Privacy

Who is responsible

Down US is run by Extrafemi Labs, the data controller for this site. For any privacy question or request, use our contact form.

Usage statistics (analytics)

To improve the site we count how it is used: page views, which buttons and links are clicked, searches typed into the site's search boxes, which state and device type visits come from, and which site referred you. These are stored only as daily totals, for example "Finance page viewed 1,204 times today".

• One cookie, no tracking pixels, no fingerprinting, no advertising trackers. The cookie, dn_consent, holds only your answer to the cookie banner (“yes” or “no”) for one year. It is first-party, contains nothing about you and is never shared.
• We also use Cloudflare Web Analytics, Cloudflare's cookie-free page-view counter (it loads from static.cloudflareinsights.com). It records which pages load and how fast, without cookies or a visitor ID, and Cloudflare processes it for us under its data processing terms.
• To count unique visitors per day, your IP address and browser name are turned into a scrambled code with a key that changes every day. The code is held in memory only, never written to storage, and discarded at the end of the day. We can't turn it back into your IP address or follow you across days.
• Sponsored slots are sold directly and served from this site's own address, not by an ad network. They set no cookies of their own and use no targeting by person. An ad may be chosen by the page you are on and your state, and we count how often each ad is seen and clicked, as daily totals only. Advertisers get those totals, nothing else.
• Visits by country, for everyone. Every visit adds one to its country's total for the day, whatever you choose on the cookie banner. Only the country is used (Cloudflare reads it from the request), no cookie is set and nothing is stored on your device. To avoid counting you twice in a day the same scrambled, memory-only code described above is used. Lawful basis: our legitimate interest in knowing where the service is used (GDPR Article 6(1)(f), NDPA section 25(1)(f)).
• Totals are kept for up to 400 days.
• Lawful basis: your consent when you choose “Allow” (NDPA section 25, GDPR Article 6(1)(a)). Until you choose, we count only if your browser sends no Do Not Track or Global Privacy Control signal, on the basis of our legitimate interest in running a free public service (GDPR Article 6(1)(f)). “No thanks” means nothing else is sent, whatever your browser sends: only the country total above.

Allow anonymous usage statistics in this browser

This is the same choice as the cookie banner. Untick it and nothing is sent.

Your location

Cloudflare, which delivers this site, tells us the US state a visit comes from. We use it only to show that state's services first, and to count visits per state. We never see or store your exact location. You can change the state in the top bar at any time.

When you report a problem

• The service, the part that isn't working (for example "GTBank, App"), the state you choose (optional), an optional short note, and the time.
• A scrambled code made from your IP address and the date, used only to stop repeat reports within 30 minutes. It changes every day and can't be reversed.

Individual reports are deleted after 24 hours. Only totals remain.

If you turn on alerts

• Browser notifications: we store the notification address your browser gives us (a random web address run by your browser's maker) and the list of services you follow. It doesn't identify you. Turn alerts off and it is deleted; addresses that stop working are deleted automatically.
• Telegram: we store your Telegram chat number and the services you follow, so the bot can message you. Send /stop to the bot and it is deleted.

Lawful basis: your consent, which you can withdraw at any time.

Notes you add to a report

If you add a short note ("what's happening?"), it is shown publicly on the service's page for up to 24 hours, without your name. Web addresses, emails and phone numbers are removed automatically. Please don't include personal details.

When you suggest a service

We keep the name, website, category and state you give us, plus the same daily scrambled code to spot duplicate suggestions. Suggestions that don't pass our checks are deleted within 14 days.

When you list your business

The For business form asks for your business name, website, category, your name, work email, and optionally your role, phone number and a message. The email must be on the website's own domain. We first email that address a confirmation link: until you open it, nothing is listed or sent to us, and an unconfirmed request is deleted after 48 hours. Once confirmed, your details reach us as a contact message, and the website (never your contact details) goes on Down US.

Lawful basis: our legitimate interest in listing services accurately, and the steps you ask for. We keep the message until it's dealt with, then for up to two years, and you can ask us to delete it.

When you ask about paid services

The paid services form sends your name, company, work email, phone number if given, the services you tick and your message to our inbox, the same way as the contact form. We use it only to reply and prepare a quote, and keep it for up to two years unless you become a customer.

When you book an ad and pay

We keep what you send in the Book an ad form (brand, your name, email address, phone number if given, website, the ad's words, link and dates) and the files you upload. Your words and images are checked automatically against our advertising policy by Cloudflare Workers AI before the booking is accepted.

You pay by bank transfer to Extrafemi Ventures. We never see or store your card or bank login. You upload a receipt (a JPEG photo or a PDF) through a private link in your booking email. Each PDF is scanned on upload for scripts, embedded files and actions that run on opening, and refused if it has any. Receipts are only opened by us, in the browser.

How long: bookings and receipts are financial records. We keep them as accounting records and don't delete them, as tax law expects. They're never shown publicly or shared beyond the processors listed below.

Lawful basis: to take the steps you ask for before a contract and to perform it, and to meet our legal obligations to keep accounts.

Badges, report cards and the API

Badges, report cards and the status API contain no personal data: only services' statuses and uptime. When a website shows one of our badges, the visitor's browser fetches it from us like any other request, and Cloudflare handles that request as described above. We don't use badge requests to identify or follow anyone.

Stored in your browser

The site saves a few preferences in your browser's local storage: your chosen state, filters, the last statuses you saw (so the page opens instantly), and your analytics choice. Your cookie choice is also kept in the dn_consent cookie so our server can respect it. These never leave your device, contain nothing that identifies you, and can be cleared in your browser settings.

Services we use

Cloudflare hosts the site and processes requests to deliver it and protect it from abuse, as our processor. To check services we contact their public websites, Globalping (probes in the US), IODA (internet health data), RIPEstat (routing data), Cloudflare Radar and public status pages. If spam protection is on, Cloudflare Turnstile checks that reports come from a person. Alerts are delivered through your browser's push service or Telegram. None of these receive anything about you. Service logos are fetched by our server, so your browser doesn't contact anyone else for them. The site's typeface comes from Google Fonts (see below).

Who processes data for us

• Cloudflare, Inc.: hosting, security, the spam check (Turnstile) and cookie-free page analytics. Processes requests to the site.
• Resend: delivers our emails: contact and business messages to our inbox, and confirmation, booking, payment and alert emails to you. It receives the address and the email's content, nothing else.
• Cloudflare Workers AI: checks the words and images of ad bookings against our advertising policy. Nothing else is sent to it.
• Google Fonts: serves the site's typeface (Outfit). Your browser asks Google for the font files, so Google sees your IP address and browser, as with any website that uses Google Fonts.
• Your browser's push service (Google, Apple, Mozilla or Microsoft): delivers browser alerts, only if you turn them on.
• Telegram: delivers bot alerts, only if you start our bot.

Globalping, IODA, RIPEstat and the status pages we check never receive anything about you; they only see our own checks.

International transfers

Cloudflare runs the site on servers around the world, so requests can be processed outside Nigeria, including in the EU and the US. Cloudflare relies on the safeguards the NDPA and GDPR require for such transfers, such as standard contractual clauses.

Children

The site is a general public service and isn't aimed at children. We don't knowingly collect data from children, and no part of the site requires personal details.

AI and your data

We don't send your reports, notes, searches, alerts or messages to AI or machine-learning services, and we don't use anything you send us to train models. The one exception is ad bookings: their words and images are checked by Cloudflare Workers AI against our advertising policy, and the result is used only to accept or refuse the ad.

Your rights

Under the NDPA and the GDPR you can ask what we hold about you, ask us to correct or delete it, object to processing, and complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or your local supervisory authority. If you live in California or another US state with a privacy law, you have the right to know what we hold, to have it deleted or corrected, and to opt out of its sale or sharing: we never sell personal information or share it for cross-site advertising, so there is nothing to opt out of, and we won’t treat you differently for asking. Because we don't store anything that identifies you, there is normally nothing to return, but we will always answer within 30 days.

How to make a request: use the contact form and say what you'd like us to do. You don't need an account or a reason.