised with our lawyers before launch.
The short version
- Your personal and group chats are end-to-end encrypted and live on your phone. Our servers pass them along and delete them once they are delivered, after 45 days at most if never delivered.
- We never read your messages, and ads never use them. Ads appear only in public places like Updates and Discover, for the kinds you choose.
- Doe Pay money is held by licensed partner banks, not by DOE. DOE gives no loans.
- You can see, correct and delete your data. Ask in the app or at doe.chat/delete-account.
What we collect and why
| What | Why |
|---|---|
| Phone number | To create your account, send your sign-in code and let people who have your number find you. |
| Name and profile photo | So people know who they are talking to. Your photo is optional. |
| Your contacts, if you allow it | To show which of your contacts use DOE. Your phone sends scrambled versions of the numbers (hashes); we compare them and keep nothing. |
| Device details | Device type, the public keys that encrypt your chats, and a push token so your phone hears about new messages. |
| Sign-in codes | When a code was sent to which number, kept for a day, so we can stop abuse. |
| Reports you make | If you report someone, the last 5 messages of that chat are shared with our safety team, by you, to review. |
| Support chats | What you write to DOE Support or to a business through DOE, so they can help you. These chats are not end-to-end encrypted. |
| Calls | Who called whom, when and for how long, so the call can ring and be shown in your history. |
| Our websites | Visitor counts without cookies. A support chat on a website keeps a random key in your browser so the chat continues. |
Your messages
Personal and group messages, photos, voice notes and files are encrypted on your phone before they leave it, using the Signal Protocol approach (PQXDH and the Double Ratchet; Sender Keys for groups). Only the phones in the chat can open them. You can check a chat’s safety number to make sure no one sits between you.
Our servers hold an encrypted message only until your phone collects it, and 45 days at most. Photos and files are stored encrypted for 45 days so they can be downloaded, and statuses for 1 day. Chat backups are encrypted and saved to your own Google Drive when you turn them on; we can’t read them.
Voice calls travel through our call servers encrypted on the way, but are not yet end-to-end encrypted. Chats with businesses and with DOE Support are kept by the business and by DOE to help you, and are not end-to-end encrypted. The chat tells you so.
Doe Pay
Doe Pay is only for people verified in a country where it is live (Nigeria first). A licensed partner bank opens your wallet, holds your money and checks your BVN or NIN with your consent. DOE keeps only a scrambled fingerprint of that number, never the number itself, so one ID can’t open two wallets.
Payment records (amounts, who paid whom, when, receipts) are kept in a separate payments system for as long as financial law requires, even after you delete your account. Partner banks keep their own records under their licences.
Ads
Ads never appear inside private chats and never use what you write. You choose which kinds of ads you see, or none. Do Not Disturb holds promotions and bulk messages; sign-in codes, receipts and delivery updates still arrive. Businesses can message you in bulk only after you asked them for updates. We count views and taps to bill advertisers, not to build a profile of you.
Who we share with
We don’t sell your data. We use these providers to run DOE, under contracts that limit them to doing that:
- Our server host: the rented server in the EU that runs our database and servers. We will name the company here before launch.
- Cloudflare: encrypted file storage, our websites and cookie-free visitor counts.
- Google (Firebase) and Expo: delivering notifications to your phone. Google Drive holds your backup only if you turn it on.
- LiveKit: carrying voice calls.
- SMS providers: sending sign-in codes.
- Licensed payment partners: running Doe Pay. We will list them here when Doe Pay opens.
We share information with authorities only when the law requires it, and we can only share what we have: we can’t hand over the content of your end-to-end encrypted chats. Some providers process data outside Nigeria; where they do, we use the safeguards the Nigeria Data Protection Act requires.
How long we keep things
| What | Kept for |
|---|---|
| Encrypted messages waiting for delivery | Until delivered, 45 days at most |
| Encrypted photos, voice notes and files | 45 days |
| Statuses | 24 hours |
| Call records | 90 days |
| Sign-in code log | 1 day |
| Your account and profile | Until you delete your account |
| Payment records | As long as financial law requires |
Your rights
You can ask to see the data we hold about you, correct it, get a copy, object to how we use it, withdraw consent you gave, or delete your account. Ask DOE Support in the app (You → Help) or at doe.chat/doe, or email support@doe.ng. To delete your account, use doe.chat/delete-account: we confirm it is your number and delete the account within 30 days. If you are unhappy with our answer, you can complain to the Nigeria Data Protection Commission.
Children
You must be 13 or older to use DOE, and older where your country’s law requires it. Doe Pay is only for adults who pass the partner bank’s checks.
Security
Chats are end-to-end encrypted, the chat database on your phone is encrypted, and every table on our servers only lets each person reach their own data. Staff tools need two-factor sign-in and every staff action is logged. No system is perfect; if something goes wrong we will tell you and the regulator as the law requires.
Changes and contact
If we change this policy in a way that matters, we will tell you in the app first. Questions: support@doe.ng or chat with DOE Support.