Privacy Policy

Effective date: 31 August 2026
Last updated: 31 August 2026

This Privacy Policy describes how Eduvera collects, uses, stores, shares, and deletes personal information when you use the Eduvera website at https://eduvera.pro and the Eduvera Android application (package name pro.eduvera.app). It applies only to practices that exist in the current Eduvera platform.

1. Introduction

Eduvera is an educational and social learning platform. Depending on how you use it, you can create an account, build a student or teacher profile, take and create courses and lessons, upload or view PDFs and other educational resources, watch videos, complete quizzes, track learning progress, join communities, publish posts, follow other users, send messages, receive in-app notifications, and (where enabled) purchase paid courses or ebooks or request instructor payouts.

This policy explains the personal information involved in those features. If we do not mention a type of data, permission, or third-party service, that is because the current Eduvera codebase does not implement it.

2. Who We Are

The Eduvera website and Android application are operated by Eduvera. The project does not currently publish a separate incorporated company name in its source code or public site configuration. In this policy, “Eduvera”, “we”, “us”, and “our” mean the operator of Eduvera.

Website: https://eduvera.pro
Android application: Eduvera (pro.eduvera.app)
Privacy and support contact: support.eduvera@gmail.com

Transactional emails (for example, email verification and password reset) are sent from an Eduvera address such as noreply@eduvera.app or another From address configured for Eduvera mail.

3. Information We Collect

Eduvera collects information in these ways:

Information you provide, such as account details, profile fields, posts, messages, uploads, and payment or payout details you enter.
Information created by your use of the platform, such as learning progress, enrollments, follows, notifications, presence (online / last active), and in-app activity needed to operate the product.
Information from sign-in providers if you use Google or GitHub to create or access an account.
Limited technical information needed to run the service, including authentication tokens stored on your device and, for some security rate limits, IP address in server memory.

Eduvera does not currently collect, through the source code we reviewed:

Precise or GPS location
Device contacts
Camera or microphone recordings (the Android app uses the gallery / file picker, not the camera or microphone APIs)
SMS, phone calls, or call logs
Health or biometric data
Advertising ID

A profile field called “location” and a settings field called “country” may be filled in by you as text. Those are not device location services.

4. Information You Provide

Depending on the feature you use, you may provide:

Full name, username, email address, and password
Profile information described in Section 6
Course, lesson, quiz, PDF/ebook, and community content if you create it
Posts, comments, replies, reactions, file attachments, photos, and YouTube links
Direct and group messages, including text, images, and file attachments
Reports about other users or content (reason and optional description)
Checkout information you enter on Chargily Pay’s payment pages when buying a paid course or ebook
Instructor payout details such as full name, CCP/RIP numbers, phone number, and preferred method (CCP or BaridiMob), if you request a withdrawal
Notification and appearance preferences (theme, language, font size, and notification categories)

5. Account and Authentication Information

Eduvera accounts can be created with:

Email and password. We store your email, a hashed password (not the plain-text password), full name, and a username. The website signup form also collects a username you choose. The Android signup flow collects full name, email, and password; a username may be assigned by the service.
Google sign-in. If Google OAuth is enabled, Google provides an identifier, email, name, and profile photo URL. We store a Google account identifier on your Eduvera user record and may use the photo as your avatar unless you upload a different one.
GitHub sign-in. If GitHub OAuth is enabled, GitHub provides an identifier, email (including from GitHub’s email API when needed), name, and avatar URL. We store a GitHub account identifier on your Eduvera user record.

Email verification uses a short-lived code emailed to you. Password reset uses a hashed reset token emailed as a link. After you sign in, Eduvera issues a JSON Web Token (JWT). On the website the token is stored in the browser’s localStorage. On the Android app it is stored with the app’s secure storage. You can invalidate other sessions with “Log out all other devices”, which increments an account version so older tokens stop working.

GitHub sign-in uses a server session cookie named eduvera.sid during the OAuth flow. See Cookies and Similar Technologies.

An administrator console exists with a separate admin username and password. That console is not a regular user account and is not offered as a consumer sign-up method.

6. Profile Information

If you complete your profile, Eduvera may store:

Full name and username
Headline, bio, occupation, skills, and learning goal
University, academic year, specialty / specialization
Website URL and a free-text location
Country (selected in Settings)
Profile photo and cover image
Role (student or teacher) and related instructor status fields used by the platform
Whether learning courses are shown on your public profile

Some of this information can appear on your public profile to other signed-in users. Email address is used for account access and is not shown as a public profile field in the public-profile API.

The user data model also includes optional gender and birthDate fields used in the administrator analytics dashboard. The current student/teacher profile and settings screens do not collect those fields. They remain unspecified unless otherwise set in the database.

7. Educational and Learning Data

When you learn or teach on Eduvera, we may store:

Course and lesson enrollments (including free and paid enrollments)
Specialization enrollments
Learning progress: completed items, current item, progress percentage, last access time
Video watch progress (percentage and seconds)
PDF viewing progress (pages viewed, download flags)
Quiz scores for lesson quiz items
Saved lessons and saved PDFs associated with your account
Course reviews (rating, comment, display name, and avatar snapshot)
XP, level, login streak, and recent login dates used for gamification
If you are a creator: courses, modules, lessons, quizzes, trailers, thumbnails, and ebooks you upload, plus earnings and withdrawal records

The website may also keep a local copy of some learning and cart/wishlist data in browser localStorage so the interface can restore recent activity on that device.

8. User-Generated Content

Eduvera stores content you choose to publish or upload, including:

Social posts (text, photos, documents such as PDF/Word/PowerPoint/Excel, YouTube links, and shared courses)
Comments, replies, mentions, likes/reactions, and shares
Community (group) names, descriptions, covers, avatars, membership, invites, and join requests
Educational PDFs/ebooks and their covers
Reports you submit about content or users

Other users may see content you make public or share in a community, depending on that community’s privacy setting (public, private, or secret) and your profile visibility choices.

10. Messages and Communications

In-app messages

Eduvera includes a messenger for direct messages and group threads. We store message text, optional image or file attachments, sender and recipient identifiers, read state, mentions, and conversation metadata (including group name, avatar, description, admins, and per-user inbox settings such as mute or archive).

Emails we send

Eduvera sends transactional email for account verification and password reset. Settings include preferences for email, courses, groups, and marketing notifications. The current backend sends email for verification and password reset. A stored “marketing” preference exists, but the current codebase does not implement a separate marketing email campaign system.

In-app notifications

Notifications are stored in Eduvera’s database and shown in the website and Android app. Eduvera does not currently use a third-party push notification vendor such as OneSignal or Firebase Cloud Messaging.

11. Device and Technical Information

To operate the service, Eduvera may process:

The authentication token on your device
Request headers used to identify the client, including X-Eduvera-Client / X-Eduvera-Platform (for example, to distinguish website and mobile payment or OAuth return URLs)
Origin and referer on authentication requests, written to server logs for security auditing (without passwords)
IP address, held temporarily in server memory, for password-reset rate limiting
Realtime connection data for Socket.IO (used for messaging and online presence)

The Android application’s own manifest declares the INTERNET permission. The app also uses libraries that let you pick photos and files from your device (gallery / system file picker) when you choose to upload them. It does not declare or use contacts, SMS, phone, precise location, camera, or microphone permissions in the application manifest we reviewed.

12. Usage and Analytics Information

Eduvera does not currently integrate Google Analytics, Firebase Analytics, Facebook SDK, Mixpanel, Amplitude, Sentry, or similar third-party product-analytics or crash-reporting SDKs.

Platform operators can view first-party dashboards built from Eduvera’s own database (for example, user counts, course activity, and aggregated gender/country/age charts based on stored profile fields). Learning progress and login streak data described above are used to provide the product, not a separate advertising profile.

The Android app may load the Plus Jakarta Sans typeface through the Google Fonts library, which can contact Google font servers. That is a font-loading dependency, not an analytics SDK.

13. Files, Images, PDFs and Videos

When you upload media, files are stored with Eduvera’s storage providers so they can be displayed to you and to other users who are allowed to see them. Current uploads use:

Bunny.net Storage for images, PDFs, documents, avatars, covers, message attachments, and similar files
Bunny Stream for hosted course/lesson videos

Some older media URLs in the database may still point to Cloudinary. New uploads are implemented against Bunny.net. Eduvera does not currently use Cloudinary as the active upload destination.

If you attach a YouTube link to a post or lesson, YouTube (Google) may collect data according to YouTube’s own privacy policy when that embed is loaded or played.

PDFs can be viewed in the app and website using client-side PDF viewers. Those viewers render the file on your device; Eduvera does not send those files to a separate PDF-analytics vendor.

14. Payments and Instructor Payouts

Paid courses and ebooks are checked out through Chargily Pay. Eduvera creates a payment transaction in its database (user, product, amounts, currency, status, Chargily checkout identifier) and sends Chargily metadata that includes Eduvera’s transaction id, product type, product id, and user id. Card or wallet details you enter on Chargily’s checkout pages are processed by Chargily, not stored as card numbers in Eduvera’s database.

Instructors who request withdrawals provide payout account information (name, account/RIP number, phone, method). Eduvera stores withdrawal requests, allocation records, optional receipts, and an append-only financial audit log for payments, earnings, and withdrawals.

Eduvera does not currently integrate Stripe, PayPal, or AdMob.

15. How We Use Information

We use the information described in this policy to:

Create and authenticate accounts, verify email, and reset passwords
Show profiles, feeds, courses, communities, messages, and notifications
Deliver and track learning content, progress, and enrollments
Host and display files, images, PDFs, and videos you or other users upload
Process course/ebook purchases and instructor payouts
Moderate content, handle reports, and enforce account blocks or bans
Operate realtime messaging and presence
Secure the service (rate limits, auth audit logs, session invalidation)
Provide first-party operator dashboards
Send transactional email

We do not currently use personal information to serve third-party advertising in the Eduvera app or website.

17. Third-Party Service Providers

The following third-party services are actually used by the current project:

MongoDB — primary application database for accounts, content, progress, messages, payments, and related records.
Bunny.net (Storage and Stream, with a Bunny CDN hostname) — file and video hosting and delivery.
Chargily Pay — payment checkout for paid courses and ebooks.
Google OAuth — optional account sign-in. Google receives the information required for that OAuth flow.
GitHub OAuth — optional account sign-in. GitHub receives the information required for that OAuth flow.
Email delivery — Nodemailer via generic SMTP, or Brevo SMTP (smtp-relay.brevo.com) when Brevo credentials are configured. Recipients’ email addresses and message content for verification/reset are sent through that mail provider.
Vercel — hosts the Eduvera website.
Render — hosts the Eduvera API.
YouTube / Google — only if a YouTube embed or thumbnail is loaded.
Google Fonts — Android app typeface loading, as described above.

Cloudinary may still appear in older stored URLs and compatibility code. It is not the current upload provider.

Socket.IO is used as part of Eduvera’s own realtime server, not as a separate consumer data broker.

18. Data Storage and Security

Account and application data are stored in MongoDB. Uploaded files and hosted videos are stored with Bunny.net. The website is served from Vercel; the API runs on Render. Production traffic is intended to use HTTPS.

We apply these safeguards that exist in the current implementation:

Passwords are hashed with bcrypt before storage
Password-reset tokens are stored hashed
JWTs are used for API authentication; OAuth-only GitHub flow uses an HTTP-only session cookie
Chargily webhooks are verified with an HMAC signature
The Android app stores the session token in secure storage rather than plain preferences

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact support.eduvera@gmail.com and use “Log out all other devices” in Settings.

19. Data Retention

Eduvera keeps account and content data while your account remains open so the product can function. We do not currently publish an automated deletion schedule for inactive accounts.

Some data is kept for a limited purpose:

Email verification codes and password-reset tokens expire after a short period
Password-reset rate-limit records are held in server memory and are not a permanent user profile
Login-date history used for streak/heatmap is capped (last 90 days in the user model)
Pending Chargily checkouts may be reused for a limited time and then expire or fail according to payment status

Payment transactions, instructor earnings, withdrawal records, and financial audit logs may be retained after other account data is removed, because they are operational and accounting records.

20. Account and Data Deletion

You can delete your Eduvera account in any of these ways:

Public deletion page (no app login required): https://eduvera.pro/delete-account. Enter the email on the account. Eduvera emails a confirmation link to that address. Completing the link (and your password, if the account has one) runs the same server-side deletion as in-app deletion.
Website: sign in, then open Settings → Account & Security → Delete account.
Android app: Settings → Account & Security → Delete account.

Authenticated deletion requires typing DELETE. If the account has a password, that password is also required. OAuth-only accounts (Google or GitHub without a password) confirm with DELETE after email verification or while signed in. A user can only delete their own account. The client cannot supply another user’s id.

What is deleted

When deletion completes, Eduvera removes the user account record (profile, hashed password, Google/GitHub identifiers, notification and appearance preferences, saved-item lists, XP and streak fields, messenger block list) and associated personal data we do not need to retain, including:

Posts you authored, including uploaded images and files
Your comments, replies, reactions, likes, and shares
Follow relationships
Your learning progress, specialization enrollments, course enrollments, ebook purchases (access records), and reviews you wrote
Notifications sent to you or from you
The text and attachments of messages you sent (other people’s messages remain in their conversations)
Communities/groups you created that have no remaining members, including their images
Draft or unused courses, lessons, and ebooks you owned that no other learner enrolled in or purchased, including hosted video and file assets
Pending account-deletion request records for that email

What may be anonymized

If other people already enrolled in or purchased a course or ebook you created, Eduvera keeps that educational content so those users are not cut off. Your instructor name on those items is replaced with a generic “Deleted user” label, and your user id is removed from course ownership where the schema allows it. In group chats or communities that other people still use, you are removed as a member; remaining content they created is not deleted.

What may be retained and why

Eduvera may retain the following after account deletion for accounting, tax, fraud-prevention, dispute-handling, security, and legal compliance:

Payment transactions and Chargily checkout identifiers (amounts, product ids, status). Card numbers are not stored in Eduvera’s database.
Instructor earnings rows and withdrawal amount/status history. Bank/CCP numbers, RIP, phone numbers, and payout account names are cleared from withdrawal records. Receipt files are removed from storage.
Append-only financial audit logs (event type, amounts, internal ids). Those logs do not store your password or payment card data.
Moderation reports, which may keep an internal user id with no profile attached.

Retained financial records are kept for as long as we need them for accounting, fraud prevention, and applicable law, then are no longer used for operating an Eduvera account. We do not use retained records to restore a deleted social profile.

Hosted files on Bunny.net that were exclusively yours are deleted when technically possible. Failed storage deletions are queued and retried. Legacy Cloudinary URLs and some old local /uploads/ files are removed from our database pointers; Cloudinary files cannot be remotely deleted without a Cloudinary API that this project does not currently use. Chargily Pay may keep checkout records on its own systems (Eduvera stores Chargily ids and amounts, not card numbers).

If you cannot use the confirmation email, contact support.eduvera@gmail.com from the address on the account. We process verified requests through the same server-side deletion process. See also https://eduvera.pro/delete-account.

21. Children's Privacy

Eduvera is an educational platform aimed at university-level learners and teachers. It is not directed at children under 13, and the current sign-up flow does not collect a date of birth or otherwise verify age.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact support.eduvera@gmail.com so we can delete the account record and review related data.

22. International Data Transfers

Eduvera’s operators and many users are connected with Algeria and other countries. Hosting and subprocessors (including MongoDB, Bunny.net, Vercel, Render, Google, GitHub, Chargily, and email delivery) may process data in countries other than your own. If you use Eduvera, your information may be transferred to and stored on servers in those locations.

23. Your Privacy Rights

Depending on where you live, you may have the right to:

Access personal information we hold about you
Correct inaccurate profile information (you can edit much of this in Profile and Settings)
Delete your account as described in Section 20, and request deletion of remaining data
Withdraw consent where processing is based on consent (for example, by disconnecting optional OAuth use going forward, or by deleting your account)

To exercise these rights, use the in-product settings where available, or email support.eduvera@gmail.com. We may need to verify that the request comes from the account holder.

24. Cookies and Similar Technologies

Eduvera uses a small number of cookies and similar storage technologies:

eduvera.sid — HTTP-only session cookie used for the GitHub OAuth sign-in flow on the API. It is not used as an advertising cookie.
Browser localStorage / sessionStorage on the website — authentication token, theme and font-size preferences, OAuth error messages, course drafts, cart/wishlist/progress caches, and similar product state.
Android secure storage and shared preferences — session token and local settings such as recent searches.

You can use Eduvera’s public pages, including this Privacy Policy, without logging in and without accepting a marketing cookie banner. This page does not require cookies to be read.

Eduvera does not currently set advertising or third-party analytics cookies.

25. Changes to This Privacy Policy

We may update this Privacy Policy when Eduvera’s product or legal requirements change. The “Last updated” date at the top will change when we do. The current version will be published at https://eduvera.pro/privacy-policy.

26. Contact Us

For privacy questions, account deletion follow-up, or other requests about this policy, contact:

Eduvera
Email: support.eduvera@gmail.com
Website: https://eduvera.pro

There is no separate public Contact page in the current website. Email is the contact method published in the product.