Privacy Policy

Who we are

LearnDrill is an exam preparation service for Cameroon GCE students, built and operated by NICORPAD. LEGAL ENTITY NAME, REGISTRATION NUMBER AND REGISTERED ADDRESS TO CONFIRM

This policy covers the website at learndrill.com, the LearnDrill student app for Android and iOS, the LearnDrill Classroom app and workspace used by teachers, the administration console used by our own staff, and the backend service at api.learndrill.com that all of them talk to.

To ask about anything in this policy, write to CONTACT EMAIL TO CONFIRM.

Students on LearnDrill are schoolchildren

Most people studying on LearnDrill are secondary school pupils in Cameroon preparing for the GCE Ordinary and Advanced Level, and many of them are under eighteen. This policy is written to be read by a parent or guardian as easily as by a student.

We do not ask for a date of birth and we do not record an age, so an account does not tell us how old its holder is. MINIMUM AGE AND PARENTAL CONSENT POSITION TO CONFIRM

In short, what is held about a student is a name, an email address, the level being studied, an optional profile photo, a record of what they have practised and scored, what they have paid, the device they use, and anything they write in a classroom. The next section sets all of that out in full.

A parent or guardian can write to CONTACT EMAIL TO CONFIRM to ask what is held about their child, to have a name or a photo corrected, to have a comment taken down, or to have the account closed and the personal details erased. There is no separate parent login, so these requests are handled by email.

What we collect

Account details

• Your name and your email address.
• Your password, stored only as a scrypt hash with a random salt. It is never stored in a form anyone can read back, including us.
• Whether the account is a student, a teacher, or a member of LearnDrill staff.
• For a student, the level you chose when you registered and, where that level requires one, the specialty.
• A profile photo, if you upload one. It is optional.
• Whether your email address has been verified, and the short lived verification and password reset codes, which are themselves stored hashed and expire.

For teachers, in addition

• The display name a class sees, which is kept separate from the name on the account because it has to match the identity documents.
• The school you say you teach at, a phone number if you give one, a short biography, and the subjects you say you teach. All of this is self declared.
• The identity documents described in their own section below.

Study activity

• Each quiz attempt: which paper and sitting, when it started, when it was submitted, how many questions it had and how many you got right.
• Each answer within an attempt, which option you chose and whether it was correct.
• Challenge attempts and their scores, which feed the challenge leaderboard.
• Your practice streak and any streak freezes used.
• A record of each offline paper bundle downloaded: which paper, which version of it, and when.
• Private notes you type against a lesson video, and the point in the video they refer to. These are yours; nothing displays them to anyone else.

Payment details

• The amount, the mobile money number you entered, whether it was MTN or Orange, the payment provider transaction reference, and whether the payment succeeded.
• The subscription it paid for and the dates that subscription runs between.
• A record of each notification the payment provider sends us about a payment.

Devices, sessions and sign-ins

• An install identifier the app sends, so each device gets its own sign-in session.
• A push notification token for each install and whether it is Android or iOS.
• A hashed copy of each sign-in token with its expiry date. The token itself only ever exists on your device.
• How many consecutive failed sign-in attempts an account has had and whether it is temporarily locked.
• Which session is the current one, so that signing in on a new device can end the old one.

Classroom activity

• Which classrooms a teacher owns or co-teaches, and the title, description, cover image and settings of each.
• One membership record per student per classroom: the status, when they asked to join, when they joined, and which teacher approved them.
• Posts written by teachers, including the title, the body, any images in them, and the subject and level they are tagged with.
• Comments written by students, as plain text.
• Files uploaded by teachers, with the original file name, the type, the size, and who uploaded them.
• Star ratings a student gives a public classroom.
• Marks of a post as helpful. These are stored, but nothing in the product lists who marked what.

Support and correspondence

• Support requests you send from the app: the subject, the message, the status, and any internal note a member of staff adds while resolving it. That internal note is not shown back to you.
• The transactional emails we send you, kept with their subject and their text so that a failed delivery can be retried.

Technical records

• Web server access logs, which record the IP address a request came from, the time, the path requested, the response, and the browser or app identifier. One signed token used to display images is deliberately stripped from these logs before they are written.
• A record of every moderation action taken by LearnDrill staff, and of every time a member of staff opens the content of a classroom. Both are described under classrooms below.

What we do not collect

• Date of birth or age.
• Home address.
• GPS or any other precise location.
• Your contacts, your photo library, or anything else on your device beyond the files you choose to upload.
• Advertising identifiers.
• Bank card details. The app does not accept cards.

There is no third party analytics, advertising or tracking code in the LearnDrill website or in either app. We do not sell personal data, and no advertising network receives any of it.

Two Google services are involved in the apps and are not tracking code but are worth naming: Firebase Cloud Messaging delivers push notifications, and lesson videos play from YouTube. Both are described under who else sees your data.

Teacher identity documents

A teacher applying to run classrooms is asked for four documents plus a profile photo: the front of their national identity card, the back of it, a photograph of themselves holding that card, and something showing that they really teach. These are the most sensitive files anywhere on the platform and they are handled differently from everything else.

How they are handled

• They may only be PDF, PNG or JPEG, up to 8 MB each, and the photograph of the applicant holding the card must be an image rather than a document.
• They are stored apart from ordinary site content, and there is no public address that serves them. The only way to open one is for an administrator reviewing the application to request a signed link, which stops working after five minutes.
• Students never see them. Other teachers never see them. They never appear on a teacher's public classroom card.

How long they are kept

• The photograph of the applicant holding the identity card is deleted 30 days after the application is approved or rejected.
• The other three documents are deleted 60 days after that same decision.
• If a teacher is suspended, both clocks stop, because a suspension is exactly the moment somebody may need to look at the documents again.
• If an application is rejected and the teacher uploads again, both clocks start over from the new decision.
• Once the files are gone, the record that a decision was taken, by whom, when, and for what stated reason, is kept. The documents behind it are not.

What this check is, and what it is not

Asking for four documents that have to agree with each other raises the bar for somebody trying to reach schoolchildren through LearnDrill, and it leaves a record of who approved whom. It is not proof of identity. The review is a person comparing photographs. There is no automated identity verification service, no liveness check and no criminal record check. We would rather say that plainly than imply a stronger check than the one we run.

Classrooms: who can see what

A classroom is run by a teacher. Teachers write the posts; students reply in comments. Students do not upload files, and there is no private messaging between members.

Who sees what

• Everything inside a classroom is visible to its members, to the teacher who owns it, and to any co-teacher that teacher has added.
• A public classroom is listed where any subscribed student can find it. The listing shows the title, the description, the teacher's display name, the cover image and the star rating.
• A classroom cover image is served without any sign-in at all, so treat a cover image as public.
• A private classroom is listed nowhere and can only be reached with its join code.
• For each member, a teacher sees the name, the level being studied, when they asked to join and when they joined, and whether their subscription has lapsed. A teacher does not see a student's email address.
• A student is a member of a limited number of classrooms at once. The limit is set by LearnDrill.

Moderation

• A teacher can remove a member, ban a member, lock a post, turn comments off, and delete their own posts.
• LearnDrill administrators can lock a classroom, remove a post or a comment, take a cover image down, and in a serious case delete a classroom. Every one of those actions is recorded with the identity of the administrator, the time, and a written reason that the system requires before the action goes through.
• When an administrator opens the content of a classroom, that is recorded as well: which classroom, what was opened, by whom and when. If a parent asks who has been reading their child's classroom, we can answer from that record.
• A removed post or comment is hidden rather than erased, so that a complaint about it can still be reviewed afterwards.

Payments

LearnDrill is sold as one subscription per academic year, paid by mobile money inside the app. The payment itself is handled by Tranzak, a payment aggregator. PAYMENT PROVIDER AT LAUNCH TO CONFIRM

When you pay, we send the provider the amount, the currency, a short description, our own reference for the payment, and the mobile money number you typed. The provider then pushes the confirmation prompt to your phone. The PIN you enter goes to your mobile money operator. LearnDrill never sees it and never stores it.

What we keep on our side is listed under what we collect. In addition:

• Each notification the payment provider sends us is recorded, whether it was accepted or rejected, and those records are deleted after 90 days.
• A receipt is emailed to you when a payment settles.

Email and notifications

Email

LearnDrill sends exactly these emails and no others:

• A code to verify your email address.
• A code to reset your password.
• A receipt when a payment settles.
• A note when a support request is resolved.
• For a teacher, the decision on their application, including what to put right if it was rejected.

There is no newsletter and no marketing email, so there is nothing to unsubscribe from. Mail is delivered through an external email provider. EMAIL PROVIDER TO CONFIRM

Push notifications

Push notifications are delivered by Google Firebase Cloud Messaging. For one to reach your phone, your device registers a token with Google and we store that token against your account. It is deleted when the provider tells us the install has gone, and you can stop notifications at any time in your phone's settings.

What we send:

• A reminder when your subscription is close to ending.
• A reminder to keep a practice streak alive.
• A note when a new challenge opens.
• A note when papers for a new sitting are published.

Who else sees your data

We do not sell personal data and we do not share it for advertising. The list below is the whole list, and each party receives only what it needs:

• Tranzak, the payment aggregator, receives the amount and the mobile money number so that it can take the payment. PAYMENT PROVIDER AT LAUNCH TO CONFIRM
• Google, through Firebase Cloud Messaging, delivers push notifications to your device.
• Our email provider delivers the transactional emails listed above. EMAIL PROVIDER TO CONFIRM
• YouTube, which is Google. Lesson videos are hosted on YouTube and play inside the app. When you play one, your device contacts Google directly, so Google receives your IP address and may set its own identifiers under its own privacy policy. We do not send Google your account details.
• Backblaze B2 holds our off-site backups, described below.
• Our hosting provider operates the server the service runs on. HOSTING PROVIDER AND SERVER COUNTRY TO CONFIRM
• Google Play and the Apple App Store distribute the apps and handle their own account data under their own policies.

We will also disclose information where the law requires it, or where it is necessary to protect a child from harm.

Where it is stored and how it is protected

LearnDrill runs on a single rented virtual private server. The database and the uploaded files both live on it. SERVER LOCATION AND COUNTRY TO CONFIRM

The measures actually in place:

• Passwords are stored as scrypt hashes with a random salt, never in a form that can be read back.
• Sign-in tokens are stored only as SHA-256 hashes. If an already used token is presented again, which is what happens when one has been stolen, every token in that chain is revoked at once.
• Verification and password reset codes are stored hashed, expire after a short time, and lock after too many wrong guesses.
• Repeated failed sign-ins lock an account for a period.
• A student account is signed in on one device at a time. Signing in somewhere else ends the earlier session immediately.
• All traffic to the website, the console and the API is over HTTPS, and browsers are told to refuse anything else.
• Uploaded files are identified by reading their actual bytes rather than trusting what the uploader claims, and every upload has a size limit.
• Teacher identity documents are reachable only through the five minute signed links described above.

No service can promise it will never be breached, and we make no claim to any security certification or audit. The list above is what is implemented, not an aspiration.

Backups

The database is dumped every night, encrypted on the server with AES-256 before it leaves it, and sent to Backblaze B2. Uploaded files are mirrored to the same place. That mirror only adds: a file deleted from the live service is not removed from the backup copies made earlier. So where this policy says a file is deleted, it means deleted from the running service, and a copy can remain in a backup afterwards. BACKUP RETENTION, AND WHETHER DELETIONS ARE PROPAGATED TO BACKUPS, TO CONFIRM

How long we keep things

• Your account and your study history: for as long as the account exists.
• After you delete your account: see the next section.
• Teacher identity documents: 30 days for the photograph with the identity card, 60 days for the other three, both counted from the approval or rejection. If the teacher deletes their account, all of them are deleted at the next nightly run instead, even if the application was never reviewed.
• Payment provider notifications: 90 days.
• Expired sign-in tokens: removed by a daily job once they are past their expiry.
• Classroom content: for as long as the classroom exists. A teacher can archive a classroom, which closes it to new writing while leaving everything readable. A teacher cannot delete a classroom; only a LearnDrill administrator can.
• Emails we have sent you: the delivery record, which includes the text of the message, is kept. No automatic deletion is configured for it today. EMAIL DELIVERY LOG RETENTION TO CONFIRM
• Web server access logs: no fixed retention period is configured today. SERVER LOG RETENTION TO CONFIRM

Deleting your account

A student can delete their account from inside the app, confirming with their password. This is what happens, and it is worth reading before you do it:

• The account is deactivated at once and every session is signed out, on every device.
• The email address is released, so it can be used to register a new account.
• After 30 days an automatic job erases the name, replaces the email address with an unusable placeholder, and deletes the profile photo.
• Quiz attempts, challenge attempts, payments and subscription records are kept, because they are the financial and operational record of the service. After the 30 days they are no longer attached to a name or an email address.
• Comments already written in a classroom are not removed by deleting the account. Write to us if you want them taken down.

A teacher deleting their account also closes every classroom they own. Each one becomes read only: students keep everything already shared, and nobody can post, comment or join again. The identity documents on file are deleted at the next nightly run, whether or not the application was ever reviewed.

Your choices

• Change your name and your profile photo in the app at any time.
• Delete your account as described above.
• Turn push notifications off in your phone's settings.
• Write to us to ask what is held about you, to ask for a correction, or to ask for it to be erased.

There is no self-service download of your data today, so a copy is prepared by hand when somebody asks for one.

This policy does not claim compliance with any particular data protection regime. It describes what the service does. APPLICABLE DATA PROTECTION LAW AND SUPERVISORY AUTHORITY TO CONFIRM

Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change materially affects what is collected or who can see it, we will say so in the app as well as here.

Contact

Questions about this policy, requests about your own data, or a concern about a child's safety: CONTACT EMAIL TO CONFIRM

POSTAL ADDRESS TO CONFIRM