Privacy Policy

Effective: 26 May 2026 · Version 1.0

This policy explains what personal information Scancourse collects, why we
collect it, and what we do with it. We aim to comply with the Protection
of Personal Information Act, 2013 (POPIA).

Information We Collect

• Account info: name, email, password (hashed), phone number, grade,
  province.
• Academic info: subjects, marks, calculated APS — you can delete
  these any time.
• Profile preferences: preferred field, dream career, preferred
  study province.
• Profile photo: stored on your device only — never uploaded to our
  servers.
• Saved items + applications: courses, bursaries, accommodation you
  save or track.
• Usage signals: course views (used to power "Similar students also
  viewed").

Why We Collect It

• Personalised course and bursary recommendations
• Save your progress between sessions
• Improve the app over time
• Send important notifications (deadline reminders, application status)

What We Do NOT Do

• We do not sell your personal information to anyone.
• We do not share your marks with universities or bursary providers
  without your consent.
• We do not use your data for advertising profiling.

Who Sees Your Data

• You — always, via the Profile screen.
• Scancourse staff — only when troubleshooting an issue you've reported.
• Service providers we use to run the app (hosting, email, error
  monitoring) under strict confidentiality.

Your Rights Under POPIA

You can at any time:

• Access the personal information we hold about you.
• Correct or update it via Edit Profile.
• Delete your account and all associated data (30-day grace period).
• Object to processing (we'll explain the consequences).
• Lodge a complaint with the Information Regulator
  (https://inforegulator.org.za).

To exercise any right, email [email protected] or use the in-app
Settings → Privacy & Data section.

Data Retention

• Active accounts: we keep your data while your account is open.
• Deleted accounts: we erase personal data within 30 days. Aggregated,
  anonymised statistics may be retained.

Security

• Passwords are stored hashed (we never see them in plain text).
• Tokens are stored in your device's secure storage.
• API traffic uses HTTPS in production.
• Access logs maintained for sensitive operations.

Children's Privacy

Scancourse is intended for students 13 and older. If we learn that we
have collected data on a child under 13 without verifiable parental
consent, we will delete it.

Changes to This Policy

If we make a material change, we'll notify you in-app before it takes
effect.

Contact

• Privacy questions: [email protected]
• Information Officer: [email protected]
• Website: https://scancourse.co.za
• Information Regulator of South Africa: https://inforegulator.org.za