SikaLegal
Privacy Policy
Effective 2026-10-21
Sika is built so that we hold as little about you as possible. This policy explains what we do process, why, and the choices you have.
1. Who we are
Sankofa Network ("Sika", "we", "us") provides the Sika messaging app, the relay and push services that support it, and this website. We are the controller of personal data described in this policy. Our address is Akwa Ibom State. You can reach us at privacy@sikaos.app.
2. The short version
- Messages, photos, files and call audio are end-to-end encrypted. We cannot read or listen to them.
- You do not need a phone number or email address to use Sika. You can add one if you want friends to find you or want to move to a new phone.
- If you add a phone number or email, we keep a scrambled form of it and which Sika key it belongs to. We never see your messages.
- Some features we plan (public channels, cloud backup) would need us to process more. They are not live yet. If one is added, we change this policy first and tell you in the app before it applies to you.
- We do not show advertising, we do not sell personal data, and this website sets no cookies and runs no tracking.
3. What we process, why, and for how long
| Data | Why | Lawful basis | Kept |
|---|---|---|---|
| Relay mail metadata: sender key, recipient key, size, time | To deliver sealed messages to people who are offline and to prevent abuse of the service | Contract; legitimate interests | Until delivered, and for at most 30 days if undelivered |
| Push registration: your public key and a device token from Google Firebase Cloud Messaging | To wake your phone when something is waiting | Contract | Until you turn notifications off, the token expires, or you remove the app |
| Wake-up signal: the recipient key and whether it is a message or a call | To send the wake-up. It carries no sender and no content | Contract | Not stored |
| Connection data: the network address your phone connects from, and the app version and processor type when it checks for updates | To keep the connection open, to deliver an update built for your phone, and to defend our services against abuse | Legitimate interests | Only for the life of the connection and in short-lived operational logs. We do not use it to build a profile of you |
| Call set-up messages and relayed audio | To connect calls. Audio is encrypted between the phones | Contract | Not stored by us |
| Group invitations and preview requests | To let an administrator confirm a group to a person who holds an invitation | Contract | Held on the administrators' phones |
| Orders in SikaPay: parties, description, amount, steps | To run escrow between two users and resolve disputes | Contract; legal obligation | As long as needed to resolve disputes and meet legal duties |
| Verification: the phone number or email you add, the one-time code, and the Sika key that asked for it | To send you a code and confirm the number or email is yours | Consent; contract | The number or email is held only while the code is valid (10 minutes), then kept only as a scrambled one-way form. The code is deleted when used or expired |
| Account: a scrambled one-way form of your verified phone number or email, the Sika key it belongs to, your optional username, and whether people may find you | So friends can find you and so you can move to a new phone | Consent; contract | Until you remove it or delete your account. We cannot turn the scrambled form back into your number |
| Friend lookups: scrambled forms of numbers a phone asks about | To tell you which of them are on Sika | Consent | Not stored. Daily limits apply. A scrambled phone number can still be guessed by someone who tries every number, so we limit lookups, and you can switch off being found in Settings, Account |
| Feedback: message, topic, optional rating and contact, and from the app the app version, phone model and language | To improve Sika and reply when you ask us to | Consent; legitimate interests | Up to 24 months |
| Spam protection: a daily-rotating, one-way hash of your network address | To limit abuse of the feedback form | Legitimate interests | Up to 24 hours |
| Download counts by day, file and build | To understand adoption. Not linked to you | Legitimate interests | Aggregated, no personal data |
| Server logs at our hosting provider | Security and reliability of the website | Legitimate interests | Short-lived, as set by the provider |
Your profile picture and About line are sent only to your contacts, as end-to-end encrypted messages. We do not receive them. Messages you send to our support address pass through our email routing provider to our mailbox, and we keep them as long as needed to answer you.
Your account keys, chats, contacts, files and settings are stored on your phone. We do not receive them. If you create a backup, it is a file that only you can open with the code you set.
4. What we never process, and what the app asks your phone for
We never process the content of your messages, photos, files or call audio, and we never hold your private keys.
The app asks your phone for permissions only for the feature that needs them: notifications and full-screen alerts, to tell you about messages and incoming calls; the microphone, for calls and voice notes; the camera, to scan codes; your contacts, only when you tap Find friends, and only to compare scrambled phone numbers with the people who allow being found (the list itself never leaves your phone); and the photos, videos and files you choose to send. Anything you send travels as end-to-end encrypted messages. The app does not read your location or call history. You can withdraw any permission in your phone's settings; the matching feature then stops working.
5. Who receives data
We use infrastructure providers as processors under written terms, for example Vercel (website hosting), Neon (the website's database), Cloudflare (domain name, email routing for our support addresses, and file storage for app downloads), GitHub (software releases), Google Firebase Cloud Messaging (push wake-ups), Africa's Talking (text messages with sign-in codes), Resend (emails with sign-in codes), and managed database and hosting providers for the relay and order services. They process data only on our instructions. We disclose data to authorities only where the law requires and only what the law requires. Because content is end-to-end encrypted, we cannot disclose it.
6. International transfers
Our providers may process data in countries other than your own. Where required, we rely on recognised safeguards such as standard contractual clauses.
7. Your rights
Depending on where you live, including under the GDPR, the UK GDPR, the Ghana Data Protection Act, the Nigeria Data Protection Act, the Kenya Data Protection Act and the South African POPIA, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to receive it in a portable form, and to withdraw consent at any time. To exercise a right, email privacy@sikaos.app. We respond within 30 days. You may also complain to your data protection authority.
Most data about you lives on your phone, where you control it. You can delete it at any time from Settings or by removing the app.
8. Security
We protect data with end-to-end encryption, encrypted storage on your phone, minimal retention, access controls and signed releases. See our security overview. No system is perfectly secure, and we will notify you and the relevant authority of a breach where the law requires.
9. Children
Sika is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has used Sika, contact us and we will act promptly.
10. Cookies
This website sets no cookies and uses no analytics or advertising trackers.
11. Changes
If we change this policy in a way that matters, we will update the effective date above and tell you in the app before the change takes effect. In particular, before we start to process anything not listed in section 3, such as phone numbers or email addresses for sign-up, a contact list for finding friends, or public posts, we will add it here, explain why and for how long, and ask for your consent where the law requires it.
12. Contact
Sankofa Network, Akwa Ibom State, Nigeria. privacy@sikaos.app.