Privacy
Privacy policy
How TimesPosts Media Ltd handles personal data, written under the Nigeria Data Protection Act 2023.
Last updated 27 September 2026
Who is responsible
TimesPosts Media Ltd is the data controller for TimesPosts. You can reach us at Dorayi, Kano, Kano State, Nigeria, or by email at legal@timesposts.com.
Reading the site
You do not need an account to read TimesPosts, and we do not run advertising or third-party analytics on it. We do not set any tracking cookie, and there is no cookie banner because there is nothing to consent to.
Reading a page involves three things worth knowing about:
- Server logs. Our hosting provider records the usual request data, including your IP address, the page requested and your browser’s user agent. This exists to keep the site up and to deal with abuse.
- Article counters. When you open a story your browser tells us to add one to that story’s read count. The counter is a single number on the story. It is not linked to you, and nothing about you is stored. Your browser keeps a marker so the same story is not counted twice in one session; that marker never leaves your device.
- Day or night edition. If you switch the colour theme, the choice is saved in your browser’s local storage. It is not sent to us.
When you give us something
| Newsletter | We store your email address, the date and where you signed up, so we can send the edition you asked for. Lawful basis: your consent. Withdraw it at any time using the unsubscribe link or by writing to us. |
| Contact form | We store your name, email address, the topic, your message, your IP address and your browser’s user agent. The address and user agent are kept to deal with abuse of the form. Lawful basis: our legitimate interest in running a newsroom that people can write to, and in keeping that channel usable. |
| Newsroom accounts | Staff accounts hold a name, email address, a hashed password, a role and a record of significant actions. Passwords are stored only as bcrypt hashes and cannot be read back by us. Lawful basis: performance of a contract and our legitimate interest in securing the system. |
Who else processes it
We keep this list short deliberately. Each of these is a processor acting on our instructions:
- Vercel hosts the site and processes request logs.
- Resend delivers our email, including password resets and replies to your messages.
- Cloudflare R2 stores the photographs and video we publish.
- Unsplash serves some sample photography. Loading those images reveals your IP address to Unsplash, as with any image hosted elsewhere.
Our own database is self-hosted rather than rented from a third party. Some of the providers above operate outside Nigeria, so your data may be processed abroad. Where that happens we rely on the transfer provisions of the Nigeria Data Protection Act 2023 and on contractual protections with each provider.
We do not sell personal data, and we do not share it for advertising. We disclose it only where the law requires it, and we will tell you if that happens unless we are prohibited from doing so.
How long we keep it
- Newsletter addresses: until you unsubscribe.
- Contact messages: up to 24 months, or longer where the message relates to a story we published and forms part of the editorial record.
- Password reset links: one hour, then they stop working.
- Newsroom accounts and audit records: while the account is active.
Your rights
Under the Nigeria Data Protection Act 2023 you may ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, hand it to someone else, or stop processing it. Where we rely on your consent you can withdraw it at any time, and that does not affect what we did before you withdrew it.
Write to legal@timesposts.com. We will respond within 30 days. There is no charge unless a request is clearly excessive or repetitive.
One limit worth being honest about: rights over personal data are balanced against journalism. Where material is held for a journalistic purpose, the Nigeria Data Protection Act 2023 allows us to decline a request that would undermine our reporting. We will tell you when we are relying on that, and why.
If you are unhappy with how we have handled a request, you can complain to the Nigeria Data Protection Commission.
Children
The site is written for a general adult audience and we do not knowingly collect data from children under 13. If you believe a child has sent us personal data, tell us and we will remove it.
Security
The site is served over HTTPS. Passwords are hashed with bcrypt. Password reset links are stored only as hashes, expire after an hour, and can be used once. Changing a password signs out every other device. No system is perfect, and we will tell affected people and the regulator if a breach is likely to cause them harm.
Changes
If we change this policy we will update the date at the top. Material changes will be flagged on the site rather than slipped in quietly. See also our terms of use.