Privacy Policy
Discovery · Last updated: 20 October 2026
Discovery is a travel and commerce app for Ghana: food and grocery delivery, rides, parcels, stays, events and tickets, tours, activities, tour guides, intercity travel, vehicle rental, a wallet, and a travel assistant. This policy explains what personal data we collect, why, who else sees it, how long we keep it, and the rights you have under Ghana's Data Protection Act, 2012 (Act 843). It covers the Discovery mobile apps and ghdiscovery.com.
The data controller is Discovery Technologies. For any privacy question or request, including to reach our data protection officer, email privacy@ghdiscovery.com.
What we collect and why
| Data | Why |
|---|---|
| Name, email, phone number | To create your account, sign you in, and let a provider, driver or courier reach you about an order you placed. |
| One-time passcodes (OTP) sent by SMS or email | Sign-in and confirming sensitive actions. A passcode is single-use and expires quickly. |
| Password, if you set one (stored only as a cryptographic hash) | Sign-in. We never store your password in readable form. |
| Profile photo and bio, if you add them | Shown to providers you book with. |
| Location | To set pickup and delivery points and show what is nearby, when you allow it. Live location is shared only while an order, ride or delivery is active (see below). |
| Delivery and pickup addresses you save | So you do not retype them. |
| Orders, bookings, tickets and payment records | To fulfil what you bought, show your history, and handle refunds and disputes. |
| Wallet balance and transactions, including transfers and withdrawals, and the mobile money number you withdraw to | To operate the wallet, prevent fraud, and keep financial records the law requires. |
| Wallet PIN (stored only as a hash) | To confirm money actions are yours. |
| Identity documents and payout details, if you register as a provider, driver or courier | Required for verification (KYC) before you can list or be paid. |
| Chat messages about an order, and messages to the travel assistant | To deliver the message, answer you, and handle safety reports and disputes. |
| Evidence for a dispute or damage claim (for example photos of a rented vehicle) | To decide the claim fairly. It is shared with the other party to the booking. |
| Device push token, if you allow notifications | To tell you an order is confirmed, a driver has arrived, or a payment cleared. |
| Basic device and app diagnostics | To find crashes and broken screens. |
We process this data to perform our contract with you, to meet legal obligations (for example tax, accounting and anti-fraud rules), for our legitimate interests in running a safe and reliable service, and, where we ask for it, with your consent, which you can withdraw at any time.
Live location, phone numbers and chat during an order
- Live location is shared between you and the driver or courier only while an order, ride or delivery is active. Sharing stops when it ends. We keep the location trail of that order for safety and dispute handling (see "How long we keep it").
- Phone numbers. Your phone number and the driver's or courier's are visible to each other only while the order is active.
- In-app chat closes 24 hours after the order ends. We keep the conversation for safety and dispute handling, then delete it.
Device security and biometrics
Where you turn it on, the app can use your device's fingerprint or face unlock to confirm sign-in or money actions. Your biometric data never leaves your device and we never receive it. The operating system only tells the app whether the check succeeded (yes or no).
Card and mobile money details
We never see or store your full card number. Card and mobile money payments are processed by Paystack, which handles those details directly. What reaches us is a reference, the amount, whether it succeeded, and, if you chose to save a card, the last four digits and card type so you can recognise it.
Push notifications
We send push notifications through OneSignal and the Expo push service, using a token for your device. You can turn them off at any time in your device settings (Settings > Notifications > Discovery) or, on the web, in your browser's site settings. Order updates still appear in the app.
Who else receives your data
We share only what each recipient needs to do its job. Our processors act on our instructions and under contract:
- Paystack: card and mobile money payments, refunds and payouts.
- Amazon Web Services: hosting, databases, file storage, and some email and AI processing.
- SMS, email and messaging providers: sending one-time passcodes, receipts and service messages by SMS, email and WhatsApp.
- OneSignal and Expo: push notifications, where you allow them.
- Map providers (such as Google Maps, Mapbox and OpenStreetMap-based services): maps, address search and routing.
- AI providers (such as Anthropic, directly or through Amazon Web Services): the travel assistant. What you type to the assistant is sent to generate a reply. Do not put sensitive personal information in those messages.
- Error-monitoring services: crash and error reports, with personal data minimised.
- Google and Apple: only if you choose to sign in with them.
- The provider you buy from: a restaurant, host, driver, courier or guide receives what they need to fulfil your order, such as your name, the delivery or pickup address, and your phone number while the order is active.
- Authorities: where the law requires it, for example a valid court order or a regulator's request.
Some of these providers store or process data outside Ghana. Where they do, we rely on contractual and technical safeguards so your data stays protected to the standard Ghanaian law requires. We do not sell your personal data, and we do not share it for advertising.
How long we keep it
| Data | How long |
|---|---|
| Account and profile data | While your account is open, then deleted when you delete your account, except what we must keep below. |
| Orders, payments, wallet and payout records | As long as the law requires for tax, accounting and anti-money-laundering purposes (generally at least 6 years after the transaction). |
| Order chat | Closed 24 hours after the order ends, then kept for up to 12 months for safety and dispute handling, longer only while a dispute, a report on that chat or a legal claim is open. |
| Location trail of an active order | Up to 12 months for safety and dispute handling, longer only while a dispute or legal claim is open. |
| Provider identity (KYC) documents | While you hold a provider, driver or courier account. When you delete your account: deleted at once if you never received money through Discovery; if you did (earnings or payouts), kept for 5 years after your account closes, as anti-money-laundering rules require, and then deleted automatically. |
| Reports other people made about you | Kept for moderation. The report holds a copy of the reported content until it is resolved, then that copy is deleted. Reports you made yourself are deleted with your account. |
| Diagnostics and logs | Typically no more than 90 days. |
Your rights
Under the Data Protection Act, 2012 (Act 843) you have the right to:
- Access the personal data we hold about you and get a copy.
- Correct data that is wrong or incomplete. Most of it is editable in the app under Account.
- Delete your data where we no longer need it or have no legal reason to keep it. Delete your account in the app at Account > Delete my account, or see how to delete your account. We cannot delete it while you still have open bookings, orders or rides, or money in your wallet; finish or withdraw first.
- Object to processing, including direct marketing.
- Withdraw consent where we rely on it, for example for location or notifications, in your device settings or by contacting us.
- Complain to us, and to the Data Protection Commission of Ghana at https://www.dataprotection.org.gh.
To use any of these rights, email privacy@ghdiscovery.com. We may need to confirm your identity first, and will respond within the time the law allows.
Children
Discovery is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will remove it.
Security
Traffic is encrypted in transit. Passwords and wallet PINs are hashed. Access to production data is restricted. No system is perfectly secure, and we will tell you and the Data Protection Commission promptly if a breach affects your personal data. If you find a security weakness, please report it to security@ghdiscovery.com.
Cookies and similar storage
See our Cookie Notice.
Changes
If we change this policy materially we will say so in the app before the change takes effect. The date at the top always reflects the current version.
Contact
Privacy questions, data requests and complaints: privacy@ghdiscovery.com. General help: support@ghdiscovery.com.