ToGradToGrad

Privacy Policy

Effective Date: 1 January 2026

1. Who We Are

ToGrad ("we", "us", or "our") is an academic progress tracking application designed for South African learners and students. We are committed to protecting your privacy and complying with the Protection of Personal Information Act (POPIA).

Contact: info@doubleone.co.za

2. Information We Collect

We collect the following categories of personal information:

Account Information

  • Full name
  • Email address
  • Password (encrypted)

Academic Information

  • For Learners: Subjects, marks, APS score, exam year, school name
  • For Students: Institution, qualification, modules, results, GPA, year of study
  • Study session data (duration, subject, completion status)
  • Application and bursary tracking information

Social Features (Optional)

  • Posts, comments, and reactions you create
  • Connections you make with other users
  • Study group memberships
  • Private messages you send and receive

Private Messaging

Messages between users are stored securely and retained to enable message history and conversation continuity. If a message or conversation is reported for safety concerns, our moderation team may review the reported content. Media attachments in messages are automatically deleted after 30 days.

For Users Under 18

If you are under 18, we may collect your parent or guardian's email address to facilitate parental consent for certain features, as required by POPIA.

3. How We Use Your Information

  • Providing academic progress tracking and APS/GPA calculations
  • Sending deadline reminders and study streak notifications
  • Matching you with relevant opportunities (bursaries, scholarships)
  • Enabling social features (posts, connections, study groups)
  • Improving our service through anonymized analytics
  • Communicating important updates about your account

Lawful Basis: We process your information based on your consent, which you provide when creating an account and agreeing to these terms.

4. Minors and Parental Consent

ToGrad is designed for use by Grade 12 learners, many of whom may be under 18. In accordance with POPIA:

  • Users under 18 may use basic app features with their own consent
  • Sharing personal information with third parties (such as bursary providers) requires verified parental or guardian consent
  • Parents can request access to their child's data or request account deletion
  • We provide clear controls for parental consent within the app

5. Who We Share Your Information With

  • Supabase (Database & Authentication): Your data is stored on Supabase infrastructure, hosted on AWS in the EU region.
  • PostHog (Analytics): EU-hosted. We send anonymized usage data only.
  • Sentry (Error Tracking): Error reports are scrubbed of personal information.
  • Resend (Email): Used to send transactional emails.

Advertising: The app does not currently display third-party advertisements. If this changes in the future, we will update this policy and notify you before any advertising-related data collection begins.

Important: Your academic information is never shared with organizations or bursary providers without your explicit, per-opportunity consent.

6. Your Rights Under POPIA

  • Right of Access: Request a copy of your personal information
  • Right to Correction: Update or correct your information
  • Right to Deletion: Delete your account and all associated data
  • Right to Object: Object to certain processing activities
  • Right to Data Portability: Export your academic data

To exercise any of these rights, contact us at info@doubleone.co.za.

7. Data Retention and Deletion

We retain your data for as long as your account is active. When you delete your account:

  • Your profile, academic data, and posts are permanently deleted
  • Your connections and group memberships are removed
  • Anonymized analytics data may be retained
  • We may retain certain data as required by law

Push notification history is automatically deleted after 90 days.

8. Security

  • All data is encrypted in transit (HTTPS/TLS)
  • Passwords are securely hashed
  • Database access is protected by Row Level Security (RLS) policies
  • Authentication tokens are securely stored on your device
  • Regular security reviews and updates

9. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as soon as reasonably possible, in accordance with POPIA requirements.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes through the app or via email.

11. Contact Us

If you have questions about this privacy policy, contact us at:

Email: info@doubleone.co.za

You also have the right to lodge a complaint with the Information Regulator of South Africa.