Privacy Policy

Welcome to Kamp (accessible via our mobile application and kamp.ng). Kamp is an anonymous, campus-only social platform built for Nigerian university students to share, connect, and express themselves freely.

At Kamp, privacy isn't an afterthought—it is our core product. We have engineered our systems specifically so that your anonymous posts can never be traced back to your real identity, even by us.

This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application and services.

1. Our Core Promise: True Anonymity

Unlike traditional social networks, Kamp does not track who you are.

• No Profiles: We do not collect names, phone numbers, bios, or profile pictures.
• Volatile Aliases: When you participate in live group chats (Kampfires) or make posts on the main feed, you can post using temporary, post-scoped or room-scoped aliases (e.g., Skeptic Owl). These aliases are completely isolated from your account and cannot be used to track or cross-reference your activity across different posts. Kampfire aliases are deleted entirely when the chat room expires.
• Cryptographic Isolation: Your posts and comments are stored with a unique, server-generated cryptographic signature called a poster_id. This ID is a SHA-256 hash of your account ID combined with a secret database key (SHA-256(user_id + POSTER_SECRET)). This signature is generated server-side. Even in the event of a database breach, it is mathematically impossible to decrypt these hashes to reveal your email.

2. Information We Collect

To keep the platform safe, authentic, and limited strictly to verified students, we collect the following:

A. Verification Information (Stored Separately)

To join a campus community, you must verify your student status. We collect:

• School Email Address: (e.g., student@unilag.edu.ng, student@mcu.edu.ng).
• Google Sign-In Credentials: If you choose to authenticate via Google, we receive your email address.
• Alternative Manual Verification (Student ID): If your university email is inactive or inaccessible, you may submit a photograph of your student ID card to our support team for manual verification.
  • Data Minimization: We use this image strictly to verify your student status. Once verified or rejected, the image is permanently deleted from our support channels within 48 hours and is never linked to your activity on the platform.
• Security Guard: Your verified email address is stored in a highly secure, restricted database table that is completely separated from the public feed. The mobile app client cannot query this table.

B. User-Generated Content

We store the content you voluntarily post to the platform to display it on the feed:

• Posts, comments, votes (upvotes/downvotes), and optional image attachments.
• Bandwidth Optimization: Images do not auto-load; they only load on tap to save mobile data (this can be changed in Preference settings).

C. Temporary Conversation Data (Kampfires)

For ephemeral group chats (Kampfires):

• Messages and room-scoped aliases are stored temporarily.
• When a Kampfire's countdown timer reaches zero, all messages, members, and aliases associated with that room are permanently and automatically deleted from our servers.

D. Device and Log Data

For security and rate-limiting purposes, we collect:

• Device type, operating system version, and IP address.
• We use this data strictly to prevent spam (e.g., restricting accounts to 10 posts per hour), block bot attacks, and enforce bans on bad actors.

E. Location and Geolocation Data

To protect your spatial privacy, we do not access, request, or store your device's precise GPS coordinates. We map you to your campus feed (e.g., UNILAG, UI, OAU) strictly using your verified school email domain. While we check IP addresses temporarily to block DDoS attacks and spambots, we do not log your IP address in correlation with your posts or account identity.

3. How We Use Your Information

We use the collected data to:

1. Verify Your School: Ensure you are a real student at an approved Nigerian university.
2. Deliver the Local Feed: Automatically place you in the correct campus feed (e.g., UNILAG, UI, MCU) based on your verified email domain.
3. Prevent Spam and Abuse: Rate-limit posts and implement a community-driven flagging system to prevent harassment.
4. Send Push Notifications: Alert you when other students reply to or upvote your posts (optional and can be disabled).

Notification Token Isolation

To deliver real-time notifications without compromising anonymity, your device’s push token (e.g., Apple APNS or Google FCM token) is stored in a separate database table. When someone replies to your post, our server resolves the cryptographic link to fetch the target token and push the alert. Your push token is never linked to the posts or comments themselves in any queryable way, keeping notification routing fully separate from feed activity.

4. How We Share Information

• We Never Sell Your Data: Kamp does not, and will never, sell or rent your personal information, email, or posts to third-party advertisers or data brokers.
• Legal Compliance and Safety: We may disclose your registration email or log data only if legally required to do so by a valid court order, subpoena, or if we believe in good faith that disclosure is necessary to prevent immediate, serious physical harm to a student or member of the public.

5. Moderation, Flagging, and Banning

To protect the community, we use a decentralized flagging system:

• If a post or comment is flagged by multiple students for harassment, hate speech, or sharing private personal details (doxxing), it is automatically hidden.
• If a user is banned for violating community guidelines, their account is flagged as "banned" in our restricted verification database. Because of our cryptographic system, we can block a device or email from posting without ever knowing which specific posts on the feed belonged to them.

6. Your Rights and Data Deletion

You have full control over your presence on Kamp:

• Deleting Posts: If you delete a post or comment you created, it is instantly removed from the public feed.
• Account Deletion: You can request account deletion at any time through the app. Upon deletion, your email is wiped from our verification tables, and the cryptographic link to your posts is permanently broken.

7. Regulatory Compliance & NDPA 2023

Kamp operates in strict compliance with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR). As a data controller, we are bound by the core principles of data protection:

• Data Minimization: We only collect the minimal verification data needed to confirm your student status (school email/ID). No name, phone number, or photos are ever collected to build user profiles.
• Storage Limitation: Expired group chat data (Kampfires) and student ID verification images are deleted automatically within their designated short-term retention periods.
• Security and Confidentiality: Your data is secured with industrial-grade cryptographic hashes and stored in separated, isolated databases.
• Right to Erasure (Right to be Forgotten): Upon deleting your account, all verification records are permanently expunged, and historical posts are completely orphaned.

8. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact the Kamp Team:

• Email: support@kamp.ng
• Website: kamp.ng