Privacy Policy
1. Who we are and what this policy covers
Wreddi ("Wreddi", "we", "us") runs the Wreddi exam-preparation service for Nigerian university students. We decide why and how your personal data is used, which makes us the "data controller" under the Nigeria Data Protection Act 2023 (the "NDPA") and its regulations.
This Privacy Policy explains what personal data we collect, why, who sees it, how long we keep it, and the choices and rights you have. It applies to the Wreddi website, web app and related services. By creating an account or logging in, you agree to this policy and consent to the processing it describes. If you do not agree, please do not use Wreddi.
2. The data we collect
Information you give us
- Account details: full name, matric number, username, password (we store only a one-way scrambled "hash", never the password itself), phone and WhatsApp numbers.
- Profile and academic details: your university, department, the courses you select, and, if you choose to enter them, your GPA, target GPA, grading scale and course results used by the GPA tools.
- Your study activity: questions you answer, scores, quiz history, weak topics, streaks, flashcard and revision progress, study plans, written-exam answers and marks, contest and leaderboard results, and achievements.
- Content you submit: AI chat messages, the questions you ask by typing or voice, notes or study material you paste in, questions you generate with the AI, messages in study rooms, and reports you send about questions.
- Support and payment records: upgrade, account-recovery and question-report requests; activation codes you redeem; and records of payments we confirm (plan, amount, method, reference). Payments are arranged with us directly, for example over WhatsApp, and we do not collect or store your card or bank-account details in the app.
- Credits and referrals: your credit balance and transactions, transfers you make or receive, and referral codes and referral relationships.
Information collected automatically
- Device and connection data: IP address, browser and device type (user-agent), and a device identifier we generate so we can recognise a new device logging in to your account.
- Usage and security logs: which pages and features you use, the time of requests, errors, login attempts and session activity. We use these to keep accounts safe, fix bugs and understand how the Service is used.
- Local storage on your device: described in our Cookies & Storage notice.
Information from others
If a friend shares a quiz or challenge link with you, we see that you opened it. If you sign up through someone's referral code, we link the two accounts so that referral rewards can be given.
3. How and why we use your data
Under the NDPA we rely on the following lawful bases. Where we rely on your consent, you give it by creating an account or logging in after reading this policy, and you can withdraw it (see "Your rights").
| What we do | Why | Basis |
|---|---|---|
| Create and run your account, log you in, keep it secure, detect misuse and new-device logins | To provide the Service you asked for and keep it safe | Contract; legitimate interests |
| Provide practice, quizzes, written exams, study tools, GPA tools, leaderboards and contests | Core features | Contract; consent |
| Generate questions, answers, explanations and marks with AI | AI features (see "AI processing") | Consent; contract |
| Review AI-written questions and add approved ones to the question banks | To improve and grow the Service for all students | Legitimate interests; consent |
| Confirm payments, activate plans, issue activation codes, handle support requests and account recovery | To deliver paid plans and help you | Contract; legal obligation |
| Send in-app notices, announcements and service messages | To keep you informed about your account and the Service | Contract; legitimate interests |
| Measure usage, find and fix problems, improve content and plan new features (using aggregated and de-identified figures where we can) | To improve the Service | Legitimate interests |
| Prevent fraud, cheating, abuse and security incidents; enforce our Terms | To protect students and the Service | Legitimate interests; legal obligation |
| Comply with the law and respond to lawful requests | Legal duties | Legal obligation |
We do not sell your personal data. We do not use it to show third-party advertising.
4. AI processing
When you use AI features (AI quizzes, written exams, the study assistant, explanations, and AI-written study notes or guides), the text you submit, such as your prompts, topic, any notes you paste in, and your written answers, is sent securely to a third-party AI service provider so that it can produce the result. The provider processes that text on our behalf to return a response. We choose our providers carefully, but we do not control their systems; you should not put into the AI features anything you would not be comfortable sending to such a provider (for example, other people's personal details, passwords or confidential documents).
AI output can be wrong. We store the AI output you receive (for example generated quizzes, chat replies and marks) in your account so you can review it. See our AI Disclaimer.
5. Voice questions
If you use the microphone button in the study assistant, your device's browser (for example Chrome) may send your voice to its own speech-recognition service to turn it into text. That happens between your browser and its provider under the provider's own privacy terms. Wreddi does not receive or store your audio: we only receive the text that appears in the message box. The microphone is used only when you tap the button, and you can deny permission in your browser settings. Spoken answers are read aloud by your device's own text-to-speech.
6. AI-written questions and our review team
Questions the AI writes for you (in an AI quiz or a written exam) are copied to an internal review queue together with the matric number of the account that triggered them. Our admins review these questions and may approve them for the Wreddi question banks. Approved questions appear to other students without your name, username or matric number. Questions generated from notes or material that you paste in yourself are not sent for review. Rejected or unreviewed items stay in our internal queue.
7. Who we share your data with
Service providers (processors) who help us run Wreddi, only as needed to provide their service: cloud hosting; our database provider; our AI provider; and content delivery networks that serve fonts, icons and scripts (these see your IP address and browser when your device loads them). If you contact us on WhatsApp, WhatsApp's own terms apply to that conversation.
Our admin team can see account, academic, activity, support and payment information as needed to run, support and secure the Service, and can generate performance summaries for individual students. Admin access is limited by role.
Other students see only what the Service is designed to show (see the next section).
Authorities and professional advisers. We may disclose information where the law requires it, to respond to a valid legal request, to protect rights, safety and security, or to our lawyers and auditors. If Wreddi is sold or reorganised, personal data may be transferred to the new owner, who must honour this policy.
8. What other students can see
- Your username (and sometimes your first name) and score information on leaderboards, in contests, in study rooms, in shared quiz links and in challenge links. Where the app offers a setting to opt in or out of public leaderboards, we follow it.
- A quiz or challenge link shows the course, the number of questions and (for a challenge) your score to anyone who opens it. It does not show your matric number.
- When you send credits to another student, they see your username.
- Your matric number, phone and WhatsApp numbers and GPA are not shown to other students.
9. Transfers outside Nigeria
Some of our providers (for example hosting, AI and content-delivery services) process data on servers outside Nigeria. Where we transfer personal data abroad, we do so as the NDPA permits, for example to providers with appropriate safeguards, and we take reasonable steps to make sure your data is protected to a comparable standard.
10. How long we keep your data
We keep your personal data for as long as your account is active and for a reasonable period afterwards where needed for the purposes in this policy: for example to resolve disputes, keep payment and activation records, prevent repeat abuse, meet legal obligations, and keep backups. Technical and security logs are kept for a shorter period. When data is no longer needed we delete it or anonymise it so that it can no longer identify you. Approved questions in the question banks are kept without any link to you.
11. How we protect your data
We use measures that are appropriate to the risk, including encrypted connections (HTTPS), hashed passwords, access controls and role-based admin permissions, device recognition on login, rate-limiting, and logging. No system is perfectly secure, so we cannot guarantee absolute security. Please protect your password, log out on shared devices, and tell us if you notice anything suspicious. If a personal data breach occurs that is likely to put your rights at risk, we will act and notify the Nigeria Data Protection Commission and affected people as the NDPA requires.
12. Your rights
Under the NDPA you have the right to:
- Access your personal data and get information about how we use it;
- Correct data that is wrong or incomplete (you can edit most details in your profile);
- Delete your data, where we have no legitimate reason or legal duty to keep it;
- Restrict or object to certain processing, including processing based on legitimate interests;
- Receive your data in a portable format, where applicable;
- Withdraw your consent at any time (this does not affect processing done before you withdrew, and some features cannot work without the data they need); and
- Complain to the Nigeria Data Protection Commission (NDPC) if you believe we have not handled your data properly.
To use these rights, or to ask for your account to be deleted, contact Wreddi through the Support option inside the app and tell us who you are (your matric number and username) so that we can verify the request. We aim to reply within 30 days. We may ask for proof of identity, and some information may have to be kept where the law requires it. Deleting your account removes your access and, once data is deleted, your progress and credits cannot be restored.
13. Children and young people
Wreddi is intended for university students aged 16 and over. If you are under 18, you must have your parent or guardian's permission to use Wreddi and to agree to this policy. If we learn that we have collected personal data from someone younger than 16, or from a minor without the required permission, we will delete it. A parent or guardian who believes this has happened should contact us.
14. Cookies and local storage
Wreddi does not set advertising or tracking cookies. It stores a small amount of information in your browser's local storage (for example to keep you signed in). See our Cookies & Storage notice.
15. Links to other sites
Wreddi may link to or open other sites and apps (for example WhatsApp). We are not responsible for their content or privacy practices.
16. Changes to this policy
We may update this policy from time to time. When we do, we will change the version and date at the top and, for material changes, tell you in the app where reasonable. Continuing to use Wreddi, or logging in after a change, means you accept the updated policy. If you do not accept it, stop using Wreddi and ask us to delete your account.
17. Contact and complaints
For privacy questions, requests or complaints, contact Wreddi (attention: our data protection contact) through the Support option inside the app.
You may also contact the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.