This is placeholder draft content written for the current mock version of OurMoni. It has not been reviewed by a qualified Nigerian fintech lawyer, does not reflect final company or regulatory decisions, and must not be treated as legally binding or as proof of compliance.

Account and profile information you provide, such as your name, email address and phone number.

Verification information submitted for identity and bank account checks.

Wallet and transaction records created by using the app, including savings, Ajo, Friendship Pool, Project Savings and Organizer Group activity.

Support communications, including tickets and messages you send us.

Device and security information such as session and login activity shown on your Security page.

Notification preferences you set in the app.

To provide the savings, wallet, group-management and support features you use.

To verify your identity where required and to help prevent fraud.

To maintain accurate records of your contributions, goals and group activity.

To respond to support requests and keep you informed through notifications you've opted into.

Paystack processes wallet funding, currently in test mode only — no real-world money moves through it yet, but it does receive your email and the amount you're funding with, same as any real Paystack checkout.

Resend delivers account and activity emails on our behalf (new-device sign-in, password changes, goal/project milestones, withdrawal-request outcomes, group contributions).

No identity-verification, bank-payout, or SMS provider is integrated yet. This section will name each one and describe its role the moment it goes live, not before.

Your transaction PIN is never stored in plain text — only a one-way (bcrypt) hash is kept, the same way a password is. Nobody at OurMoni, including engineering, can read it back.

Wallet balances, transfers, and contribution history are real, persisted financial records now (not a simulated local value) — kept in our database behind row-level security so you can only ever see your own.

Final security practices beyond what's described here (formal encryption-at-rest standards, access-control policy, incident-response process) will be documented once confirmed.

Retention periods have not yet been finalised and are not stated here as fact — see the open business decisions below.

You can request account closure from Profile → Account. In this mock version that only updates your local app state — no real data is deleted or retained anywhere yet.

A dedicated contact channel for privacy requests will be published here once confirmed.