OurwaPlateforme privacy policy
Version of 18 October 2026
OurwaPlateforme is the app that lets parents and guardians follow their children's schooling at the schools that use it: results, absences, homework, messages, documents and payments. This page explains what data the app processes, why, who receives it, how long it is kept and how to exercise your rights.
1. Who is responsible for what
Each school decides what data it holds about its pupils and their families, and how that data is used. It is responsible for that data under Mauritanian Law No. 2017-020 of 22 July 2017 on the protection of personal data. The school creates your account, records grades, absences and payments, and publishes messages and documents.
The publisher publishes the app, maintains the directory of schools and runs the servers on behalf of the schools. The publisher processes the schools' data on their behalf and uses it for no other purpose.
- Publisher: Sidibrahim Mohammed, an individual
- Address: Nouakchott, Mauritania
- Email: 25038@supnum.mr
- Phone: +222 47331944
2. How sign-in works
- Your account is created by your child's school. Your identifier is your phone number. The school gives you a password, which the app makes you change the first time you sign in.
- Each school has its own server and its own data. Schools do not share their data with one another.
- When it starts, the app downloads the directory of schools: the address of each school's server. The directory contains no personal data.
- When you sign in, the app sends your number and password, over an encrypted connection, to the server of each school in the directory. Each server checks them against its own accounts. A server that recognises them opens a session and shows you the children enrolled at that school; the others refuse. This is how a single sign-in shows children enrolled at several schools.
- A server that refuses a sign-in may record the attempt (number entered, IP address, device type) in its security log, as it does for any refused sign-in.
3. Data processed
| Data | Source | Purpose |
|---|---|---|
| Your phone number, your name, other numbers the school has recorded | The school | To identify and contact you |
| Your password | You | To open your account. It is never stored in readable form: only its Argon2id hash is kept |
| Your language (French or Arabic) | You | To show the app and notifications in your language |
| Your children's identity: name, sex, date and place of birth, school number and national identifiers recorded by the school | The school | To link each child to their schooling |
| Schooling: class, year, grades, averages, report cards, rank, absences, late arrivals, remarks, homework and its attachments, timetable | The school | To show you the child's progress |
| Messages from the school, and the fact that you have read them | The school, and you | To inform you; to tell the school the message arrived |
| Documents the school sends you (PDF), the date they were delivered and the date they were first opened | The school, and the app | To deliver the documents; to tell the school they were opened |
| Fees due, payments recorded at the school's cash desk, receipt numbers, months paid, discounts and exemptions | The school | To show you what is paid and what remains due |
| Your device's notification token, its system (Android, iOS) and its language | The app | To send you notifications |
| IP address and device or browser type, at sign-in and at each session renewal | The app | To protect your account: limit password attempts, detect a session used from another device |
| The action log: who did what, when, from which IP address | The servers | Traceability for a system that keeps accounts |
The app takes no payments and sells nothing. It displays the payments the school has recorded.
4. Why this processing is permitted
Under Law No. 2017-020, this processing is based on:
- the relationship between your family and the school: schooling, its follow-up and its fees;
- the school's legal obligations: keeping its school records and its accounts;
- your consent, for notifications: you can withdraw it at any time in your phone's settings;
- the security of the service: sign-in data and the action log.
5. What stays on your phone
- Your session key, the session details and the last dashboard (children's names, averages and absences) are kept in the phone's encrypted storage (Android Keystore, iOS Keychain). They are erased when you sign out and when you delete your account.
- Your language, the list of documents received (so it can be read offline), the directory of schools and the list of notifications already shown are kept in the app's private storage. They are removed when the app is uninstalled.
- On Android, automatic backup of the app's data is disabled: it is not copied to an online backup.
- A report card or document you save goes to the phone's Downloads folder, or opens from the app's temporary folder. It is then under your control.
6. Notifications
If you accept them, the app notifies you when the school records an absence or late arrival, a grade, a remark, homework, a message, a payment, a timetable or a document.
A grade never appears in a notification. The notification says that a grade has been recorded; the grade itself is read in the app. A locked screen can be read by anyone holding the phone.
Notifications go through Firebase Cloud Messaging, a Google service. For each notification, Google receives:
- your device's token;
- the title and text of the notification, which name the child and the event: the date of an absence, the subject of a grade or homework, the amount of a payment, the subject line and text of a message from the school, the title of a document;
- the address of the school's logo and the app screen to open.
Google does not receive your number, your password or any grade. If Firebase is not active on your phone, the app itself checks the school's server and nothing goes through Google. You can turn notifications off in your phone's settings; when you sign out, the device token is deleted from the server.
7. Who receives your data
- The school's staff, according to their role: a teacher sees their classes, the cash desk sees payments, the management sees everything. The server checks every access.
- The publisher, who runs the servers: access is limited to operating, backing up and repairing them.
- The servers' hosting provider, which stores the data without using it. Hosting provider: Hostinger International Ltd.
- Google, for notifications only, as described in section 6.
No one else. No data is sold. None is passed to advertisers, data brokers or social networks. A school does not receive another school's data.
8. Transfers outside Mauritania
The servers that store the data are located outside Mauritania. Country of the servers: United Kingdom.
Google processes notifications on its own servers, outside Mauritania.
9. How long data is kept
| Data | Retention |
|---|---|
| Your account | Until you delete it, or the school closes it |
| The children's school and financial data | As long as the law requires the school to keep its records and accounts. It remains after your account is deleted, linked to an anonymous account |
| Documents and their delivery and opening dates | As long as the school keeps the document |
| The notification token | Until you sign out, delete your account, or Google reports it as invalid |
| Sign-in attempts (number entered, IP address, device type) | 30 days, then deleted automatically |
| Sessions | A session expires after 90 days at most. Its record (sign-in and sign-out dates, IP address, device type) stays in the school's sign-in history |
| The action log | As long as the school keeps its records |
| The web server's access log (IP address, time, page requested without its parameters) | Overwritten continuously: only the most recent entries are kept |
10. Security
- All exchanges between the app and the servers are encrypted (HTTPS).
- Passwords are stored as Argon2id hashes. No one, neither the school nor the publisher, can read them.
- After five wrong passwords, the account is locked for fifteen minutes.
- A session relies on a signed token (ES256) valid for fifteen minutes and on a renewal key stored on the server as a hash and replaced at each use. Reusing an old key closes every session derived from it. Changing your password closes all your other sessions.
- In the database, each school is isolated from the others: a query made for one school cannot read another school's data.
- Actions are recorded in a log.
11. Your rights
Law No. 2017-020 gives you the right to access the data about you, to have it corrected or erased, and to object to its processing.
- In the app: you see the data the school holds about you and your children. You can delete your account: Profil → Supprimer mon compte (Profile → Delete my account; the app is in French or Arabic). What deletion erases and what it keeps: Delete your account.
- With the school: to correct information, a grade or a payment, or to stop being linked to a child. Contact its office.
- With the publisher: for any question about the app or this policy, or if the school does not answer you. Write to the email address in section 1.
- Complaint: you can refer the matter to the personal data protection authority established by Law No. 2017-020.
12. Children
The app is made for adults: the parents and guardians a school has registered as responsible for a pupil. A pupil has no account and does not sign in. You see a child's data because the school has registered you as responsible for that child; if that is no longer the case, tell the school: the link is removed and you no longer see anything about that child.
13. What the app does not do
- No advertising, no advertising identifier.
- No analytics, no tracking across apps or websites.
- No access to your location, contacts, photos, camera or microphone. The only permission requested is for notifications.
14. Changes
Each version of this policy is dated at the top of the page. A change to the data collected or to its recipients applies only with a new version published at this address.
15. Contact
- Publisher: Sidibrahim Mohammed
- Address: Nouakchott, Mauritania
- Email: 25038@supnum.mr
- Phone: +222 47331944
For your children's data, contact their school's office first.