Privacy policy

Last updated 29 September 2026

Refera is a service for sharing Nigerian academic work. This policy explains how Refera handles personal data under the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Act General Application and Implementation Directive 2025. Contact [email protected] about this policy or your data. Refera is the data controller for information collected through this site.

Information we collect

• Account details: name, email address, password hash, university, department, profile name, biography, and optional profile image.
• Google sign-in details: Google's account identifier, verified email address, and name. We use these to create or connect your Refera account. We do not ask for access to your Google Drive, contacts, or mail.
• Contributions: paper details and PDF, ownership evidence, reference notes, saved papers, and copy requests. Ownership evidence remains available to Refera reviewers, not other users.
• Withdrawal details, if you request a withdrawal: amount, bank name, account name, and account number.
• Technical data needed to deliver and protect the site, such as request logs, IP address, and a session cookie.

Why we use it

We use account details to provide your account, confirm your email, and authenticate you. We use contribution and activity data to review submissions, display approved papers, record references, and manage credit balances. We use bank details only to review and settle withdrawal requests. We use technical data to operate, secure, and troubleshoot the service. These activities are necessary to provide the service you request, protect the service and its users, and meet applicable legal obligations. We do not use Google sign-in data for advertising or sell it.

What others can see

Other users can see approved paper titles, abstracts, academic details, author names, public profile details, and reference counts. They cannot see your password, bank details, ownership evidence, or email address through the public paper listing. If someone requests a copy of your paper, their name and email address are shown to you so you can respond. Please avoid putting private information about others in a paper or profile unless you have the right to share it.

Service providers and transfers

Cloudflare hosts the site, database, and uploaded files. Google provides optional sign-in. Resend sends account confirmation emails. These providers process data for their respective services and may process it outside Nigeria. Contact us for information about these transfers. We may disclose information when the law requires it or to address abuse and security incidents.

Cookies and security

Refera uses an essential, secure, HTTP-only session cookie to keep you signed in. Google sign-in may use Google's own cookies during authentication. Cloudflare may process security and operational request data. Passwords are stored as salted hashes. Uploaded ownership evidence and bank details are restricted to authorised account and review flows. No internet service can guarantee absolute security.

How long we keep information

Sessions expire after 30 days unless you sign out sooner. We keep account, contribution, and transaction records while needed to run Refera, resolve disputes, and meet legal obligations. Approved papers may remain available until removed following a valid request or review. We assess deletion requests individually, including whether records must be retained for legal or accounting reasons. Backups and provider logs may take additional time to expire.

Your choices and rights

You may ask to access, correct, delete, or receive your personal data, or object to or restrict certain processing. You may withdraw consent where consent is the applicable basis. Email [email protected] from your account address with your request. We may need to verify your identity before responding. You can also complain to the Nigeria Data Protection Commission. If you use Google sign-in, you can also manage Refera's access in your Google account.

Children and updates

Refera is intended for people aged 18 or older. If we learn that a child has registered, we will review and remove the account as required. We may update this policy as the service changes. The updated date above shows the current version; material changes will be communicated through the site or email where appropriate.