Privacy Policy

This Privacy Policy explains how the Catholic Music Academy ("we," "us," "the Academy") collects, uses, and protects information when you use our mobile app, our web application, or the website at catholicmusicacademy.net (together, "the Service"). The Academy operates under the Catholic Diocese of Warri, Nigeria.

Information We Collect

We collect only what's needed to run the Academy's certification programmes and keep your account secure:

• Account information: your first name, last name, email address, and phone/WhatsApp number, provided when you apply or enrol.
• Password and security question: stored using one-way cryptographic hashing (PBKDF2, 100,000 iterations) — we cannot see or recover your actual password or security answer.
• Payment receipts: images you upload as proof of programme fee payment, used solely to verify and process your enrolment.
• Profile photo: optional, if you choose to add one to your account.
• Academic records: your enrolment status, module progress, assessment scores, written assessment responses, and examination results.
• Notification data: if you enable notifications, we store a device or browser token used only to deliver you updates about your enrolment, modules, and examinations.
• Basic usage data: such as your last login time, used for account security and support.

We do not collect your precise location, and we do not access your device's contacts, camera roll, or files beyond the specific photo or document you choose to upload.

How We Use Your Information

• To create and manage your student account
• To process applications and enrolments, including verifying payment
• To track and display your progress through course modules and assessments
• To communicate with you about your application, modules, examinations, and results — by email, WhatsApp, or in-app/push notification
• To issue Certificates of Competence upon successful completion
• To maintain the security of your account, including detecting suspicious login activity

We do not sell your information, and we do not use it for advertising or share it with marketers.

Who We Share Information With

We use a small number of trusted service providers to run the Service. Each only receives the information necessary to perform its function:

• Supabase — our database and file storage provider, hosting your account data, payment receipts, and profile photos.
• Vercel — hosts our website and the backend functions that power login, notifications, and applications.
• Resend — delivers transactional emails (e.g. application confirmations, course completion notices).
• Expo / push notification services — deliver app notifications to your device, using a device token that does not identify you personally to Expo.

We do not share your information with any other third party, and we never sell it. Academy staff and diocesan administrators involved in processing applications and grading assessments can access relevant student records as part of their role.

Data Retention

We retain your account and academic records for as long as your account is active, and for a reasonable period afterward to maintain accurate academic records (for example, to verify a certificate you were issued in the past). If you'd like your account data deleted, contact us using the details below.

Your Rights

• You can review and update your name, photo, and account details at any time from within the app.
• You can change your password and security question at any time.
• You can request a copy of the personal data we hold about you.
• You can request that we delete your account and associated personal data, subject to reasonable academic record-keeping needs (e.g. verifying a certificate already issued).

Children's Privacy

The Service is intended for use by students of the Academy's music programmes. We do not knowingly collect personal information from children without the involvement of a parent, guardian, or the enrolling institution as part of the normal application process. If you believe a child has provided us with personal information outside of a proper enrolment process, please contact us and we will address it.

Security

Passwords and security answers are never stored in plain text — they are hashed using PBKDF2 with 100,000 iterations before being saved. Payment receipts and photos are stored in access-controlled cloud storage. While no system can guarantee absolute security, we take reasonable technical measures to protect your information.

Changes to This Policy

We may update this Privacy Policy from time to time, for example as the Service adds new features. We'll update the "Last updated" date above when we do. Continued use of the Service after a change means you accept the updated policy.

Contact Us