Privacy Policy

1. Who We Are

FailFastNG is an educational technology platform owned and operated by Failfast Pioneer Systems Ltd (RC: 9433743), a company incorporated in Nigeria. Our registered address is 6, Rotimi Street, Yaba, Lagos, Nigeria. We run two products: FailFast Arena, a competitive knowledge platform with entry tokens, and FailFast EDU, a school management and assessment tool for schools and tutorial centers.

The platform is accessible to users from any country. Paid token features in Arena (buying entry tokens, token challenges, and funded competitions) are restricted to Nigerian users who complete Nigerian identity verification. All other features are available to users worldwide.

This policy explains what personal data we collect from users of our website and applications, how we use it, and what rights you have. It applies to all user types: Challengers, Instructors, Sponsors, School Admins, Teachers, and Students.

We process personal data in line with the Nigeria Data Protection Act (NDPA) 2023 and are registered with the Nigeria Data Protection Commission (NDPC) as required under the Act. Users located outside Nigeria accept that their data is processed by a Nigerian entity under Nigerian law when they use the platform.

2. Data We Collect

2.1 Account and Identity Data

When you create an account, we collect:

Full name
Email address
Phone number
State of residence (used to decide whether paid token features are available to you; at launch they are available in Lagos State only, and users elsewhere keep all features that need no licence. Users living outside Nigeria can leave it blank)
Date of birth (used to age-gate paid token features in Arena; users under 18 may register but cannot buy entry tokens, enter token challenges, or take part in funded competitions until their 18th birthday)
Profile photo (optional)
Username or display name

Nigerian users who activate paid token features in Arena must complete identity verification (KYC), applied in escalating steps. At the first token tier we collect and verify the user's National Identity Number (NIN); the verification result includes the holder's date of birth, which we compare against the date of birth registered on the account to enforce our 18+ requirement for token challenges. At Expert tier and above we additionally collect and verify the Bank Verification Number (BVN). Both are collected and verified through our partner payment platform. FailFast does not store the raw BVN or NIN on its servers. We retain only the verification result (including the date-of-birth consistency outcome) and a reference token returned by the partner platform.

For Instructor and Teacher payouts, we also collect the user's Nigerian bank account number (10-digit NUBAN) so that monthly content payouts reach the correct account.

2.2 Financial and Transaction Data

For users of FailFast Arena who buy entry tokens or take part in group challenges, we collect:

Token balance and token transaction history (purchases, entries, prizes and refunds)
Entry amounts in tokens, prizes won in tokens, and refund records
Hosted competition funding and prize records
Gift card issuance, balance history, and expiry records. Gift cards are only available to Nigerian KYC-verified users aged 18 or older. We record which accounts sent and received gift cards, remaining balances, and usage against individual challenges.
Payment method details processed through our payment platform partner (We do not store full payment card numbers on our servers. The bank account number we collect for Instructor and Teacher payouts is used only to make those payouts.)

For Instructor and Teacher accounts, content payout earnings are tracked in a payout ledger (the amount owed, any tax withheld, and payout history) and paid monthly to the bank account the user registers. For international Instructors outside Nigeria, these earnings accumulate in their payout ledger but cannot be paid out until the platform expands payment infrastructure to their region. The accumulated balance is retained and remains accessible to the Instructor when payout becomes available.

For a parent or guardian who approves a purchase by an under-18 user: the parent’s name and phone number, the result of verifying that phone number against the parent’s own National Identification Number record (we keep the verification result and a reference, not the raw NIN), the parent’s consent record under section 31 of the NDPA, each purchase approval (item, price and time), any monthly cap the parent sets, and any revocation of the link.

For under-18 users who buy learning tokens: the purchase record, the parent link, and the approval history. These records are kept with the transaction records described in Section 7.

2.3 Content and Activity Data

Questions answered, attempts made, and scores earned in FailFast Mine and competitive challenges
Content submitted by Instructors for review and payout calculation
Competition parameters set by Sponsors and Challengers who host competitions
Quizzes and assessments created by Teachers in FailFast EDU
For EDU students who link their school account to an Arena account: qualifying FailFast Mine session data (success points and grit points earned from practice on platform-verified questions) is synced one-directionally from the EDU account to the linked Arena account. The student initiates this sync from the Arena app; it does not run automatically, and nothing transfers until the student chooses to sync. Streaks are not synced; EDU and Arena streaks are independent. The school admin is not notified when a student links accounts.

2.4 Device and Session Data

We automatically collect certain technical data when you use our platform:

Device type, operating system, and browser
IP address (we also use the region it points to as a secondary check on the state of residence you gave us; a mismatch can lead us to review your account, but we do not decide your state from your IP address)
Pages visited and features used
Session duration and time stamps
App focus events: how often the app loses focus during a session, how long each absence lasts, and whether the absence was triggered by a manual app switch, an incoming phone call, or a screen-lock event. This data is used for anti-cheat scoring integrity and is described further in Section 5.
Per-question response times, collected silently during every session to support anomaly detection

2.5 School and Institutional Data (EDU Only)

For FailFast EDU, School Admins provide:

School name, address, and contact details
Class structure and student enrollment lists
Student names and class levels (e.g., SS2, JSS3)

Student accounts in FailFast EDU are created and managed by the school administrator. A student email address is optional and is not required to create or use a student account. The school administrator provisions student credentials and can reset them when needed. Parents or guardians of students under 18 should contact their school admin regarding how student data is managed within the school's account.

A student’s FailFast Arena activity, including token balance, challenge entries, and prizes, is never visible to the school, even when the student has linked an Arena account. The school sees only the student’s EDU activity.

For EDU school token pools: the school’s token purchases and allocations to teacher and class budgets, rewards paid to students, and tokens returned to the pool at term end. Students never pay for tokens. These records sit in the school’s tenant, are visible to the School Admin, and are never visible to other schools. If a Teacher funds a self-funded reward fund, we record the purchase and the one-way transfer into the fund; the School Admin sees the reward given, not the Teacher’s purchases.

3. How We Use Your Data

3.1 To Operate the Platform

Create and manage your account
Process token purchases, challenge entries, prize crediting, refunds, and hosted competition funding
Check your state of residence to decide whether paid token features, such as buying tokens or gift cards and entering paid challenges, are available to you
Track scores, tier progression, streaks, and leaderboards
Generate and deliver questions matched to your subject preferences and difficulty tier
Calculate Instructor and Teacher content payouts based on question usage in group challenges
Verify parent approval for purchases by under-18 users and apply any cap the parent has set

3.2 To Protect Platform Integrity

FailFast uses behavioral data to detect and prevent cheating. This includes monitoring per-question response times, app focus events, and answer pattern anomalies. A full description of what is collected and how it is used is in Section 5.

3.3 To Communicate With You

Send account verification and transaction confirmation emails
Notify you of challenge results, tier changes, and streak updates
Respond to support requests
Send product updates (you can opt out of non-essential communications at any time)

3.4 To Comply With the Law

We may use or retain your data where required by Nigerian law, including for tax reporting, regulatory audits under gaming regulation, or responses to valid legal requests.

4. Legal Basis for Processing

Under the NDPA 2023, we process your data on the following grounds:

Contract performance: Processing your account and transaction data to deliver the services you signed up for.
Legitimate interest: Protecting the platform against fraud, cheating, and abuse.
Legal obligation: Retaining financial records and complying with regulatory requirements, including gaming regulation.
Consent: Where you have given consent, such as for optional communications, for EDU student data collected under school admin authorization, or by a parent or guardian when linking to a child’s account under section 31 of the NDPA.

For users located outside Nigeria: by registering for and using the platform, you accept that your data is processed by a Nigerian entity under the NDPA 2023. FailFastNG does not currently offer jurisdiction-specific processing arrangements for other countries' data protection laws. If this is a concern, you should not register for the platform.

5. Anti-Cheat Monitoring

Because FailFast Arena involves paid token challenges, we take scoring integrity seriously. The following data is collected passively during sessions and used only for integrity purposes.

5.1 Per-Question Response Time

The platform records how long each question stays on screen before an answer is submitted. Users who consistently take an unusually long time on questions they get right on the first attempt are flagged for review, since that pattern can indicate using an external tool to look up answers.

5.2 App Focus Events

When you switch away from the app during an active session, the platform logs that a focus loss occurred, how long you were away, and the type of event. Manual app switches, incoming phone calls, and screen-lock events are each tracked and weighted differently in the anomaly scoring. Phone calls and screen-lock events are given less weight than deliberate app switches.

On return from a focus loss, a non-accusatory overlay is shown briefly before you can continue. In competition mode (group challenges, sponsored competitions, hosted competitions), the overlay lasts 10 seconds and the session timer does not pause during your absence or during the overlay. In practice mode (FailFast Mine and Rookie free challenges), the overlay lasts 5 seconds and the session timer does not pause while you are away. In Adventurer mode, the overlay also lasts 5 seconds and the timer likewise does not pause; the overlay cannot be disabled. Leaving the screen always costs session time in every mode, a deliberate light anti-cheat measure.

The cumulative count of focus losses and total time away during a session contribute to an anomaly score. A single focus loss in a long session is treated as a normal interruption. A pattern of switching away on most questions is flagged for manual review.

5.3 Statistical Anomaly Detection

Accounts with sustained high first-try success rates combined with slow per-question response times are flagged automatically for manual review. This combination is the clearest behavioral signal of AI-assisted cheating.

5.4 How This Data Is Used

Anti-cheat data is used only for scoring integrity purposes. It is not sold or shared with third parties. Users can request a review if they believe a flag was applied to their account in error.

5.5 Automated Decision-Making

The anti-cheat system makes automated decisions based on behavioral data. These decisions can result in an account being flagged, tokens won being held, or a competition result being voided. No account suspension or permanent termination is applied based on automated detection alone. A human review confirms any significant action taken against an account.

Under the NDPA 2023, you have the right not to be subject to decisions that significantly affect you based solely on automated processing. If you believe an automated flag or decision has been applied to your account incorrectly, you may request a human review by contacting us at privacy@failfastng.com. We will respond within 10 business days.

6. Who We Share Your Data With

We do not sell your personal data. We share it only in the following cases:

6.1 Payment Platform Partner

To process token purchases, gift card purchases, school invoices, and Instructor and Teacher payouts, we pass transaction data to our payment platform partner. That partner operates under their own privacy policy and is responsible for securing payment credentials.

6.2 Question Content Providers

We source questions from third-party APIs, including public exam question providers. We do not share your personal data with these providers.

6.3 Legal and Regulatory Bodies

We will share data with Nigerian regulatory authorities, law enforcement, or courts if required by a valid legal order.

6.4 Service Providers

We use third-party services for hosting, analytics, and communications. These providers are bound by data processing agreements and may only use your data to deliver services on our behalf. This includes the SMS providers that deliver one-time codes to parents who approve purchases by under-18 users.

6.5 Internal Cross-Product Data Sync (EDU to Arena)

When an EDU student initiates a sync after linking their school account to an Arena account, qualifying practice data flows internally from the EDU tenant to the Arena user record. This is a read from the student's own session records only. No other school data, no teacher notes, no admin settings, and no data from other students is accessed or transferred. Data never flows in the opposite direction: Arena activity, token history, and challenge records are never visible in the school dashboard.

6.6 Cross-Border Data Transfers

FailFastNG hosts platform data on Oracle Cloud Infrastructure (OCI). The hosting region is configured to support the platform's position under the NDPA 2023. FailFastNG also uses other third-party infrastructure providers to operate the platform. Some of these providers store or process data on servers located outside Nigeria. Where this occurs, we ensure that appropriate safeguards are in place as required by the NDPA 2023, including data processing agreements with those providers that bind them to data protection standards consistent with Nigerian law. The types of international providers we use include cloud storage and hosting services, analytics and monitoring tools, and communication platforms. We do not transfer data to a country whose laws do not provide adequate protection for personal data without first putting appropriate contractual safeguards in place.

6.7 Sponsors in Opportunity-Prize (Employability) Competitions

Some sponsored competitions carry opportunity prizes (for example, job interview slots, internship places, training seats, or certificates). If you register for one of these competitions, you give explicit consent at registration for FailFastNG to share your name, contact details, and performance profile with the sponsoring organization if you win, so that the prize can be delivered. By default only the winner's details are shared; where a sponsor requests details of other top performers, each of those users is asked individually and nothing is shared without their opt-in. Separately, users may choose to make a performance profile (subject tiers, score percentiles, competition placements, and streak history) publicly shareable via a link they control; this is off by default and can be revoked at any time, after which the link stops working. Sponsors who receive your details are independent organizations responsible for their own handling of your data; we share only what is needed to deliver the prize and we record what was shared and when.

7. How Long We Keep Your Data

Active account data: Retained for as long as your account is open.
Transaction and token records: Retained for 7 years in line with Nigerian financial record-keeping requirements. This covers token purchases, refunds, challenge entries, prizes, parent approval records, and EDU school token ledgers and school token pack purchase records.
Parent link and consent records: Kept while the child’s account is open and for 7 years afterwards, with the transaction records, to evidence the consent.
Anti-cheat session logs: Retained for 90 days after a session, unless an investigation is in progress.
EDU student data: Retained for the duration of the school's active subscription. On subscription termination, student personal data is deleted within 60 days unless the school requests an earlier deletion. The school's token ledger and token pack purchase records are financial records and are kept for 7 years with the other transaction records; student personal data linked to them is still deleted on the 60-day timeline.
Inactive accounts: Accounts with no activity for 24 consecutive months will be flagged for archiving. We will send a notice to the registered email address giving the user 30 days to log in and reactivate the account. If no response is received within that 30-day period, the account will be archived and personal data deleted, except for any data we are required to retain under Nigerian law.

8. Your Rights

Under the NDPA 2023, you have the right to:

Access: Request a copy of the personal data we hold about you.
Correction: Ask us to correct inaccurate or incomplete data.
Deletion: Request that we delete your data, subject to legal retention requirements.
Restriction: Ask us to stop certain types of processing.
Objection: Object to processing based on legitimate interest.
Portability: Receive your data in a structured, machine-readable format.

To exercise any of these rights, contact us at the address in Section 12. We will respond within 30 days.

EDU students, or their parents and guardians, should direct requests through the School Admin, who manages data within the school's tenant environment.

9. Cookies

Our website uses cookies to keep you logged in, remember your preferences, and measure how the platform is used. You can control cookie settings through your browser.

We do not use cookies to serve third-party advertising.

10. Minors and Children

Users under 18 may register for FailFast Arena and use the platform's free features: FailFast Mine, tier progression, leaderboards, streaks, and free challenges. All token challenge features, including buying entry tokens, group challenges, hosted competitions, and sponsored competitions with token prizes, are hidden from accounts where the verified date of birth shows the user is under 18. Under-18 users may buy learning tokens for in-app uses with a parent’s approval, as described below.

Access to token challenges is protected by three independent layers. The first is the platform's own age gate, which hides token challenge features and never displays entry or prize amounts to under-18 accounts. The second is NIN verification at the first token tier: the NIN record includes the holder's date of birth, which we compare against the date of birth registered on the account, so a false date of birth entered at registration is detected at the first activation attempt and any contradiction freezes token activity pending review. The third is CBN regulation: BVN (Bank Verification Number) is only issued by Nigerian banks to individuals aged 18 and above, which independently blocks underage users at the Expert tier and above. These layers together mean underage access to token challenges is structurally blocked by platform controls, identity verification, and statutory banking regulation.

The NDPA 2023 requires parental or guardian consent before processing the personal data of a child. FailFast Arena collects date of birth and basic account information at registration from all users, including users under 18. By registering, a user under 18 confirms that they have obtained the consent of a parent or guardian before providing their personal data to the platform. FailFastNG relies on this confirmation at the point of registration. If a parent or guardian wishes to withdraw consent or request deletion of their child's data, they may contact us at privacy@failfastng.com. We will process such requests within 30 days.

Parent-approved purchases of learning tokens. A parent or guardian links to the child’s account once, using a phone number verified through the parent’s own National Identification Number record. At that link we ask for the parent’s consent under section 31 of the NDPA. Each purchase then needs a one-time code sent to the parent’s phone by SMS; the message names the item and the price so that the approval is informed. The parent may set a monthly cap, see the purchase history, and revoke the link at any time. We keep the verification result and a reference, not the raw NIN.

FailFast EDU is designed for use in school environments and holds data belonging to students, many of whom are under 18. In those cases, the School Admin acts as the data controller for their institution and is responsible for ensuring appropriate parental or guardian consent is obtained before creating student accounts. Parents or guardians of students under 18 should direct privacy queries to the school. Students never pay or play for money in EDU, and EDU student data is completely separate from Arena.

If we become aware that an under-18 Arena user has entered a token challenge before their 18th birthday, we will immediately suspend token activity and investigate. Confirmed underage challenge entry will result in account suspension and return of the entry tokens.

11. Security

We apply technical and organizational measures to protect your data, including encrypted connections, access controls, and regular security reviews. No system is fully secure, and we cannot guarantee that data will never be compromised, but we take reasonable steps to reduce that risk.

To support offline practice and low-data use, question content is cached in an encrypted local database on your device, using AES-256 encryption through SQLCipher. The encryption key is held in your device's hardware-backed secure storage. The local data is wiped when you log out.

As part of our information-security controls, privileged access to user data by platform staff and automated jobs is recorded in an append-only audit log. This record cannot be altered after the fact and helps us monitor how user data is accessed.

If a data breach occurs that is likely to affect your rights or freedoms, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required by the NDPA 2023. We will also notify affected users without undue delay once the nature and scope of the breach has been confirmed and notification would not compromise any ongoing investigation.

12. Contact Us

If you have questions about this policy or want to exercise your rights, contact our Data Protection Officer at:

Email: privacy@failfastng.com

Mailing address: 6, Rotimi Street, Yaba, Lagos, Nigeria

We aim to respond to all privacy requests within 30 days.

13. Changes to This Policy

We may update this policy when the platform changes or when legal requirements shift. We will post the updated version on our website and notify registered users by email at least 14 days before the changes take effect. Continued use of the platform after that date means you accept the revised policy.