Privacy policy
Last updated 5 October 2026
Thirdnod lets you tell someone they crossed your mind: a few words, a voice note, maybe a gift. People use it on their own, and teams use it at work through a workspace. This policy covers both. Where the two differ, we say so.
1. Who we are
Thirdnod is run by Thirdnod Limited, a company registered in Nigeria and based in Lagos. In this policy, “Thirdnod”, “we” and “us” mean that company.
When you use Thirdnod on your own, we decide how your personal data is used, so we are its controller. When your employer or organisation gives you access through a workspace, the organisation is the controller of the workspace data and we process it on its behalf (see section 5).
We follow the Nigeria Data Protection Act 2023, and other data protection laws where they apply to you. For anything about your personal data, write to privacy@thirdnod.com.
2. The short version
- We collect what you give us to send nods, buy gifts and run your account, plus basic device and usage data.
- A nod is private to you and the person you send it to, unless you choose to show it publicly.
- We don’t sell your personal data, and we don’t show third-party ads.
- Card details go straight to our payment providers. We never see or store them.
- At work, your organisation decides what the workspace collects and who can see it.
- You can see, correct, download or delete your data. Write to privacy@thirdnod.com.
3. What we collect from everyone
Your account
Your name, email address and password (stored only as a secure hash), or your Google account details if you sign in with Google. If you add them: a username, profile photo, country, WhatsApp number and shipping address. When you sign in with a code, we email you a one-time code.
The nods you write
Your message, any voice note you record, the theme you pick, and drafts while you write. If you start writing before you have an account, your draft is kept on your device until you sign in.
The people you send nods to
To deliver a nod, we need the recipient’s name and at least one way to reach them: an email address, a WhatsApp number or, for a printed copy or a gift, a postal address and phone number. We save the people you send to as your contacts so you can reach them again. Only give us details of people you know and believe would be happy to hear from you. We use them only to deliver your nod and anything that comes with it.
Gifts, orders and payments
What you buy, delivery details, order and delivery status, store credit and gift card balances. Card and bank details are entered on our payment providers’ pages (Bachs or Paystack). We receive only the payment result and a reference, never your full card number.
Writing help and gift suggestions
If you use “Help me write”, or when we suggest gifts that suit your message, the text of your nod and the recipient’s name are sent to an AI model provider to produce the suggestion. We don’t send your email address or contact details, and the text isn’t used to train AI models or kept by the provider. Your organisation can turn AI gift suggestions off for its workspace.
Device and usage data
When you use Thirdnod we record your IP address, browser and device type, the pages and features you use, searches in the gift shop, and the times of these events. We use your IP address to work out your country, so we can show prices in your currency and gifts that can reach you.
Cookies and similar storage
We use a small number of essential cookies to keep you signed in and secure your session. We also keep a few things in your browser’s storage, such as an unsent draft and your country. We don’t use advertising cookies. We use a third-party analytics tool, which may set cookies, to understand how Thirdnod is used and improve it.
4. Using Thirdnod on your own
On top of section 3, using Thirdnod on your own involves the following.
Your public profile
You choose what appears at your public profile address: the profile itself, nods you have received or sent, your wins, your wishlist, and a “Send me a nod” button. Each one has its own switch under Settings › Privacy, and you can change them at any time.
The public wall
A nod appears on the public wall only if its sender chooses to show it there. Nods on the wall may be reviewed by our moderation team.
Group nods
When you start a group nod, people you invite can sign it and contribute to a group gift. Their name, message and contribution can be seen by everyone in the group: the organiser, the recipient and the other contributors. A contributor’s email address is stored in a protected (hashed) form, so we can recognise a returning contributor without keeping the address in the group.
If someone sends you a nod
The sender gave us your name and contact details so we could deliver it. You can read the nod without an account. If you would rather not receive nods from Thirdnod, or want your details removed, write to privacy@thirdnod.com and we will delete them and stop further messages to that address.
5. Using Thirdnod through your workplace
Who is responsible
A workspace is set up by an organisation, usually an employer, for its people. The organisation is the controller of workspace data. It decides what is collected and who can see it, and we act on its instructions under our agreement with it. For questions about how your organisation uses this data, or to exercise your rights over it, contact your workspace administrator first. We will help them respond.
What a workspace holds about you
As well as your account (section 3), a workspace can hold:
- your job title, department, teams, manager or team lead, and work phone number;
- your start date and, unless you opt out, your date of birth, to celebrate birthdays and work anniversaries;
- a delivery address for gifts your organisation sends you;
- recognition you give and receive: nods, reactions, comments, votes, nominations, awards, badges, challenges and points;
- points allowances, balances and spot bonuses, and what you redeem them for;
- if you leave the organisation, your leaving date, role, department and length of service.
What administrators, managers and workspace officers can see
Depending on how your organisation sets up the workspace, administrators, managers and workspace officers can see:
- activity summaries for you and your team, such as how many nods you sent and received each week, points given and received, and current streaks;
- an engagement score made from that activity, and a flag when activity drops noticeably compared with before;
- team comparisons and leaderboards, if the workspace turns them on;
- trends in recognition among people who have left, to understand staff turnover.
These measures count activity on Thirdnod only. They aren’t a judgement of your work, and Thirdnod doesn’t make decisions about your employment. Your organisation should tell you how it uses them.
Your choices inside a workspace
- You can opt out of birthday celebrations in your workspace profile.
- You choose whether to get WhatsApp messages from the workspace.
- A nod you send inside a workspace can be seen by the people your organisation allows, such as the workspace wall.
When you leave a workspace
If you leave a workspace or your organisation removes you, your personal Thirdnod account carries on. The workspace keeps the records your organisation needs, under its own retention rules. When an organisation closes its workspace, we delete or anonymise the workspace data within 60 days, unless the law requires us to keep it longer.
6. How we use it, and why we may
Data protection law requires a lawful basis for each use. Ours are:
| What we do | Lawful basis |
|---|---|
| Run your account, deliver your nods, and fulfil and deliver orders | Performing our contract with you |
| Take payments and keep financial records | Contract, and our legal obligations |
| Writing help and gift suggestions | Your request when you use the feature, and our legitimate interest in useful suggestions |
| Keep Thirdnod secure, prevent fraud and spam, and moderate public content | Our legitimate interests, and legal obligations |
| Understand how Thirdnod is used and improve it | Our legitimate interests |
| Service emails, such as sign-in codes, receipts and delivery updates | Contract |
| Marketing emails, if we send them | Your consent, which you can withdraw at any time |
| Workspace features | Your organisation’s basis as controller; we process on its instructions |
8. How long we keep it
- Account data: while your account is open. When you delete your account we delete or anonymise it within 60 days.
- Nods: until you or the recipient deletes them, or your account is deleted. A copy the recipient has already received stays with them.
- Orders and payment records: kept for audit and accounting purposes, including after an account is deleted.
- Device, usage and security logs: up to 60 days.
- Unsent drafts kept on your device: until you send or clear them.
- Workspace data: as your organisation sets it, and as described in section 5.
9. Your rights and choices
You have the right to:
- get a copy of your personal data, and have it in a portable format;
- correct data that is wrong or incomplete;
- have your data deleted. You can delete your account under Settings › Account;
- object to, or ask us to restrict, how we use your data;
- withdraw consent at any time, where we rely on consent;
- not be subject to a decision based only on automated processing that significantly affects you.
Write to privacy@thirdnod.com. We reply within 14 days and may need to confirm your identity first. For workspace data, we will pass your request to your organisation and help it respond. If you’re unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or the data protection authority where you live.
10. Keeping it safe
Data is encrypted in transit, and sensitive values such as provider keys are encrypted at rest. Passwords are stored only as secure hashes. Access to personal data is limited to staff who need it for their role. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the regulator as the law requires.
11. Children
Thirdnod isn’t meant for children under 13, and we don’t knowingly collect their data. If you believe a child has given us personal data, write to privacy@thirdnod.com and we will delete it.
12. Changes to this policy
If we change this policy, we will update the date at the top. If a change materially affects you, we will tell you by email or in the app before it takes effect.
13. Contact us
Questions or requests: privacy@thirdnod.com, or by post to Thirdnod Limited, Lagos, Nigeria.