Your ISP is Watching: The Illusion of Privacy in the Nigerian Tech Space

I was staring at my terminal last night in a Gbagada workspace, sweat dripping down my neck because the inverter had just kicked out the AC, when my build failed for the third time. While waiting for the dependency mirror to respond, I started thinking about how much of our digital lives we take for granted.

We write code, deploy apps to AWS or Supabase, and buy domains, all while assuming that our little corner of the internet is safe and private. But if you are building products or just browsing the web from Nigeria, you need a quick reality check: your internet connection is nowhere near as private as you think.

The Incognito Lie We All Tell Ourselves

Let’s start with the biggest myth in the book: Incognito mode.

I’ve seen fellow developers open an incognito tab to test local cookie states or inspect a production site, believing they are suddenly ghosts. No, you are not. Incognito mode is basically local amnesia for your browser. It prevents Chrome or Firefox from saving your history, cookies, and form data on your actual machine.

But your internet service provider? Whether you are routing through MTN, Airtel, or a fiber connection in your Lagos estate, they can still see the DNS queries you make. The servers you touch still log your IP address. If you are sitting in a café in Akure using their public Wi-Fi, the router owner can easily see which domains you are hitting. Incognito is "private from your partner or sibling using your laptop," not "hidden from the internet."

Why Your Cheap VPN Isn't a Magic Shield

Then we have VPNs. The marketing around these tools is wild. They promise total anonymity, but as developers, we know how routing works.

A VPN encrypts the tunnel between your machine and their server. This is great for stopping your ISP from snooping on your traffic or bypassing annoying geoblocks that assume every Nigerian IP is suspicious. But the moment you log into your GitHub, Google, or Paystack account while that VPN is active, the anonymity is gone.

Websites still identify you. Even if you log out, modern tracking has evolved past simple IP addresses and cookies.

The Developer's Nightmare: Browser Fingerprinting

As someone who builds web applications, I know how much telemetry we can collect from a client. It is called browser fingerprinting, and it is incredibly effective.

Trackers don't need cookies to know who you are. They look at your screen resolution, your operating system, your browser version, the specific system fonts you have installed, your language preferences, and even your GPU performance.

When you bundle all these data points together, you get a highly specific signature. You can clear your cache, switch to a VPN, and use incognito, but if your browser fingerprint remains identical, trackers can easily stitch your activities together.

Building and Staying Safe on the Nigerian Web

This is not just some theoretical discussion. In Nigeria, security risks hit differently.

We deal with constant fraud attempts, bad actors scraping local platforms, and sometimes, overzealous network monitoring. For founders and developers, a breach doesn't just mean a leaked database; it means your startup is dead before it even leaves beta.

So, how do we protect ourselves without losing our minds or breaking the bank?

First, we need to enforce Two-Factor Authentication (2FA) on everything. Not SMS-based 2FA, because SIM-swapping is a very real hustle in Nigeria, but authenticator apps like Google Authenticator or hardware keys if you can afford them.

Second, we need to design our own products with data privacy in mind. Stop collecting user data you do not need. If you don't need to store a user's precise location or device fingerprint to run your SaaS, don't log it. The best way to protect user data is to simply not have it in the first place.

Stay safe out there, keep your tunnels secure, and stop trusting that purple incognito icon to save you from the real world.