UGSRC App Privacy Policy

Last Updated: January 29, 2026

Introduction

Welcome to the UGSRC app, the University of Ghana Student Representative Council mobile application. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the UGSRC app for announcements, events, scholarships, clubs, blogs, polls, AI assistant (Ujamaa), real-time feedback chat, and other student services.

Information We Collect

Personal Information

We collect personal information that you provide during registration and use:

• Full name and email address
• Academic details: program, level (collected during onboarding)
• Scholarship applications: University of Ghana Student ID number, personal statements
• Event registrations and club interests
• Blog comments and poll responses
• Feedback submissions (may be anonymous)

Usage & Device Information

We automatically collect information about your app usage:

• Features accessed, content viewed, search queries
• Device type, OS, app version, push notification tokens
• Error logs and performance data for app improvement
• Real-time feedback chat data (via Socket.io)
• Poll votes, blog likes/comments, event registrations
• AI assistant (Ujamaa) conversations and token usage

Authentication Data

Passwordless authentication via OTP is managed through Supabase:

• Hashed OTP codes (not stored in plain text)
• OTP verification records with rate limiting
• Authentication tokens and session data
• Email verification status and login history

How We Use Your Information

We use the information we collect for the following purposes:

• Account management via passwordless OTP authentication
• Delivering personalized content: announcements, events, blogs, scholarships
• Processing scholarship applications and tracking status
• Event registrations and automated reminders
• Club information and associated content delivery
• Conducting polls and displaying aggregated results
• Powering the AI assistant (Ujamaa) with trusted campus data
• Real-time feedback chat between students and SRC executives
• Managing notification preferences and quiet hours
• Sending push notifications based on your settings
• App performance optimization, analytics, and bug fixes
• Ensuring compliance with University of Ghana policies

Data Sharing and Disclosure

We do NOT sell, rent, or trade your personal information. We may share data only in these circumstances:

• UG Administration: For enrollment verification and official purposes
• SRC Executives: For feedback routing, scholarship reviews, and event management
• Service Providers: Supabase (database/auth/storage), Railway (hosting), Socket.io (real-time chat), OpenAI (AI assistant), Tavily (AI web searches)
• Club Executives: Limited access to club-related content and member engagement data
• Legal Requirements: When required by law or to protect rights/safety
• Business Transfers: In case of merger or university reorganization

Data Security

We implement comprehensive security measures to protect your information:

• TLS/HTTPS encryption for all data in transit
• Bcrypt hashing for OTP codes (not stored in plain text)
• OTP rate limiting to prevent brute-force attacks
• JWT token-based authentication with secure session management
• Secure local storage (iOS Keychain, Android Keystore)
• Row-Level Security (RLS) policies in Supabase database
• Role-based access controls for executives and club managers
• Supabase Storage policies for secure file uploads
• Regular security updates, code reviews, and penetration testing
• Data breach notification within 72 hours if incident occurs

Your Rights

• Access and review your personal data
• Request correction of inaccurate information
• Request deletion of your personal data
• Object to processing of your data
• Withdraw consent at any time
• Export your data in a portable format

Data Retention

• Active students: Data retained during enrollment + 1 year after graduation
• Scholarship applications: Retained for 3 years after submission
• Feedback & chat messages: Retained for 2 years from submission
• AI chat history: Retained until user deletion or 1 year after graduation
• Poll responses: Retained indefinitely for historical data and analytics
• Blog comments and likes: Retained for 2 years or until content deletion
• Event registrations: Retained for 1 year after event date
• OTP records: Auto-expire after 10 minutes and deleted after 30 days
• Usage logs: Retained for 12 months for analytics
• Graduated/inactive: Account archived after 1 year, deleted after 2 more years
• Upon deletion request: Data deleted within 30 days (legal exceptions apply)

Children's Privacy

The UGSRC app is intended for use by registered University of Ghana students who are typically 18 years of age or older. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information.

Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

Third-Party Services

• Supabase: Database, passwordless authentication, file storage, and real-time subscriptions
• Railway: Backend server hosting infrastructure
• Socket.io: Real-time messaging for feedback chat
• OpenAI: Powers the AI assistant (Ujamaa) with GPT-4 technology
• Tavily: AI web searches
• Mailgun: Transactional emails for OTP delivery
• Expo/React Native: Mobile app development framework
• PascoHub: Academic platform for past exam questions
• All third-party services comply with data protection regulations

Device Permissions

• Media Library (Photos and Documents): For uploading past exam questions to the PascoHub service
• Notifications: For push notifications about events, announcements, and updates
• Local Storage: For theme preferences, onboarding status, and auth tokens
• Network: For API communication and real-time chat
• All permissions are requested with clear explanations and can be revoked

Analytics & Tracking

• Anonymous usage statistics to improve app features
• Error logs for debugging and performance optimization
• AI usage metrics (tokens consumed, conversation length) for fair usage
• Feature engagement data (poll participation, event registrations, blog views)
• No data is sold to advertisers or marketing companies
• Analytics are used solely for improving student experience

AI Assistant Data

• Conversations are stored in your chat history for continuity
• Questions are sent to OpenAI GPT-4 along with trusted campus data
• No personal identifying information is sent to OpenAI beyond your question
• Chat history can be deleted at any time from the AI tab
• Daily usage limits prevent abuse and ensure fair access
• AI responses are generated based on official school documents, web searches, and app content (announcements, events, blogs, etc.)
• We do not train custom AI models on your conversations

Notification Preferences

• Customize notifications by category (announcements, events, polls, blogs, scholarships, clubs)
• Enable/disable push notifications
• Set quiet hours to silence notifications during specific times
• Opt out of specific notification types while keeping others active
• Urgent announcements may override some settings for safety
• All preferences are synced across devices

PascoHub (Third-Party Service)

• PascoHub is NOT operated by UGSRC—it is a third-party service with its own management
• Requires separate authentication with your email (independent from UGSRC login)
• Provides access to past exam questions and study materials uploaded by students
• Uses a credit system: earn credits by uploading verified materials, spend credits to download
• Your PascoHub data (uploads, downloads, credits) is managed by PascoHub, not the SRC
• The SRC does not have access to your PascoHub activity or personal data
• PascoHub has its own privacy policy and terms of service—please review them
• Integration is provided for convenience, but data handling is governed by PascoHub policies
• For PascoHub-specific issues, contact PascoHub support directly
• The SRC is not responsible for PascoHub data practices, service availability, or content accuracy

For questions about this policy, please contact the developer via email at gabrieladjeiboye@gmail.com.