Peak Software (Pty) Ltd ("we", "us", "our") runs Mam': the website studypastpapers.com and the Mam': Homework Help & Exams mobile app. This policy explains what information we collect, why we collect it, and the choices you have. We comply with the Protection of Personal Information Act, 2013 (POPIA) of South Africa.

1. Information we collect

1.1 Information you give us

Profile details — first name, surname, email address, mobile number, display name, grade (9–12), home language, and selected subjects. All fields are optional except where needed for a specific feature (e.g. mobile number is required to receive an OTP).
Account dates — the date you created your account. We record this for new accounts.
Verification data — one-time passcodes (OTP) we send to your mobile by SMS to confirm you own the number.
Content you create — quiz answers, questions you ask Ask Mam' (our AI homework helper), feedback and bug reports.
Photos and videos you choose to send — when you attach a photo or video to a question in Ask Mam', it is uploaded so the AI can read it. Uploads are deleted automatically after 24 hours. We never access your camera or photo library unless you choose to attach something.
Community map — if you choose to share, we store your province, your grade, and how ready you rate yourself for each subject. You pick the province yourself. We do not use your location. Details are in section 2.1.
Past papers you send us — when you use "Send us a past paper", we store the files you send (PDF or photos) and any details you type, such as subject, grade, year and a note. Details are in section 2.2.
Competition entries — if you enter a competition, we store your name, email address, phone number (optional), whether you are 18 or older, a parent or guardian's consent if you are not, and your survey answers. Details are in section 2.3.
ChatGPT link — if you link a ChatGPT account, we store the sign-in tokens OpenAI gives us, in encrypted form. Details are in section 2.4.

1.2 Information collected automatically

App identifiers — an account ID if you sign in, and a random ID stored on your device. We use them to keep your daily Ask Mam' question allowance fair across sign-outs and reinstalls. We store them in hashed form.
Device & usage data — device model, operating system, app version, language, IP address, pages or screens viewed, and interactions (e.g. which papers you download).
Where an install came from, and how far setup got — we count which app store page or link a new install came from, and how far new installs get through setup (for example, how many reach the grade or subjects step), as anonymous totals only.
Cookies and similar technologies on the website for essential functionality and analytics. You can clear or block these in your browser at any time.

1.3 Information we do not collect

We do not ask for ID numbers (except from a competition winner, see section 2.3), addresses, payment card details, or sensitive personal information (religion, health, political views, etc.). If a future feature requires any of these, we will update this policy and ask for clear consent.

2. How we use your information

To give you access to past papers, memos and study tools.
To personalise your experience (e.g. show papers for your grade and subjects).
To send you OTPs so you can verify your mobile number and log in.
To keep the service working — diagnostics, crash reports, fraud and abuse prevention.
To measure how the service is used so we can improve it (aggregated analytics).
To show advertising that helps keep the service free, where applicable.
To run the weekly leaderboard. See section 2.5.

2.1 Community map

The community map shows how ready learners feel for their exams, by province. Sharing is optional and off until you turn it on.

We store your province, grade and readiness for each subject (a number from 0 to 100 that your phone works out from your own ratings and progress). The row is linked to a hashed form of your account or device ID, not to your name.
The map only shows averages for a province. A province shows no numbers until at least 20 learners have shared. A subject is only named once at least 20 learners have rated it. No single learner's answers are ever shown.
We keep your shared data for 120 days after your last share, then it is deleted automatically.
Tap Stop sharing in the app at any time. This deletes your shared data straight away.

2.2 Past papers you send us

We use the files and details you send to check the paper and, if it is suitable, add it to our catalogue.
Our admins review each submission. We store it with a hashed form of your account or device ID, the app version and your country, so you can see its status in the app and so we can limit abuse.
Please do not send anything with your name, ID number, school report or other personal details on it.
We keep submissions for up to 180 days, then delete them. If we add a paper to the catalogue, the paper itself becomes part of the public catalogue. Your identity is never shown with it.

2.3 Competitions

From time to time we may run a competition in the app. Entry is optional and free. Each competition has its own rules, shown in the app before you enter.

We collect your name, email address, an optional phone number, your account ID, and whether you are 18 or older.
Entrants under 18 must confirm that a parent or guardian agrees to the entry. We may ask the parent or guardian to confirm before we hand over a prize. A parent or guardian can ask us to withdraw a child's entry at any time.
The entry form includes a short survey: for example your grade, province, how you heard about the app, which features you use, how likely you are to recommend it, and what phone and data access you have.
We use entries to run the draw, contact the winner and hand over the prize. We use survey answers to understand how learners use the app, in anonymous form only. Survey answers used for research are never linked to your name, email or phone number.
Before we hand over a prize, the winner (or their parent or guardian) must confirm their identity. This may include an ID number, which the Consumer Protection Act regulations require us to keep on record.
We only publish a winner's first name and the first letter of their surname, and only with their consent.
We do not use competition entries for marketing and we do not sell them.
You can withdraw your entry before the closing date in the app (Me → Competition → Withdraw my entry) or by email. This deletes your entry.
We keep competition records, including winner records, for three years after the competition, as the Consumer Protection Act regulations require. Then we delete them.

2.4 Sign in with ChatGPT

This feature is not switched on yet. If we switch it on, a signed-in learner can link a ChatGPT account so Ask Mam' answers on their own ChatGPT plan.

When you link, we store the sign-in tokens OpenAI gives us, encrypted, and a hashed form of your ChatGPT account ID. We do not keep your ChatGPT email, name or picture.
While linked, your Ask Mam' questions and attachments are sent to OpenAI and processed under your ChatGPT plan and OpenAI's own terms and privacy policy.
You can unlink at any time in the app. We then revoke the link with OpenAI and delete the stored tokens.

2.5 Leaderboard

The weekly leaderboard is public to other users. It shows your display name (or your first name if you have not set one, or "Learner from Grade X"), the avatar you picked, and your weekly points. Set a display name in your profile if you do not want your first name shown.

3. Legal basis (POPIA)

Under POPIA we process your personal information on the grounds of: (a) your consent, which you can withdraw at any time; (b) performance of a contract with you (providing the app and website); (c) our legitimate interests in operating and improving the service; and (d) legal obligations where they apply.

4. Who we share information with

We do not sell your personal information. We share limited information with trusted service providers that help us run the service:

Amazon Web Services (AWS) — hosting, storage, database and serverless compute. Our production infrastructure runs in the Africa (Cape Town) region (af-south-1) and the content-delivery layer runs globally on Amazon CloudFront.
AWS Simple Notification Service (SNS) — sends OTP SMS messages to your mobile.
Google Analytics — aggregated usage analytics. IP anonymisation is enabled where supported.
Google AdMob — serves ads in the mobile app. We do not ask permission to track you on iOS, so ads in the iOS app are not targeted using your advertising identifier.
Apple App Store / Google Play — distribute the mobile app and collect crash reports.
Google Firebase Authentication — handles sign-in with Google, email and password, and phone.
Google Gemini and OpenAI — if you use Ask Mam' or the quiz generator, your question and any photo or video you attach are sent to an AI model to produce a response. We do not send your name, email, mobile, or account identifiers with the request. We do not keep the text of your questions on our servers; your chat history stays on your phone.
OpenAI (Sign in with ChatGPT) — only if you link a ChatGPT account (see section 2.4). OpenAI then handles the sign-in and processes your Ask Mam' questions on your ChatGPT plan.

We may also disclose information if required by law, to enforce our terms, or to protect rights, safety and property.

5. Cross-border transfers

Some of our providers (e.g. Google, OpenAI) process data outside South Africa. When this happens we rely on provider safeguards (such as standard contractual clauses) to ensure your information receives equivalent protection as required by POPIA.

6. How we protect information

We use industry-standard measures: encryption in transit (HTTPS / TLS), encryption at rest for our databases and object storage, least-privilege IAM access, short-lived credentials, and server-side logging of sensitive actions. No system is perfectly secure; if we ever suffer a breach involving your personal information we will notify the Information Regulator and affected users as POPIA requires.

7. How long we keep information

Active profile — kept while your account is active.
OTP codes — valid for 10 minutes then discarded.
Usage logs — retained for up to 90 days for operations and security.
Backups — kept for up to 35 days on a rolling window.
Community map data — 120 days after your last share, or until you tap Stop sharing.
Past papers you send us — up to 180 days. A paper we add to the catalogue stays in the public catalogue, without your identity.
Competition records — three years after the competition, as the Consumer Protection Act regulations require.
ChatGPT link — until you unlink or delete your account.

If you delete your account, we remove your profile from the active database. Backup snapshots that may still contain your data are overwritten within the backup retention window.

8. Your rights

POPIA gives you the right to:

access the personal information we hold about you;
correct or update information that is wrong or outdated;
request deletion of your account and associated data (see how to delete your account);
object to processing for direct marketing or for purposes based on our legitimate interest;
withdraw consent you previously gave, at any time, without affecting processing that happened before you withdrew it;
lodge a complaint with the Information Regulator (South Africa).

Deleting your account

The fastest way to remove your account and associated data is the dedicated form on our account-deletion page. We confirm receipt by email within 7 days and complete the deletion within 30 days. The page lists exactly what gets removed and what is retained.

For the other rights above, email us at support@studypastpapers.com. You can also clear your local profile at any time from Profile → Clear all data in the app — note this only wipes the copy on your device and does not delete your account from our servers.

9. Children

Many of our users are school learners under 18. We only collect information reasonably necessary to provide the service. If you are under 18 you should have a parent or guardian's permission to use the app. Under POPIA a parent or guardian gives consent for a child. Entrants to a competition who are under 18 must confirm a parent or guardian's consent (see section 2.3). A parent or guardian can ask us to access, correct or delete a child's information. If you believe a child has given us information without permission, contact us and we will delete it.

10. Third-party links

The service may link to third-party sites (for example app store listings, news articles, or education resources). Their privacy practices are their own; we encourage you to read their policies.

11. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date above and, where reasonable, notify you in the app.

12. Contact

Questions, requests or complaints: support@studypastpapers.com

Information Regulator (South Africa): inforegulator.org.za