Privacy Policy

Handbook is an exam-preparation service operating in Nigeria at handbook.ng. We are the data controller for the information described here. You can reach us at hello@handbook.ng.

This policy is written with the Nigeria Data Protection Act 2023 (NDPA) in mind, and reflects how the product actually behaves rather than the broadest permissions we could claim.

Account details. Your email address and a password, which we never see in readable form — it is hashed by our authentication provider. If you sign in with Google, we receive your email address and nothing else from them.

Study profile. Your name, class level, chosen exams and subjects, and — if you choose to give them — your date of birth, interests, hobbies and career ambition. These personalise the AI tutor's explanations. Every field except your class level and subjects is optional, and the product works without them.

Study activity. Practice sessions, the answers you selected, scores, topic mastery and streaks. This is the product: without it there is nothing to show you about where you are losing marks.

AI tutor conversations. Messages you send to the tutor and its replies, so you can return to a conversation later.

Payment records. The plan you bought, the amount, the date and a transaction reference. We do not receive or store your card number — that goes directly to Paystack.

Technical data. Standard server logs, and error reports when something breaks.

We do not sell your data. We do not share it with advertisers. We do not build advertising profiles, and we do not run third-party advertising or analytics trackers on the site.

Our error monitoring is deliberately configured not to attach personal information to crash reports: no IP addresses, no cookies, no request bodies, and no session recordings of your screen. We also strip identifying values such as email addresses and payment references out of the URLs those reports contain.

Only the services required to run Handbook, each handling one job:

Supabase — database and sign-in. Paystack — payments (a licensed Nigerian payment processor). Vercel — hosting. Sentry — error monitoring, hosted in the European Union. AI providers — when you use the tutor, your message and relevant study context are sent to a model provider to generate a reply.

We will also disclose information where the law requires it. If we are ever compelled to hand over data about you, we will tell you unless we are legally barred from doing so.

BECE candidates are typically around 14, and many WAEC and JAMB candidates are under 18. We take that seriously.

If you are under 16, you need a parent or guardian's permission to hold a Handbook account, and they are entitled to see what we hold about you and to ask us to delete it. Because payment requires a card, an adult is involved in every paid account by construction.

We ask for the minimum a study tool needs. We do not require a date of birth, a phone number, a photograph, a school name or a home address, and we never ask a scholar for a parent's financial details.

A parent or guardian can email hello@handbook.ng to request a copy of their child's data or its deletion, and we will act within 30 days.

Under the NDPA you may ask us to show you what we hold, correct anything wrong, delete your account and its data, or export it. You may also object to how we are using it.

Deletion is built into the product: Settings → Delete My Profile removes your account and everything attached to it — profile, subjects, practice history, tutor conversations — in one action. It is immediate and cannot be undone. For anything else, email us and we will respond within 30 days.

Study data stays for as long as your account exists, because its value is the trend over months of revision. Delete your account and it goes with it.

Payment records are kept for seven years after the transaction, which Nigerian tax and accounting rules require and which we cannot delete on request. Error reports are kept for 90 days.

Traffic is encrypted in transit. Access to your data is enforced at the database itself, so one scholar's account cannot read another's even if the application has a bug. Passwords are hashed by our authentication provider and are not readable by us.

No system is perfect. If a breach ever affects your personal data, we will notify you and the Nigeria Data Protection Commission as the NDPA requires.

We set one kind of cookie: the one that keeps you signed in. There are no advertising or tracking cookies, which is why you are not being asked to dismiss a consent banner.

If we change this policy in a way that affects you, we will email you before it takes effect rather than quietly changing the date at the top.

See also our Terms of Service and Refund Policy.