1. Who is responsible for your information
Schollar is operated by Nthabiseng Lefophana & Tlou Kgatla, who are based in the Republic of South Africa. For the purposes of POPIA they are the joint responsible parties for the personal information described in this policy, and either of them may be contacted about it.
Privacy questions and requests: scholar.thimral@gmail.com
2. Scope
This policy applies to the Schollar web application and everything served from it. It does not apply to any external website you reach by following a link from Schollar.
3. What we collect and how
3.1 Information you give us directly
| Category | What it includes |
|---|---|
| Account details | Your email address, and a password you choose. Passwords are handled entirely by our authentication provider and are stored only as salted hashes — we never receive or store your password in a form we can read. |
| Content you create | Tasks, subjects, assessments, study sessions, notes and documents, folders, and your display preferences (theme and colour scheme). |
| Messages you send us | If you use the Help Centre contact form, we store the email address, subject and message you submit, and — where you are signed in — your user ID, so we can reply and follow up. The message is also emailed to us (see section 6). |
| Information about other people | Subject records include optional fields for a lecturer's email address, office and consulting hours. If you enter another person's details, you are responsible for doing so lawfully — see section 9. |
3.2 Information collected automatically
- IP address. Your IP address is used as the key for rate limiting (to stop abuse of sign-in and other endpoints) and is recorded against security events such as failed sign-in attempts.
- Security event records. When a request fails validation, is unauthorised, or trips a rate limit, we record the event type, a short message, a timestamp, and where available your IP address and user ID. These records exist to detect and investigate abuse.
- Server logs. Our hosting provider records standard request logs on our behalf.
3.3 If you sign in with Google
Signing in with Google is optional. If you use it, Google confirms your identity to us and provides your email address and basic profile information. We request no additional Google scopes and have no access to your Gmail, Drive, Contacts or Calendar. Your use of Google's sign-in service is governed by Google's own privacy policy.
4. Why we use it, and our lawful basis
| Purpose | Basis under POPIA |
|---|---|
| Creating and authenticating your account | Necessary to perform our agreement with you (s11(1)(b)) |
| Storing and displaying the content you create | Necessary to perform our agreement with you (s11(1)(b)) |
| Rate limiting, abuse prevention and security logging | Our legitimate interest in keeping the service secure (s11(1)(f)) |
| Responding to your support or privacy requests | Compliance with a legal obligation, and your consent (s11(1)(c), s11(1)(a)) |
5. What we do not do
We consider these commitments part of this policy, and they are verifiable in how the application is built:
- We do not sell, rent or trade your personal information.
- We do not show advertising, and we run no advertising trackers.
- We do not use analytics, behavioural tracking or fingerprinting tools. The application loads no third-party analytics scripts of any kind.
- We do not use your content to build advertising or marketing profiles.
- We do not send marketing email. The only emails we send are transactional — account confirmation and password resets.
6. Who else processes your information
We use a small number of service providers, who act as operators under POPIA. They may process your information only to provide their service to us:
| Provider | Role | Where |
|---|---|---|
| Supabase | Authentication and database hosting — stores your account and all content you create | European Union (Ireland) |
| Vercel | Application hosting and content delivery; processes requests and server logs | Global edge network |
| Identity provider — only if you choose to sign in with Google | Global | |
| Resend | Email delivery — used only to forward a message you send us through the Help Centre contact form. Nothing else is emailed through it, and it is not used for marketing. | Global |
We do not share your personal information with anyone else, except where we are legally compelled to do so by a court order, subpoena or other binding legal process.
6.1 Cross-border transfer
Your account and content are stored on servers in Ireland, within the European Union. This is a transfer of personal information outside the Republic of South Africa for the purposes of section 72 of POPIA. The EU maintains data protection laws that provide a level of protection substantially similar to POPIA, and our providers are contractually bound to protect your information.
7. Cookies and similar technologies
Schollar uses strictly necessary cookies only. We set no advertising, analytics or tracking cookies, so there is no consent banner to dismiss and nothing to opt out of.
| Cookie | Purpose |
|---|---|
| Supabase authentication cookies | Keep you signed in between page loads and refresh your session. Without them you would be signed out on every navigation. They are set with SameSite=Lax and, in production, the Secure flag so they are only sent over HTTPS. |
You can block or delete cookies in your browser settings. If you block these, you will not be able to sign in. Our Cookie Policy lists every cookie and browser-storage key in full.
We also register a service worker and use your browser's local cache to let pages load faster and work offline. This stores data on your own device only; it is not transmitted to us. Clearing your site data removes it.
8. How we protect your information
- All traffic is served over HTTPS, with HSTS enabled.
- Passwords are hashed by our authentication provider. We never see them in plain text.
- Database row-level security is enabled, and every query is additionally scoped to the signed-in user, so one account cannot read another's data.
- A Content Security Policy restricts what the application may load and which servers it may talk to, alongside
X-Frame-Options,X-Content-Type-Optionsand a restrictivePermissions-Policy. - Sensitive endpoints are rate limited to frustrate brute-force attempts.
- Failed authorisation and validation attempts are logged for review.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that creates a real risk to your personal information, we will notify you and the Information Regulator (South Africa) as required by section 22 of POPIA.
9. Information about other people
Subject records let you store a lecturer's email address, office location and consulting hours. When you enter another person's details you become responsible for that information: only record details you are entitled to hold, keep them accurate, and delete them when you no longer need them. Do not store anyone's special personal information (as defined in POPIA) in Schollar.
10. How long we keep it
- Your account and content are kept for as long as your account exists. Deleting your account deletes them.
- Security and rate-limit records are kept only as long as needed to investigate and prevent abuse, and are not used for any other purpose.
- Messages you send us through the contact form are kept while we deal with your query and for a reasonable period afterwards, so we have context if you write again. Ask us and we will delete yours.
- We may retain information for longer where a law requires it, or where it is needed to establish, exercise or defend a legal claim.
11. Your rights
Under POPIA you have the right to:
- Access — ask what personal information we hold about you and receive a copy.
- Correction — correct anything inaccurate. Most content is directly editable inside the application.
- Deletion — delete your account and the personal information attached to it. You can do this yourself at any time under Settings → Delete account. Deletion is immediate and removes your account together with your tasks, subjects, assessments, study sessions, notes and settings. It cannot be undone.
- Object — object to processing based on legitimate interest.
- Complain — lodge a complaint with the Regulator (see section 13).
To exercise any of these, email scholar.thimral@gmail.com. We will respond within a reasonable period and in any event within the timeframes POPIA requires. We may need to verify your identity before acting on a request.
12. Children and learners
Schollar is a study tool and may be used by school learners under the age of 18. POPIA treats the personal information of a child as requiring the consent of a competent person — normally a parent or legal guardian.
If you are under 18, you may use Schollar only with the consent and oversight of your parent or guardian. By creating an account you confirm you have that consent. A parent or guardian may contact us at scholar.thimral@gmail.com to review, correct or delete a child's information, and we will act on such a request.
We do not knowingly collect information from children beyond what is described in section 3, and we do not profile or market to any user.
13. Complaints
Please raise concerns with us first at scholar.thimral@gmail.com — most issues are resolved quickly. You also have the right to complain directly to the supervisory authority:
Information Regulator (South Africa)
General enquiries: enquiries@inforegulator.org.za
Complaints: POPIAComplaints@inforegulator.org.za
https://inforegulator.org.za/
14. Changes to this policy
We may update this policy as the service changes. The “last updated” date at the top always reflects the current version. If a change materially affects your rights or how we use your information, we will give notice in the application before it takes effect. Continuing to use Schollar after a change takes effect means you accept the updated policy.
15. Contact
Nthabiseng Lefophana & Tlou Kgatla
scholar.thimral@gmail.com