Privacy Policy

Last updated: 6 September 2026

This policy explains how Afripraat ("we", "us", "our") collects, uses, stores, protects and deletes personal information when you use the Afripraat website, web app or Android app available at afripraat.co.za. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). This policy applies together with our Terms & Conditions.

1. Who is responsible

Afripraat is the responsible party for the personal information processed on the platform. Afripraat is operated from South Africa.

Contact: info@afripraat.co.za

2. What we collect

Information you give us

• Account details: full name, email address, username, school name, account type (learner, teacher or parent) and, for learners, grade.
• Parent/guardian consent: the consent confirmation given when a learner account is created, and (if a learner links a parent) the parent or guardian's email address.
• Content you create: word packs and other teaching content created by teachers.
• Support messages: anything you send us by email.

Information created by using the app

• Learning data: word packs practised, attempts, correct answers, mastered words, active days, streaks, badges, scores and participation marks.
• Classroom data: which classroom a learner belongs to or has asked to join.
• Subscription status: payment confirmations we receive from PayFast (plan, amount, paid-until date and a payment reference). We never see or store card numbers - payments are handled entirely by PayFast.
• Notification tokens: if you turn on reminders, a device token used to send push notifications. Turning reminders off removes it.

What we do NOT collect

• No advertising identifiers or ad tracking in the Android app, and no third-party analytics trackers in the app. The website uses the Meta (Facebook) Pixel for advertising measurement - see section 10.
• No precise location, contacts, photos, microphone or camera access.
• No card or bank details.

3. How we use personal information

• To provide the learning service: saving progress, unlocking words, awarding badges and showing marks, reports, leaderboards and certificates.
• To let teachers see the progress and participation of learners in their own classrooms only, and to let a linked parent or guardian see a simple progress summary for their own child.
• To manage subscriptions, process cancellations and payment queries, and send service emails (for example payment or account notices).
• To send optional practice-reminder notifications, only if you turn them on.
• To keep the platform secure, prevent abuse and keep a security audit log.

4. Children's information

Many of our users are school learners under 18, including children under 13. We take this seriously:

• A parent, guardian or school must consent before a learner account is created - the sign-up form requires this confirmation, as required by POPIA.
• We collect only the information needed to provide the learning service - nothing more.
• Learner data is visible only to the learner, their own teacher(s), a parent or guardian the learner has linked, and Afripraat platform administrators.
• Parents or guardians may at any time request access to, correction of, or deletion of their child's information by emailing info@afripraat.co.za.

5. Who processes data on our behalf

We use a small number of service providers (operators) to run the platform. They process data only on our instructions:

• Google Firebase / Google Cloud - authentication (login), database and push notifications. Data is stored on Google Cloud infrastructure with encryption in transit and at rest.
• PayFast (payfast.io) - a registered South African payment provider that processes all subscription payments. Card details go directly to PayFast and never touch our systems.
• Netlify - hosts the website and app files (it does not receive account data).
• Brevo - sends transactional emails (for example payment and reminder emails).

Some of these providers store data outside South Africa. Where personal information is transferred across borders, it is protected by contractual and technical safeguards that provide a level of protection consistent with POPIA (section 72).

6. Security

• All traffic is encrypted (HTTPS), and data is encrypted at rest on Google Cloud.
• Database security rules restrict every read and write: teachers can only see learners in their own classrooms; learners can only see their own data and their classmates' leaderboard entries; subscription records can only be written by our payment server, never by an app user.
• A server-side security log records suspicious activity so we can investigate abuse.
• Passwords are handled by Firebase Authentication; we never see or store your password.

7. How long we keep data

• Account and learning data are kept while your account is active, so your progress is never lost.
• If you delete your account, your profile and learning data are deleted immediately (see section 8).
• Payment records are kept as long as required by South African tax and financial law, even after account deletion.

8. Deleting your account and data

You can also request deletion by emailing info@afripraat.co.za from the email address linked to the account, with the subject "Delete my account". Deletion requests by email are completed within 30 days. Parents or guardians may request deletion of their child's account the same way.

What is deleted: your account, profile details, learning progress, classroom membership, co-teacher and parent/child links, any invitations still addressed to your email address, and your notification tokens. Word packs you shared to the public library stay available to other teachers, but your name and account are removed from them. What is kept: payment records required by law (kept separately, without your learning data) and anonymous entries in the security log.

9. Your rights under POPIA

You may at any time:

• ask for a copy of the personal information we hold about you;
• ask us to correct or update it (most details can be edited yourself under Settings);
• ask us to delete it (section 8 above);
• object to processing or withdraw consent, where the processing is based on consent;
• complain to the Information Regulator of South Africa (inforegulator.org.za, complaints.IR@inforegulator.org.za).

10. Cookies, local storage and advertising measurement

We use browser local storage and Firebase Authentication session data to keep you logged in and to save unsent progress on your device. Clearing your browser data removes these.

Our website uses the Meta (Facebook) Pixel, a measurement tool from Meta Platforms, to understand how well our advertising works. It records page visits and key actions (such as completing sign-up or a payment) together with a cookie-based identifier, and may match these to your Facebook or Instagram account if you have one. We use this only to measure ad performance and to reach people similar to our current users; we never send Meta your name, school, learning data or payment details. Meta processes this data under its own privacy policy, and you can control how it is used for ads at facebook.com/adpreferences or by blocking third-party cookies in your browser. The pixel does not run inside the Android app.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced on the website or by email before they take effect. The "Last updated" date at the top shows the current version.

12. Contact

Afripraat
Email: info@afripraat.co.za
Website: afripraat.co.za