Privacy policy

This policy explains what personal information ofcourse collects, why, who else handles it, how long it is kept and what you can ask us to do with it. It is written to meet South Africa's Protection of Personal Information Act (POPIA) and, for visitors in the European Union and the United Kingdom, the GDPR.

Who we are

ofcourse (ofcourse.website) is run by cazz, an individual based in South Africa, who is the responsible party (the “controller”) for your information and also its information officer. For anything in this policy, email hello@ofcourse.website.

What we collect and why

Your account

• Name, email address and password. To create your account, sign you in and send you account emails (email verification and password resets). Your password is stored only as a one-way hash; nobody can read it.
• Your role and course access. Whether you are a member or staff, and whether you have been given access to courses, so we can show you what you are allowed to see.
• Profile details you choose to add: a display name, a short bio, an avatar image and an accent colour. All are optional.

What you do while learning

• Lesson progress (which lessons you have completed), so you can pick up where you left off.
• Exercise code and results for the coding exercises in lessons, so your work follows you between devices.
• Notes and bookmarks. Private to you: nobody else, including staff, can read them.
• Questions you ask on a lesson. These are public to everyone who can read that lesson, together with your display name and avatar. Answers come from the course's author or an admin.
• Problem reports you send about a lesson. Seen by the course's author and admins only.

Security records

• Signed-in sessions: your IP address and your browser's user-agent string, so you (and, if your account is misused, an admin) can see and sign out your devices.
• Sign-in attempts: a one-way hash of the email address entered, your IP address, your user agent and whether the attempt worked, to detect password-guessing.
• An activity log of changes such as completing a lesson, being granted course access and staff actions, with the IP address the change came from, so we can investigate abuse and undo mistakes.
• Rate-limit counters keyed by IP address or account, to stop automated abuse.

Anonymous counts

To improve lessons we count, per lesson and per day, how often quiz questions are answered right first time and how often hints are opened, and we keep course searches that found nothing (the search text only). These counts are not linked to you or your account.

Payments

When paid course access becomes available, payments will be handled by Stripe. We will never see or store your card number; we keep a record of what you bought and when, and Stripe processes your payment details under its own privacy policy.

What we don't collect

We do not use advertising, third-party analytics or tracking pixels, we do not build profiles of you for marketing and we never sell your information. We do not currently collect visitor statistics; if we start, this policy will describe exactly what is recorded first.

Our legal grounds

• To provide the service you signed up for (your account, progress, exercises, notes and questions).
• Our legitimate interest in keeping the site secure (sessions, sign-in attempts, the activity log and rate limits).
• Your consent for the optional profile details, which you can remove at any time in your settings.
• Legal obligations, for example keeping payment records once payments exist.

Who else handles your information

We use these service providers (operators) to run the site. Each processes your information only to provide its service to us:

• Vercel hosts the site, stores uploaded images (Vercel Blob) and runs bot protection (Vercel BotID) on sign-up, verification and password-reset requests, which checks signals from your browser to tell people from automated scripts.
• Neon hosts our database.
• Resend sends our account emails.
• Stripe will process payments once they are available.
• YouTube (Google): video pages show a still image until you press play. Only then is the player loaded from youtube-nocookie.com, and YouTube's own privacy policy applies to it.

We may also disclose information when the law requires it, or to protect the safety of users or the site.

Information sent outside South Africa

Our providers store and process information outside South Africa, including in the United States and the European Union. We use providers that commit, in their data-processing terms, to protecting personal information to a standard comparable to POPIA and the GDPR. By using ofcourse you understand that your information is transferred this way.

Cookies and browser storage

We use only cookies that are needed for the site to work or that remember a choice you made, so we do not ask for cookie consent. There are no advertising or analytics cookies.

• __Secure-better-auth.session_token: keeps you signed in. Essential. Kept until you sign out, or 7 days without a visit.
• theme: remembers whether you chose the light, dark or system theme. Kept for 1 year.
• accent: remembers the accent colour you picked. Kept for 1 year.

Your browser's local storage also keeps, on your device only: unsaved editor drafts, your reading position in lessons, exercise code, and display choices for code blocks. Drafts, reading positions and exercise code are cleared when you sign out. You can clear all of it at any time in your browser's settings.

How long we keep it

• Account, profile and learning data: for as long as you have an account. Deleting your account deletes your profile, progress, exercise code, notes and questions.
• Sessions: until they expire (7 days without a visit) or you sign out, then deleted daily.
• Sign-in attempts: 90 days.
• Rate-limit counters: about a day.
• The activity log: kept for as long as it is needed to investigate abuse; we are working on a fixed limit.
• Problem reports and anonymous counts: kept, without your name, after your account is deleted.
• Payment records: as long as tax law requires.

Your rights

You can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong;
• delete your account and your information;
• stop or restrict using it, or object to how we use it;
• send it to you in a machine-readable format.

You can change your name, profile, avatar and password yourself in your settings. For anything else, including deleting your account or getting a copy of your data, email hello@ofcourse.website from the address on your account. We will reply within 30 days.

If you are unhappy with how we handle your information, you can complain to South Africa's Information Regulator (inforegulator.org.za) or, if you live in the EU or UK, to your local data-protection authority. We would appreciate the chance to fix it first.

Children

You must be at least 13 to use ofcourse. If you are under 18, you need the permission of a parent or guardian, who agrees to this policy on your behalf. If we learn that someone under 13 has an account, or that a minor is using it without permission, we will delete it. A parent or guardian can ask us to do this by emailing hello@ofcourse.website.

Security

Connections are encrypted, passwords are hashed, uploaded images are re-encoded to remove hidden metadata, and access to personal information is limited to what each role needs. No system is perfectly secure; if a breach affects your information, we will tell you and the Information Regulator as the law requires.

Changes to this policy

When this policy changes, the date at the top changes too. If a change matters to how your information is used, we will email you before it takes effect.