Introduction
Kobogist is a digital magazine. You can read stories, browse profiles, search the site, leave a comment, write to the newsroom, and (if you choose) join a newsletter form in the footer.
This policy explains what information that involves, why it happens, and what you can ask us to do about it. It is written for readers in Nigeria, where we publish, and for visitors in the UK and elsewhere who may have additional rights.
Who we are
Kobogist publishes from Lagos, Nigeria, at kobogist.com. For privacy questions, email [email protected].
The registered legal entity name and office address for Kobogist have not been published on this site. Until those are confirmed, treat Kobogist as the controller of personal data described here, and use the email above.
What we collect
We only collect what the site actually uses. Today that is:
Information you give us
- Comments. If you comment on an article, we collect your name, email address, and the comment itself. Comments are reviewed before they appear in public. Your email is not shown next to the comment.
- Contact form. If you write to us from the Contact page, we collect your name, email, chosen topic, and message so we can reply.
- Newsletter form. The footer and some sidebars invite an email address. That signup is stored in your browser only (local storage). It is not currently sent to Kobogist's servers or to an email platform. You will not receive a newsletter from us until that changes — and if it does, we will update this policy.
Information collected automatically
- Google Analytics 4. On the public site in production, and only after you accept analytics cookies, we use Google Analytics to understand which pages are read. That typically includes your IP address (which Google may truncate), device and browser details, approximate location, pages viewed, and referring site. Analytics is not loaded on
/admin(the staff area) or in local development. - Story view counts. When a story is opened, the backend may count the view using a short-lived, in-memory key derived from your IP address so the same visit is not counted repeatedly. That key is not stored as a lasting reader profile.
- Search. Search queries can appear in the page URL (
/search?q=). We use them to return results. They are not used to build a public profile of you. - Hosting logs. Our host (Vercel) and our API host may keep standard server logs — IP address, user agent, and request time — for security and debugging. We do not use these to advertise to you.
Staff-only information
Kobogist has a private publishing area at /admin. Staff accounts use an email and password. A short-lived access token is kept in the browser, and a refresh cookie (refreshToken, httpOnly, 7 days) keeps the session going. Readers do not create accounts, and we do not take payments.
What we do not collect
We do not run a public shop, booking system, or live chat. We do not use advertising pixels (such as Meta or TikTok) on the site today. We do not ask for payment card details. Editors may upload images to Cloudinary; readers are not asked to upload files on the public site.
How we use it
- To publish journalism, profiles, and related pages, and to keep the site working.
- To moderate comments and remove abuse, spam, or unlawful material.
- To reply when you contact the newsroom.
- To understand, in aggregate, which stories people read — if you allow analytics.
- To keep staff accounts secure.
- To remember your light or dark theme preference on this device.
We do not sell your personal information.
Legal bases
Kobogist is published from Nigeria. The Nigeria Data Protection Act 2023 (NDPA) is the main law that applies to us. If you are in the UK, the UK GDPR may also give you rights in respect of our processing.
- Legitimate interests / journalistic purposes — publishing stories and profiles, keeping the site secure, counting views, and moderating comments.
- Consent — Google Analytics cookies on the public site; you can refuse.
- Contract / requested service — answering a message you send us, and operating staff accounts for people who work on the magazine.
- Legal obligation — if we must keep or disclose information to comply with Nigerian law or a binding order.
Journalism has specific protections under Nigerian and UK law. Those protections do not give us a free hand with your comment email or a private message to the newsroom.
How long we keep it
- Published comments stay with the article unless they are removed in moderation or you ask us to delete yours.
- Rejected or pending comments are kept for moderation and abuse review, then removed when they are no longer needed.
- Contact messages are kept long enough to reply and follow up, then deleted from active inboxes in the ordinary course of newsroom work.
- Analytics is retained according to the Google Analytics property settings (typically a rolling window of months, not indefinitely on our side).
- View-count keys expire in memory after about an hour.
- Staff sessions expire with the refresh cookie (7 days) unless renewed.
Your rights
You can email [email protected] to ask us to:
- tell you what personal data we hold about you
- correct it if it is wrong
- delete a comment or a message you sent us, where we can
- restrict or object to some processing
- withdraw analytics consent (you can also refuse cookies on the banner)
Under the NDPA you may also complain to the Nigeria Data Protection Commission (NDPC). UK visitors may complain to the Information Commissioner's Office (ICO). We would rather put it right first — write to us and we will look into it.
We will not usually hand over unpublished journalistic material, confidential sources, or other information that would undermine editorial independence.
International transfers
The site is hosted outside Nigeria (including the United States and the European Union, depending on the provider). Google, Vercel, Cloudinary, and our email provider may process data in more than one country. If you are in the UK or EEA, that is an international transfer. We rely on the providers' published safeguards (such as standard contractual clauses) where they apply. This is a point for legal counsel to confirm against the actual contracts in place.
Children
Kobogist is a general news and culture magazine. It is not aimed at children. We do not knowingly collect personal information from anyone under 13, or under 16 where UK rules on information-society services apply. If you believe a child has sent us personal data, email [email protected] and we will delete it.
Security
We use HTTPS, staff authentication, httpOnly refresh cookies for the publishing desk, and access controls on the API. No website is perfectly secure. Do not send us passwords, bank details, or highly sensitive personal data through the comment form.
Changes
If how the site works changes — for example if the newsletter starts going through a real email service — we will update this page and the date at the top. Continued use ofKobogist after a change means the updated policy applies to that later use.
How to contact us
Privacy questions, access requests, and deletion requests: [email protected]. You can also use the contact form.
What still needs confirming
These points should be confirmed by Kobogist's owner or legal counsel rather than invented here:
- The registered company or business name, and a physical office address.
- Whether a Data Protection Officer has been appointed under the NDPA.
- Whether Kobogist needs a UK representative under UK GDPR (usually relevant if you are established outside the UK and systematically monitor UK users).
- The exact Google Analytics data-retention setting and any Google Signals use.
- Written contracts and transfer tools with Vercel, Google, Cloudinary, and Resend.
- A retention schedule for newsroom email, including contact-form messages.