Privacy Policy

Draft — awaiting owner sign-off and legal review. This policy describes what the website actually does today, but it has not been approved by the organisation or reviewed by a lawyer, and is not final. It must not be treated as the published policy until both have happened.

Membership accounts

When you register as a member we store your first and last name, email address, phone number, a one-way encrypted form of your password (never the password itself), and whether you joined through the Homebase (Nigeria) or Diaspora path. Depending on the path you choose we also store your hometown, your state of residence, and — for diaspora members — your city, country of residence, country of origin, optional postal address, and your professional interest or area of contribution.

If you had an account on our previous WordPress website, your username and existing encrypted password were carried over so that you can keep using the same login. The stored password is upgraded to a newer encryption format the first time you sign in; we never see or store your password in readable form.

Contributions and donations

We record each membership contribution and donation: the amount, the currency, the payment method used, the status of the payment, and a reference supplied by the payment provider. For monthly memberships we also record the subscription status and the next billing date. If you donate without an account, we store the name and email address you enter on the donation form so we can send you a receipt.

Payment providers

Payments are handled by three providers, chosen by region and payment method: Paystack for Homebase (Naira) payments, and Stripe or PayPal for Diaspora (US Dollar) payments.

You enter your card or account details on the provider's own secure checkout page. Your full card number and security code never reach our servers, and we never store them. When you refresh your subscription from your dashboard, we ask the provider for a summary of the card you are charged on — the brand, the last four digits and the expiry date — so we can show it to you. We display it and discard it; it is never stored.

We send the provider only what is needed to take the payment: your name, your email address, the amount and currency, a description of what you are paying for, and whether it is a membership or a donation. The provider then notifies us of the result. Each provider handles your data under its own privacy policy.

Email we send you

Transactional email is delivered through Resend, which receives your email address and the contents of the message. We send four kinds of message and no others: a welcome email when your membership is confirmed, a receipt for each contribution or donation, a password-reset link when you ask for one, and a notification to our own team when you use the contact form.

Your newsletter subscription

We also offer an optional email newsletter. You are only added to it if you ask to be, by using the subscribe form yourself — it is never bundled with membership or donating, and joining or giving never subscribes you. Ticking nothing is a complete answer.

When you subscribe we send you one email asking you to confirm. We do not send you anything else unless you click the link in it, and if you never click it we delete the address. That step exists so that nobody can sign you up using your address without your knowledge.

We keep your email address, the date you subscribed, and the wording you agreed to, for as long as you stay subscribed. Every newsletter carries a one-click unsubscribe link that works without signing in, and we act on it immediately. Your address is used for the newsletter and nothing else — we do not sell it, and we do not share it with anyone other than the service that delivers the mail for us.

Unsubscribing does not affect your membership, and cancelling your membership does not on its own unsubscribe you. The two are deliberately separate so that neither can surprise you.

The contact form

Messages sent through our contact form are stored in our database with your first name, last name, email address, and the message itself, and are emailed to our team so we can reply. The form includes a hidden field used to detect automated spam.

To stop automated abuse, this form — along with the password-reset and newsletter-signup forms, and no other page — uses Cloudflare Turnstile, a check that confirms you are a person. Your IP address and browser details are sent to Cloudflare for that check. We chose it over Google reCAPTCHA specifically because it does not profile you for advertising and does not follow you across other websites, and we load it only on these three forms rather than on every page.

Analytics

We do not currently run any analytics on this website. We intend to, so that we can see roughly how many people visit and which pages are useful to them. When we do, it will be analytics that does not use cookies, running on our own server alongside the rest of this website — not a service such as Google Analytics.

We have not yet chosen which software we will use. This section will be updated to name it, and to describe exactly how it handles IP addresses, before analytics is switched on. Whichever we choose, we are committing to all of the following, and if we cannot meet them we will not turn it on:

• no cookie, and nothing else stored on your device;
• no identifier that follows you between visits, or between this website and any other;
• your visit is not passed to anyone else — the software runs on our own server, so there is no third party to send it to;
• your IP address is used only momentarily, to work out your approximate country and to tell one visit apart from another on the same day — it is not kept alongside a record of the pages you viewed;
• nothing is linked to your membership record, and none of it is ever used for advertising.

Because analytics of this kind stores nothing on your device and does not identify you, there is nothing for you to consent to and nothing to switch off — which is why this website shows you no cookie banner. If that ever changes, we will ask you first.

Cookies and browser storage

Signing in sets one cookie, which holds a signed session token identifying your account and whether you are an administrator. It exists so that you stay signed in as you move between pages. It is essential to the website working and cannot be switched off. Related cookies keep your sign-in secure and return you to the right page afterwards.

We set no analytics cookies and no advertising cookies, we do not profile you across other websites, and the two typefaces are served from our own domain rather than from a third party. Any other cookie this website sets is listed on our cookies page, which names every one of them and says how long it lasts.

Password-reset links are single-use and expire one hour after they are requested. We store only an encrypted fingerprint of the link, never the link itself.

Who can see your information

Our administrators can see member records, contribution history, and contact-form messages in order to run the organisation. Beyond that, your information reaches only the following service providers, each acting on our behalf:

• the payment provider handling your payment — Paystack, Stripe, or PayPal, as described above;
• Resend, for delivering the transactional emails described above;
• DigitalOcean, which hosts this website and its database for us;
• Cloudflare, which receives your IP address and browser details when you use one of the three forms described above, so it can check you are not an automated program;

Our analytics does not appear in that list because it runs on our own server rather than a third party's, so your visit is not passed to anyone.

We do not sell your information, and we do not share it for advertising or with data brokers.

How long we keep it

Account details, profile details, and contribution history are kept for as long as your account exists. If your account is deleted, your profile and your subscription records are deleted with it; the underlying payment records are retained for our financial records, but are no longer linked to your account. Contact-form messages are kept until we remove them.

Your choices

You can view and manage your membership from your dashboard, and cancel a monthly contribution at any time.

You can also ask us for a copy of what we hold about you, ask us to correct it, ask us to delete your account, or object to what we are doing with it.

To do any of those, email privacy@awujo.org. That address reaches a person, and it is the right one to use for anything about your own data — including a complaint about how we have handled it. You can also use our contact form if you prefer, but the email address does not depend on the form working.

If you are in the United Kingdom, the European Union, or Nigeria, you may also have the right to complain to your national data protection authority.

Changes to this policy

If what we collect or who we share it with changes, we will update this page. It is currently a draft awaiting legal review.

Last updated 17 August 2026.