Privacy Policy

1. Who is responsible

SCHOLAU is a university learning platform operated by David Mba, who is responsible for the processing described here. For privacy questions or requests, email johnnwaokolo01@gmail.com.

This notice covers the SCHOLAU website and learning accounts. A university’s own systems and independent third-party websites have their own notices. University or course names identify academic content; they do not by themselves establish a partnership or endorsement.

Google sign-in and Google user data

When you choose Continue with Google, Google shares your Google account identifier, email address and basic profile information, such as your name and profile picture, with SCHOLAU through Supabase Auth. We use this information to authenticate you, create or identify your SCHOLAU account, maintain your sign-in session and display your account profile. SCHOLAU does not receive your Google password.

Google sign-in requests basic identity, email and profile access only. It does not request access to your Gmail messages, Google Drive files, calendar, contacts or other Google account content. You can use email and password instead of Google sign-in.

Supabase processes and stores Google authentication and account information on SCHOLAU’s behalf. Authorized administrators may access account information for support and security. Your display name and profile image may be visible to other users through SCHOLAU’s profile, social and competition features as described below; your email address is not a public leaderboard field.

We do not sell Google user data, use it for advertising, or use it to train artificial intelligence models. We use and share Google user data only to provide and secure the account and profile features described in this policy, with service providers performing those functions, or where required by law.

We retain Google account and profile information while it is needed to provide your account and address support, security or legal requirements. You can disconnect SCHOLAU in your Google Account’s third-party connections settings. Disconnecting prevents future Google authorization but does not automatically delete information already stored in SCHOLAU; request deletion through your Profile or email johnnwaokolo01@gmail.com. Deletion is handled as described in the retention and deletion section below.

2. Information we handle

Account information: email, authentication records, username, display name, optional profile photograph, account status, age declaration, and records of terms acceptance. Supabase Auth handles passwords and sign-in credentials.

Academic information: university, faculty, department, level, semester, academic period, enrollments and course assignments. Learning records include lesson progress, assessment attempts, submitted answers, scores, feedback, mastery, XP, streaks and rewards.

Competition and social records: friend handles and relationships, invitations, battle participation, answers, outcomes and leaderboard preferences.

Lecturer applications: name, university, faculty, department, position, requested courses, optional institutional profile link, verification notes and review decisions. The application form does not request identity-document uploads.

Communications: reports, support and deletion requests, announcements, notification preferences, delivery records, and browser push subscriptions when enabled.

Technical information: authentication cookies, browser storage, request and security logs, device/browser information and network identifiers such as IP addresses where processed by hosting or authentication services.

Guardian verification, when available: applicant email, guardian name and contact, relationship, consent and verification records, reviewing administrator, policy versions, approval status and account linkage. We do not request identity documents through the registration form.

3. Purposes and lawful bases

We use account, academic, learning and competition information to provide the services you request, administer accounts, match course content, save progress and deliver results. Where a valid contract applies, we rely on steps towards or performance of that contract.

We rely on legitimate interests, subject to your rights and reasonable expectations, for proportionate security, abuse prevention, troubleshooting, content review and administration. We rely on legal obligations where a law requires particular processing or disclosure.

Where consent is required, including processing children’s information through verified parent or guardian consent, we obtain it before enabling the relevant processing. Optional push notifications are offered separately. Accepting the Terms is not blanket consent to unrelated processing. You may withdraw consent; withdrawal does not make earlier lawful processing unlawful, but may prevent continued use of the affected feature.

4. Who can see your information

Other learners may see your username, display name and profile image in social and competition features, together with relevant battle results. Leaderboards display public identity and XP. You can change leaderboard visibility in Profile; this does not remove your identity from friend relationships or battle history. Your detailed XP ledger and account contact details are not public leaderboard information.

Authorized administrators handle support, moderation, lecturer applications and account management. Approved lecturers receive access appropriate to their assigned teaching role and courses. Access is controlled by permissions; a lecturer application alone does not grant teaching access.

5. Service providers and transfers

The application uses Supabase for authentication, database and associated storage, Vercel for hosting, and Cloudflare R2 for configured private learning assets. Email and browser push delivery can involve the relevant delivery and browser platform providers. These services process information needed for their functions. We may disclose information where lawfully required, to protect rights and security, or to advisers bound by appropriate confidentiality.

Our providers may process data outside Nigeria. We use providers for the functions described here and assess their applicable transfer protections. Contact us if you want information about a particular transfer.

6. Cookies, storage and analytics

SCHOLAU uses authentication cookies to maintain sessions and browser storage or caching for preferences, the installed web application and offline behavior. You can manage cookies and site data through your browser; blocking required session storage may prevent sign-in or other requested functions. Shared-device users should sign out and clear site data when appropriate.

The current release connects product events to an analytics adapter that discards them; no external product-analytics adapter is configured. It does not implement session replay. Operational database records and hosting or security logs are separate from product analytics. Any future non-essential analytics must be assessed, disclosed and, where required, offered with a separate consent choice before activation.

7. University entrants under 18

SCHOLAU intends to support university entrants under 18 without a fixed minimum age, only after verified parent or guardian consent and an assessment appropriate to the student’s age. This pathway is currently closed while support contacts and verification are established. Selecting ‘under 18’ does not create a learning account.

Once available, a parent or guardian must contact support. Support checks their authority, consent to the identified processing and the applicant’s eligibility, records the review, and supplies an email-bound approval code after approval. A pending request is not approval. The applicant must also read the Privacy Policy and accept the Terms as applicable. A guardian can contact support about access, correction, withdrawal or deletion. We will assess and address accounts identified as belonging to children without the required authorization.

8. Retention, deletion and security

We keep account and learning information while your account is active and as needed to provide the service. After a deletion request, we remove personal records from active systems through our account-erasure process, except information needed for legal obligations, security, disputes or another lawful purpose. Backup copies may remain temporarily under provider backup cycles before expiry.

Request deletion through Profile → Settings → Security → Request account deletion. This sends a support request; deletion is not immediate. Support handles identity checks and account removal. The account-erasure workflow removes personal learning and competition records and linked legal and guardian records. Shared course content and other players’ records may remain after personal attribution is removed. Support must also handle owned storage objects through the relevant storage service.

Access controls, private asset delivery and restricted administrative functions help protect information. No internet service guarantees absolute security. Contact support about suspected account misuse. Deletion from active systems does not imply immediate removal from provider backups.

9. Your rights and choices

Subject to applicable law, you may request information about processing, access, correction, erasure, restriction, portability, objection to processing, or withdrawal of consent. You may also raise concerns about decisions made solely through automated processing that significantly affect you and request human review where applicable. Automated quiz scoring and XP do not represent university admission, accreditation or official examination decisions.

Use Profile to update available settings and notification or leaderboard choices. For other requests, contact johnnwaokolo01@gmail.com; existing account holders can also use Profile → Settings → Support & privacy → Contact support. We may verify identity or guardian authority before responding and explain lawful limits.

You may complain to the Nigeria Data Protection Commission (NDPC), whose website is linked below. This notice describes our practices and your options under applicable Nigerian data-protection law.

10. Updates and contact

We will identify policy versions and update dates and provide appropriate notice of material changes. Where new consent is required, publishing an update alone will not replace obtaining it. The current policy takes effect on 22 October 2026.

Operator: David Mba. Privacy and support: johnnwaokolo01@gmail.com.