Privacy policy

OurAfrica operates the OurAfrica learning platform — the web application at ourafrica.co.zw, the Windows desktop application (distributed through the Microsoft Store), and the Android application (together, the “Platform”). We are the data controller for the personal data described in this policy.

OurAfrica, F2 Phumula Centre, Victoria Falls, Zimbabwe. For anything about your privacy, write to [email protected].

We collect only what the Platform needs to work:

• Account data — your name and email address, and your password when you register directly. Sign-in is handled by a managed identity service (Amazon Cognito); your password is never stored in plain text, and if you choose “Continue with Google” we receive your name and email from Google.
• Profile data — your country, which we ask for when you set up your account, plus anything you choose to add: a profile photo, mobile number, city, date of birth, job title, bio and areas of expertise. All of these except country are optional.
• Learning data — enrollments, lesson progress, quiz attempts and scores, notes, assignments you submit, and the certificates you earn.
• Organization data — if you join through an employer or institution, your membership and your role in it.
• Purchase records — what you bought, the amount, and how you paid. Payments are made by EcoCash or bank transfer and confirmed by our accounts team; we do not collect or store card details.
• AI study tools — when you use the AI tutor, flashcards, translation, quiz feedback or similar tools, the questions you ask and the course content, answers or submissions involved are processed to produce a response.
• Device and security data — on the Windows app, an install identifier, your computer’s name, the operating system and the app version, so your device can be registered for offline learning; and the IP address used when a device signs in, kept in a security log.
• Diagnostics you choose to send — the Windows app can send a diagnostic report from Settings → Downloads. It contains the app version, operating system, download and sync status, and error messages. Nothing is sent unless you press the button.
• Crash reports (Android) — if the Android app crashes, a report with the app version, device model, operating-system version, the error, and the screens and actions leading up to it is sent to our error-tracking provider. It does not include your name or email address.

We do not use advertising or third-party analytics trackers, and we do not access your location, contacts or microphone. The web app uses your camera only if you choose to scan a certificate’s QR code; the image is read in your browser and never uploaded.

• To deliver the Platform: courses, progress tracking, quizzes, and certificates.
• To let you learn offline: course content and your progress are stored on your device and synced when you reconnect.
• To issue verifiable certificates that anyone can check against our records.
• To record purchases and subscriptions, and send receipts and invoices.
• To recommend relevant courses based on your learning activity and interests.
• To send service emails, such as verification, receipts and course updates.
• To keep the Platform secure, diagnose faults, and improve reliability.
• To answer your support requests.

We do not sell your personal data, and we do not use it for third-party advertising.

We use a small number of service providers, each only for the job described, under contract and not for their own purposes:

• Amazon Web Services — hosting for our servers and database, sign-in (Amazon Cognito), file storage and delivery (Amazon S3 and CloudFront), and sending email (Amazon SES).
• Google — “Continue with Google” sign-in, and the Gemini models behind the AI study tools.
• Anthropic and OpenAI — only if you add your own provider key for the AI study tools; your requests then go to the provider you chose.
• Vercel — hosting for the ourafrica.co.zw website.
• Cloudflare — network delivery and protection for our website and API.
• Sentry — crash reports from the Android app.
• Microsoft and Google — distribute our Windows and Android apps through their app stores.

We may also disclose data where the law requires it, or to protect the safety of our users or the Platform.

Our servers, database and sign-in service run in Amazon’s Stockholm, Sweden region, and files such as course media and profile photos are stored in its Ireland region. Email is sent through Amazon’s United States region, Android crash reports are processed in the United States, and our website and network providers serve content from locations around the world. This means your data is transferred outside Zimbabwe; we rely on these providers’ contractual and technical safeguards when it is.

If your account is linked to an organization’s subscription, that organization’s administrators can see your enrollment status, course progress, and completion records for courses within their program — that visibility is the product they are paying for. They cannot see your personal notes, and your certificates and learning history remain yours: they stay with your account if you leave the organization.

• All traffic between your device and our servers is encrypted in transit (TLS), and our database is encrypted at rest.
• Sign-in uses short-lived, automatically refreshed session tokens.
• Courses downloaded for offline use are stored on your device encrypted with AES-GCM. On Windows, each learner on a shared computer has a separately encrypted profile protected by their own PIN.
• If you add your own AI provider key, it is stored encrypted on our servers and never shown again — only its last four characters are visible to you.
• Access to production data inside OurAfrica is restricted and logged.

We follow Zimbabwe’s Cyber and Data Protection Act and internationally recognized data-protection principles, including those of the GDPR and South Africa’s POPIA, for learners across the continent.

We keep your account data while your account is active. You can delete your account at any time in Settings → Security, or by writing to [email protected]. Deletion takes effect after a 30-day recovery period, during which you can change your mind. After that, your sign-in identity and profile are erased and your name, email address and mobile number are removed from our records.

We keep an anonymized record of learning activity, and a minimal record of any certificate we issued so that it can still be verified. Data on your own device is removed when you uninstall the app. Diagnostic reports and security logs are kept only as long as needed for support, security and reliability work.

The Platform is not directed at children under 13, and you must be at least 13 to create an account. If you are between 13 and 18, you need a parent’s or guardian’s consent to use the Platform. If we learn that we have collected personal data from a child under 13, we will delete it; if you believe this has happened, contact us at [email protected].

You can, at any time:

• Get a copy of the personal data we hold about you — download it yourself in Settings → Security, or ask us.
• Correct inaccurate profile data, most of it directly in Settings.
• Delete your account, as described in section 08.
• Object to or restrict specific processing.

To exercise any of these, email [email protected]. We respond within 30 days. If you are unhappy with our response, you can complain to the data protection authority in your country — in Zimbabwe, the Postal and Telecommunications Regulatory Authority (POTRAZ).

When this policy changes in a way that matters, we will say so in the Platform before the change takes effect — the “last updated” date at the top always reflects the current revision.