Privacy Policy

Last updated: April 2026  ·  The Advocate — Know Your Rights. Know Your Word.

The Advocate is a self-advocacy training tool. This policy explains what data we collect, why, and how we protect it. We built this app to teach South Africans their rights — including their right to privacy. We apply those same standards to ourselves.

1. What we collect and why

Progress data (stored locally on your device): Your completed scenarios, drill ratings, and bookmarks are saved in your browser's localStorage. This data never leaves your device unless you create an account.

Account data (if you register): Email address, name, and hashed password. We use this to link your progress across devices and to manage your subscription.

Payment data: We do not handle your card details. All payments are processed by PayFast, a South African payment gateway. We receive only a confirmation of successful payment — no card numbers, no banking details.

Usage data: When you use the app, we may record which scenarios and domains you completed. This is used to generate impact reports for grant funders. No personal information is shared with funders — only aggregated counts (e.g. "312 scenarios completed this month").

No behavioural tracking: We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts. There are no tracking cookies on this app.

2. How we use your data

• To sync your progress across devices (account users only)
• To verify your subscription and unlock paid content
• To generate aggregate impact reports for grant applications (anonymised)
• To send transactional emails — for example, a facilitator account approval notification

We do not sell your data. We do not share it with third parties except PayFast (for payment processing), our hosting provider Render (for server operations), and Gmail SMTP (used solely to deliver transactional emails). Each processes data under their own privacy policies.

3. Your rights under POPIA

The Protection of Personal Information Act 4 of 2013 gives you the following rights:

• Right to access: You can request a copy of the personal data we hold about you.
• Right to correction: You can request that incorrect information be corrected.
• Right to deletion: You can request that your account and all associated data be deleted. We will action this within 7 days.
• Right to object: You can object to how we process your data.

To exercise any of these rights, contact us at the address below. We will respond within 14 business days.

4. Data retention

Account data is retained for as long as your account is active. If you delete your account, all personal data is deleted within 7 days. Progress data stored in localStorage is deleted when you clear your browser storage — we have no control over this.

5. Security

Passwords are hashed using bcrypt (minimum 12 rounds) and are never stored in plaintext. All data in transit is encrypted via HTTPS. We do not store payment card details at any point.

6. Children

This app covers topics including children's rights and family law. Users under 18 should use this app with the knowledge of a parent or guardian. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has registered an account, please contact us and we will delete it.

7. Changes to this policy

If we make material changes to this policy, we will update the date at the top of this page and notify registered users by email.