Privacy Policy

Coursy (coursy.sy) is a platform that helps students in Syria find training courses and enroll with training institutes and instructors. This policy covers the Coursy mobile app (Android and iOS) and the coursy.sy website.

Data you give us

When you create a student account and edit your profile:

• First and last name, email address and phone number.
• Your password, stored only in encrypted (hashed) form that nobody can read, including us.
• Gender, date of birth and city.
• Education level, university and major.
• Interests (the course categories you choose) and how far from you new courses should be to notify you.
• Profile photo, if you add one.

Data created when you use the app

• Course enrollments and their status (pending, approved, rejected, cancelled).
• Favorite courses, and the ratings and reviews you write.
• The notifications we send you and whether you have read them.
• Views of course and institute pages. Institutes only see the total number of views.

Payment data

Some courses ask for an advance payment through ShamCash. You transfer the money from your own ShamCash wallet directly to the institute's ShamCash account; it never passes through Coursy and we never see your ShamCash login. To confirm your transfer we look it up in the institute's account and store:

• The transaction number, amount, currency and date.
• The sender name and ShamCash address that ShamCash reports with the transfer.

Technical data

• Your device's notification token (Firebase Cloud Messaging by Google), its platform and the app language, to send you notifications.
• Crash reports (Firebase Crashlytics by Google) when the app stops unexpectedly: device model, operating system and app version, and the technical details of the error. They do not include your profile data.
• The IP address of requests to our server, used to protect the service against abuse.

How we use your data

• To run your account and show you courses, institutes and instructors.
• To send your enrollment to the institute and tell you when it is approved, rejected or cancelled.
• To verify your ShamCash payments and confirm them to you and the institute.
• To suggest courses and notify you about new ones that match your interests and city.
• To keep the service secure and fix crashes.

Who we share it with

• The institute or instructor offering a course you enroll in: your name, contact details and the status of your enrollment and payments for that course, so they can confirm your seat and contact you.
• Other users: reviews are public and show your first name, the first letter of your last name and your profile photo. Your email, phone and date of birth are never shown.
• Google Firebase, as our service provider for notifications and crash reports.
• ShamCash: to verify a transfer we query the institute's ShamCash account by transaction number.
• Authorities, only when the law requires it.

We do not sell your data or share it for advertising.

How long we keep it

• Your data is kept while your account exists.
• When you delete your account, your profile, enrollments, favorites, reviews, notifications and device tokens are deleted immediately and your email and phone number can be used again.
• Payment records stay with the institute as its financial records, without any link to you and without the sender name and address: only the transaction number, amount, currency, date and institute remain.
• Crash reports are kept by Firebase Crashlytics for 90 days.
• Copies can remain in our server backups until those backups are replaced in the regular backup cycle.

Your rights

• See and correct your data at any time from your profile in the app.
• Delete your account and data in the app (Settings → Delete account) or on the account deletion page, without installing the app.
• Turn notifications off in your phone's settings.
• Ask us any question about your data using the contact details below.

Delete your account

Security

All traffic between the app and our server is encrypted (HTTPS). Passwords are stored hashed, institutes' payment credentials are stored encrypted, and you can sign out of the app at any time, which ends that session on the server.

Changes to this policy

When this policy changes we update this page and the date at the top.

Other ways to reach us

• Email: info@coursy.sy
• Phone: +963 981 974 974
• Address: Damascus, Syria