Privacy & Cookie Policy · Lagos Life and Vatar

Published by Vatar

This Privacy & Cookie Policy explains what information we collect, why, who processes it for us, how long we keep it and the choices you have. It covers:

the Vatar: Life in Your City app for iPhone and Android (the "Vatar app");
the game on the web at lagoslife.app, naijalife.app and lagoslife.eliysites.com; and
the other services we run with them (support, the report form, advertising and partner stores).

Vatar and Lagos Life are operated by Vatar, Nigeria ("Vatar", "we", "us", "our"). Lagos Life is our first world: the Vatar app and the website are the same game, with one account, so this one Policy applies to both.

For the purposes of data protection law, including the Nigeria Data Protection Act 2023, Vatar decides why and how your personal data is processed, except where another company acts independently under its own legal obligations (for example an app store or a payment provider).

1. The Short Version

We collect what the game needs to work: your account, your saved game, what you say and share in the game, and basic technical and safety signals.
We do not track you across other apps or websites, we use no advertising identifier, we have no advertising network or analytics company in the app, and we do not sell your personal data.
We never use GPS. We only know roughly where you are (your city and region) from your network.
Live voice (Spaces and voice chat) is never recorded. An automated safety check may turn what speakers say into text as they talk; that text is thrown away unless it breaks the community rules.
Billboards and sponsors only ever get totals per ad, never anything about you.
You can delete your account in the game (Settings → Account → Delete account) or at lagoslife.app/delete. You have 30 days to change your mind.
Players aged 13 to 17 play in a separate teen space, away from adults, with extra protections (section 13): nothing a teen writes is sent to an AI company, teens see only the game's own house ads, and we collect no more from them than the game needs.

2. Scope

This Policy applies to information processed in connection with:

your account and sign-in;
gameplay and your saved game;
chats, voice notes, live voice rooms, posts and other social features;
purchases and payments;
support, reports and safety;
push notifications;
advertising, sponsorships and partner stores;
the websites, the Vatar app and cookies or similar technologies.

3. Information We Collect

Account information

your email address (for sign-in help and password resets);
your username, display name and a user ID we create;
your password, stored only as a protected hash, never as readable text;
your date of birth, used for the age check and to keep teens and adults apart (see section 13);
your answers to the "owner questions" you can use to get back into your account; and
account status, security events (such as a password change) and the time the account was created.

Device identifiers

a device ID we create on your phone or browser, used so one account plays on one device at a time and to spot account takeovers; and
a push token for each phone or browser where you allow notifications.

We do not collect your phone's advertising identifier (IDFA or Google Advertising ID). The Android app removes that permission.

What you say and share in the game

chats, direct messages and group messages, reactions and stickers;
voice notes you send, and songs players add in clubs;
what you say out loud in live voice rooms (Spaces, and voice chat at venues and in homes). It goes live to the people in the room and is never recorded or stored. While the safety check is on, what a speaker says is turned into text as they talk, in short pieces, to check it against the community rules; the audio is never kept, and the text is thrown away at once unless it breaks the rules (see section 11). Every room the check covers shows an "AI safety check" sign. Private 1:1 voice chats (just you and one other player) are covered by the safety check too, the same as Spaces, and their audio is never recorded or stored;
pictures you choose to attach, such as a billboard picture you book or a screenshot in a problem report. Players can't send or post photos in chats, Lagos Gist or anywhere else in the game;
posts and comments on Lagos Gist, bios, business and campaign texts and other things you write in the game; and
reports, blocks and the messages you send to support.

Other players can see what you post publicly or send to them. Direct messages are not end-to-end encrypted: they are stored on our servers so they can be delivered, and the team can read a chat that is reported to them.

Gameplay information

your saved game: your Sim and its look, money, homes, jobs, skills, items, businesses and progress;
in-game money moves, purchases, transfers between players, bets and other game events; and
your in-game social graph: friends, family, partners, followers and groups inside the game. We never read your phone's address book or contacts.

Purchases

what you bought, when, the amount, the currency and the transaction reference.

We never receive or store your full card or bank details: the payment provider or the app store handles those.

Location

your approximate location (city, region and country) worked out from your network address by Cloudflare. We use it to count visits, to show where a sign-in came from in your security alerts, and to suggest the world you start in.

We never collect precise location and never use GPS. Your Sim's location in the game is a place in the game world, not where you are.

How you use the game

product interaction: when you open the app, daily visits, streaks and which parts of the game are used, so we can keep it working and improve it; and
billboard and sponsor counts: how many times each in-game ad was seen or tapped, counted per ad, never per player. Sponsors only get these totals.

Crash and performance information

crash reports (with your username if you are signed in) and "slow to load" reports, so we can fix problems; and
technical details such as your IP address, device and browser type, operating system, app version and server logs.

Device signals for security

To fight fraud, bots and stolen accounts we combine technical signals from your device, browser, session and network. These signals are used only for security and abuse prevention, never to build an advertising profile.

Advertisers and partners

If you or your business books advertising or a sponsorship, or sells through a partner store, we process your contact and business details, the campaign or order, the creative materials and the payment records.

4. What We Do Not Collect

your name as on an ID, your phone number or your home address (except a delivery address you give a partner store, which is kept sealed and removed later);
precise or GPS location;
your phone's contacts, photo library (except a picture you choose to attach), health or fitness data;
your browsing or search history outside our services; or
any advertising identifier.

We do not offer sign-in with social accounts.

5. Why We Use Your Information

We use information to:

create and run your account, sign you in and keep it secure;
save your game and keep it the same on every device;
run the game's economy, social features, elections, courts and events;
deliver chats, voice notes, live voice rooms and notifications;
process purchases and keep proper records of them;
keep players safe: separate teens from adults, filter chats, check what's said in live voice rooms, act on reports, stop fraud, bots and account takeovers;
answer support requests and problem reports;
count visits and fix crashes and slow loading;
report ad and sponsor totals to advertisers;
comply with the law and defend legal claims.

6. Legal Bases

Under the Nigeria Data Protection Act 2023 (and similar laws where you live), we rely on:

Contract: to provide the game and the features you ask for, save your game and process purchases;
Legitimate interests: security, fraud and abuse prevention, keeping the economy fair, fixing and improving the game, and moderation, where those interests are not overridden by your rights;
Legal obligation: accounting, tax, payment and other legal duties, lawful requests and court orders; and
Consent of a parent or guardian: for a teen's data, where the law requires it (section 13); and
Consent: for push notifications (you can turn them off at any time in Settings or on your phone), the microphone for voice notes and live voice rooms, and any non-essential cookies.

7. Cookies and Similar Technologies

The website uses necessary cookies to keep you signed in, protect your account, prevent fraud and remember settings you choose. The Vatar app keeps the same sign-in token in your phone's secure storage instead of a cookie.

We do not use advertising or cross-site tracking cookies. If we ever add non-essential cookies, we will ask first where the law requires it.

Some third-party content inside the game, such as football highlights (ScoreBat), loads only when you play it, and its provider's own policy then applies.

8. Advertising Inside the Game

Ads in the game are billboards, branded places, sponsor buttons and similar placements inside the game world. They are the same for everyone in a place: they are not targeted using your personal data, your location or your activity outside the game. Advertisers only ever receive totals per ad.

9. Who Processes Your Information

We do not sell your personal data and do not share it with anyone for their own advertising. We use these service providers, who process data only to provide their service to us:

Cloudflare: hosting, security, the website and app servers, live voice rooms (including turning what speakers say into text for the safety check, in memory only), bot checks, storage for voice notes and pictures, and approximate location from your network;
Amazon Web Services (AWS): our main database and servers, and sending account emails;
Google Firebase Cloud Messaging: delivering push notifications to the Vatar app (only a push token and the notification itself; no Firebase Analytics);
Apple and Google: as the app stores, they distribute the Vatar app and, when in-app purchases are offered, take those payments under their own terms;
Flutterwave: payments on the website and orders from partner stores (Bachs handled website payments made before 6 October 2026);
OpenAI: answers from the in-game helper, the Live Court's AI judge (including turning voice notes said in court into text), checks on pictures, checks on the text of what's said in live voice rooms (never the audio), and the automatic check of what adults post in public (Lagos Gist, Hustle, names and similar), only for the text, audio or picture involved. Nothing a teen writes or says is sent to OpenAI: the teen space is checked by our own rules only; and
Resend: a backup for sending account emails.

Earlier copies of the game's data from before 4 October 2026 are held read-only by DigitalOcean, our former host, until they are deleted.

Website-only real-money features, such as an IPO offer, may also pass the details you enter to the companies named on that screen (for example the payment provider, an identity check and the issuing house), with your agreement on that screen.

We may also disclose information where the law requires it, to respond to lawful requests or court orders, to investigate fraud or crime, to protect players or the public, or as part of a reorganisation or sale of our business, with the same protections.

10. International Transfers

Our main database and servers run on AWS in London, United Kingdom (eu-west-2); Cloudflare serves the game from its network around the world; OpenAI and Google process data in the United States. So your data is processed outside Nigeria, including in the United Kingdom, the European Union and the United States. Where data leaves Nigeria we rely on the safeguards the Nigeria Data Protection Act 2023 allows, such as contractual protections and the providers' own security commitments.

11. How Long We Keep Information

Your account and saved game: for as long as your account exists.
Voice notes: deleted automatically after 90 days.
Live voice: never recorded or stored. When the safety check finds that something said broke the rules, the text of that moment and of about the 45 seconds before it is kept for the team's review and any appeal, then its words are deleted after 90 days.
Sign-in sessions: until you log out or they expire (60 days on the website).
Push tokens: until you turn notifications off, log out or delete your account.
Security, fraud and moderation records and payment and purchase records: as long as needed for those purposes and as the law requires, even after an account is deleted (see section 12).
Visit and crash data: only as long as it is useful for keeping the game running.

12. Deleting Your Account

You can delete your account at any time:

in the game or the Vatar app: Settings → Account → Delete account; or
on the web: lagoslife.app/delete.

We ask for your password and a second tap to confirm. Then:

you are logged out everywhere at once, your notifications stop and your phones' push tokens are deleted;
your account stops appearing to other players;
for 30 days you can change your mind simply by logging in again, and everything comes back as it was;
after 30 days your account can't be brought back and is set for erasure: your saved game, email, date of birth, profile, settings, relationships, friends lists and device data are erased, and the voice notes you sent are removed from storage, by our deletion job;
your username is reserved for 90 days so nobody can pretend to be you.

Some records are kept without your name on them because other players or the law need them: chats and posts other players received stay with them, shown as from "Deleted player"; payments, receipts and money sent between players stay in the ledger; election votes stay counted with your ID replaced; and safety reports and court records stay. Nothing in them links back to your deleted account.

If you can't log in, reset your password from the login screen first, or ask the team (see lagoslife.app/help).

13. Teens and Children

Vatar is for people aged 13 and over. We ask for a date of birth when an account is made; it can't be changed later except to correct an obvious slip. Players aged 13 to 17 play in a separate teen space, where it is open (on the website first; the Vatar app's sign-up stays 18+ for now). Where the teen space isn't open, accounts must be 18 or over.

The Nigeria Data Protection Act 2023 gives children's personal data extra protection (section 31). For players aged 13 to 17:

Separate and minimal. A teen's account and everything they do live in a separate teen database. We collect only what the game needs: the account (username, display name, email, password as a hash, date of birth), the saved game, what they write in the game, and the technical and safety signals in section 3. No phone number, no photos (nobody can send or post photos in the game), no precise location.
No advertising profiles. Teens only see the game's own house ads, never targeted ads, and never marketing emails.
No AI companies. Nothing a teen writes or says is sent to OpenAI or any other AI company: the teen space is checked by our own rules. Teens can't use the in-game AI helper, the AI court, live voice rooms or real-money purchases.
Private by default. Other players find a teen only by their exact username; where a teen is and whether they're online shows only to their contacts; new chats come from contacts only.
Parents and guardians. The game has a guardian-consent step (a parent or guardian approves by email before a teen can message anyone or trade). We switch it on wherever the law requires a parent's or guardian's consent. A parent or guardian can also ask what we hold about a teen, ask for it to be corrected, or have the account deleted, by writing to support@vatar.com with the teen's username.
Turning 18. On their 18th birthday a teen's account moves to the adult game with their game money, homes and look; the links made in the teen space end.

We do not knowingly allow children under 13. If we learn an account belongs to a child under 13, we close it and delete its data.

How we keep teens safe, in plain words, is at lagoslife.app/child-safety, and our standards against child sexual abuse and exploitation are at lagoslife.app/child-safety-standards.

14. Security

We protect information with access controls, password hashing, encrypted connections (HTTPS only; the Vatar app refuses unencrypted connections), account alerts, the option to lock a stolen account, transaction ledgers, monitoring and server security. No service on the internet can be perfectly secure, so please keep your password private: the team will never ask for it.

15. Your Rights

Under the Nigeria Data Protection Act 2023, and similar laws where you live, you have the right to:

be told how your data is used (this Policy);
get a copy of your personal data;
have wrong data corrected;
have your data deleted (see section 12);
restrict or object to some processing;
receive your data in a portable form where the law provides it;
withdraw consent at any time (for example, turning off notifications); and
ask for a human to review a decision made only by automated means that significantly affects you.

To use these rights, contact us (section 19). We may need to confirm the account is yours first. You can also complain to the Nigeria Data Protection Commission.

16. Automated Security and Safety Decisions

Automatic checks may flag activity as suspicious from account, money, device, session or network signals, and may hold a transfer, limit sending for a while, ask for extra checks or mute an account that keeps breaking the chat rules. You can ask the team to review any of these through Settings → Contact support or lagoslife.app/help.

In live voice rooms, the safety check may warn a speaker, mute them for the rest of the room, remove them, or end a Space, and pause their voice chat for a while. Talk about self-harm is never punished: the speaker is shown where to find support. You can appeal any of these from the notice in the room ("Think we got it wrong?") or at lagoslife.app/report, and a person on the team will review it.

17. Messages From Us

We send emails for your account: password resets, verification, security and service messages. We send emails about offers and events only if you turn them on (Settings → "Emails about offers and events"; adults only, off by default, and you can turn them off at any time). We do not send marketing SMS or WhatsApp messages. Push notifications are about your game (messages, knocks, money received and similar). You can turn them off in Settings or in your phone's settings.

18. Changes to This Policy

We will update this Policy when the game, our providers or the law change. The effective date at the top shows the current version, and we will tell you in the game about important changes.

19. Contact

For privacy questions, requests or complaints:

Vatar
Operator of Lagos Life and of the Vatar app (Vatar: Life in Your City)
Nigeria
Website: lagoslife.app
Help: lagoslife.app/help
Contact: support@vatar.com
Data protection contact: support@vatar.com, with "Privacy" in the subject, for requests under the Nigeria Data Protection Act 2023