Privacy Policy

Last updated: 7 November 2026 · Applies to the Legally Unbullied web app (this site)

The short version. Legally Unbullied answers questions about Nigerian law using legal sources and AI. To do that we store your questions and the answers you receive if you have an account; if you use the free guest mode we store an anonymous daily counter, not your identity. We never sell your data, we don’t run ads, and we don’t use tracking analytics. Your conversations are private to you.

1. Who is responsible for your data

Legally Unbullied (“we”, “us”) operates this service from Nigeria. The controller for purposes of the Nigeria Data Protection Act 2023 is the operator of the service. How to reach us is described in section 9.

2. What we collect, and why

Account and sign-in (if you create an account)

• Email and password. Accounts are handled by Firebase Authentication. Your password goes directly to Firebase. We never see, receive, or store it ourselves. Passwords are stored by Firebase using industry-standard hashing.
• Email verification. When you sign up we send a 6-digit code to your email to confirm it is really you (via the OTP flow, or Firebase’s own reset/verification emails).
• Google sign-in (optional). If you choose “Continue with Google”, we receive your Google basic profile (name, email, profile image) from Google. Nothing else about your Google account.

Your questions and answers (signed-in users)

• Questions you ask, the answers we generate, follow-up clarifications, safety approvals you give, and your conversation titles are stored in our database (Google Firestore) under your account only.
• Our security rules restrict each conversation to its owner; other users and anonymous visitors cannot read yours.
• Conversations stay until you delete them (you can delete individual conversations in the app) or until you ask us to delete your account.

Guest mode (no account)

• Everyone gets 3 free questions per day without signing up. To enforce that fairly, we keep a short-lived daily counter in Firestore keyed by a one-way hash of: your IP address, your browser’s user-agent, and a device fingerprint generated in your browser.
• The hash cannot be reversed into your identity, and we never attach your questions or answers to it. Guest counters are day-buckets that reset daily. They are not used for profiling or advertising.
• On your device (your browser), guest state such as remaining free questions and your conversation cache is stored in localStorage. It never leaves your device except as described above.

Feedback on answers (thumbs up / down)

• If you rate an answer, we store the rating. If you are signed in, we also store, together with it, the question you asked and the answer you rated.
• This is deliberate: it lets us trace a failing answer back to the exact exchange and understand where it went wrong, and it is used to improve the quality of the service (including building better training and evaluation data).
• Ratings are stored in a private database readable only by the operator, are never published, and are never shown to other users. Guest users’ ratings are stored on their device only.

Data stored only on your device

• localStorage holds your cached conversation list, the marks showing which answers you already rated, and app preferences. Clearing your browser storage removes it.

Technical and service data

• Our servers (hosted by Render) keep standard logs (IP address, request path, time, status) for security, abuse prevention, and reliability.
• We do not run third-party analytics, advertising, or tracking cookies. The only third parties involved in ordinary use are listed in section 4.

3. What we do not do

• We do not sell, rent, or trade your personal data.
• We do not show ads or build advertising profiles.
• We do not read your messages for any purpose other than operating and improving the service.
• We do not publish your questions, answers, or ratings.

4. Third parties that process your data

• Google Firebase (Authentication, Cloud Firestore, hosting of our backend data). Account credentials and your conversations are stored in Google’s data centres, which may be outside Nigeria (e.g. the United States and European Union). Google processes this data as our processor under its Firebase privacy information.
• AI model providers. To generate answers, the text of your question (and the relevant legal context we retrieve) is sent to the AI provider we have configured at the time (e.g. Groq, Google Gemini, Cerebras or OpenRouter). They process it under their own terms. Do not include information you are not comfortable sharing with an AI provider.
• Hosting (Render). Runs the app and keeps operational logs.
• Legal sources. Quotes of Nigerian law come from public official or reputable publications (e.g. the Laws of the Federation, PLAC compendium, published judgments). These are public documents; the links are shown with each answer.

5. Your rights

Under the Nigeria Data Protection Act 2023 you may request access to, correction of, and deletion of your personal data.

• In the app: delete any conversation and it is removed from our database. Signing out removes the on-device session.
• Full deletion: to delete your account and all associated server data (conversations, messages, feedback you submitted), contact us as described in section 9. We will honour the request, except where retention is required by law.
• You may object to processing or complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

6. How long we keep data

• Conversations & messages: until you delete them or ask for account deletion.
• Feedback (rating + question/answer): retained while we use it to improve the service; deleting your account removes items attributable to you.
• Guest counters: short-lived day-buckets; they roll over daily.
• Server logs: retained as needed for security and reliability, per our host’s defaults.

7. Security

Data is encrypted in transit (TLS). Access to the database is server-side only, protected by Firebase Admin SDK, with Firestore security rules denying all direct client access to internal collections. No security is perfect. If you suspect misuse of your account, change your password and contact us.

8. Children

Legally Unbullied is designed for adults dealing with real-life legal matters in Nigeria. It is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

9. Contacting us, and changes to this policy

Contact. Legally Unbullied is a small, independent project operated from Nigeria; a public support email is not yet published. Privacy questions and requests for access, correction, or deletion can be raised in the app after signing in (e.g. via answer feedback or conversation settings) and will be handled by the operator. If a support address is published later, it will appear here.

Changes. We may update this policy as the service evolves. The “Last updated” date above shows the current version; material changes will be flagged in the app before they take effect.

Remember: Legally Unbullied provides legal information, not legal advice. See our Terms of Service.