Privacy Policy

1Who we are

trueset is operated by Shipyard Systems, Nigeria, which is the data controller for the personal data described here. This policy covers the trueset website and API. It is written to meet the Nigeria Data Protection Act 2023.

2What we hold

Email address

The address you sign up with.

API keys

Stored only as SHA-256 hashes, with a short prefix so you can tell keys apart. The full key is shown once, when you create it, and cannot be recovered.

Request records

Method, path, status, response size, duration and a request ID. For a request made with a key, the key prefix and account ID.

Usage counts

Requests per key per hour. Your account page shows these.

Payment records

For each payment: the amount, date, plan and Paystack's reference, with Paystack's customer and subscription codes for your account. We never receive or store your card or bank details.

Rate limit counters

Held against your IP address or your account for about a day at most.

Traffic counts

Counts of API requests by hour, endpoint, plan and status, and counts of website page views by day, page and referring site. To count distinct visitors and callers per day we keep a one-way hash of your IP address and browser for up to three days, then keep only the daily total.

3Why we hold it

To run your account

Your email address is used to send sign-in links and messages about your account and plan. We send it nothing else. Basis: our contract with you.

To apply limits and bill

Keys, usage counts, rate limit counters and payment records let us authenticate requests, enforce limits and take payment for plans. Basis: our contract with you, and our legal duty to keep accounting records.

To keep the service working

Request records let us investigate errors and abuse. Traffic counts show us how the service is used and where it is slow. Basis: our legitimate interest in running a reliable, secure service.

4What we do not do

• We do not record IP addresses in request logs.
• We run no third-party analytics, advertising or tracking. Our own traffic counts are described in clause 2.
• We load no third-party scripts, fonts or images. Every asset is served from the site itself.
• We do not sell personal data, and we share it only with the processors in clause 6.

5Cookies and browser storage

We set one cookie, when you sign in. It holds a session token, expires after 30 days, and is marked HttpOnly and SameSite=Lax, so scripts and other sites cannot read or reuse it.

If you switch between the light and dark theme, your choice is saved in your browser's local storage under the name theme. It stays on your device and is never sent to us.

6Who processes it

Three kinds of supplier handle data for us: Paystack, which collects payments and receives your email address and payment details when you subscribe; our email provider, which receives your address to deliver sign-in links; and our hosting and database providers, which store the records in clause 2. They may only use the data to provide their service to us. Some of them process data outside Nigeria.

7How long we keep it

Sign-in links expire after 15 minutes and sessions after 30 days, and both are deleted once expired. Request records and usage counts are kept while your account is open, and deleted when you ask us to delete it. Payment records are kept for six years, as company and tax law require.

8Your rights

You can ask for a copy of the data we hold about you, have it corrected, have your account and its data deleted, or object to how we use it. Email hello@timileyin.dev from the address on your account and we will confirm what we have done.

If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission.

9Children

The service is for businesses and developers. It is not directed at anyone under 18, and we do not knowingly hold their data.

10Changes

We will email the address on your account about any material change to this policy before it takes effect.