Privacy policy
This policy explains how the operator of Cohort (Cohort, a trading name. The registered company name and number will be added here once the company is registered.) processes personal information in the Cohort app and at cohortfounding.com, as the responsible party under the Protection of Personal Information Act, 2013 (POPIA). Cohort is designed to know as little about you as possible: you can read without giving us anything, and you can post without giving us your name.
What we collect, and why
When you open the app
- An anonymous account. The app creates a random account identifier so it can load content and keep your settings. It isn't linked to your name, phone number or device identifiers.
- What you tell us about your career: stage (for example trainee or newly qualified), field, region, and how much detail your badge shows. Used to personalise what you see and to describe you, broadly, on posts.
When you verify
- Your work or university email address, used once to email you a six-digit code. Cohort does not store the address. We keep only:
- a one-way, keyed fingerprint of it, so the same address can't create several accounts and so you can restore your account on a new phone;
- what the address's domain tells us: the employer's name and type (for example "Big 4") if we recognise it, or that you are a student.
- The code itself is stored only as a fingerprint and expires after 10 minutes.
- Our email delivery provider (Resend) processes the address to deliver the code and keeps a delivery record for a limited period under its own retention policy.
When you contribute
- Questions, answers, job notes and interview reports you write, with the badge shown at the time. Shown to other members under a handle that is different in every room and can't be linked to your account by other members.
- Employer ratings, stored against your account so you can rate only your own employer, once. Only aggregated ratings from 10 or more members are shown.
- Pay entries are stored without any link to your account: we can't tell which entry is yours. Each entry keeps field, stage, region, employer (to stop one employer dominating a figure), the package details you enter and the day it was added. A receipt code that only your phone holds lets you withdraw it.
- Votes, quick checks, reports you make and members you block.
What we don't collect
No names (unless you type one into a post, which our rules forbid), phone numbers, ID numbers, contacts, photos, precise location or advertising identifiers. Cohort has no ads and doesn't track you across other apps or websites. Usage statistics stay on your phone; they aren't sent to us.
Technical information
Our hosting providers process your IP address and basic request details to deliver the service and protect it from abuse, and keep them in short-lived logs.
Lawful basis
- Providing the service you asked for, including verification (POPIA section 11(1)(b)).
- Your consent, which you give when you verify and when you choose to contribute, and which you can withdraw by deleting content or your account (section 11(1)(a)).
- Our legitimate interest, and that of members, in a safe, trustworthy service: preventing duplicate accounts, abuse and unlawful content (section 11(1)(f)).
- Complying with the law (section 11(1)(c)).
Special personal information
We don't ask for special personal information, such as health, religion, race, union membership or criminal behaviour, or information about children. Please don't include it in posts. We remove posts that reveal it about other people.
Automated checks
An automatic check holds posts containing contact details, ID numbers, links or serious allegations until a person reviews them. No decision with legal or similarly significant effects on you is made by automated means alone.
Who processes it for us
- Supabase: database, sign-in and storage, hosted in the European Union (Frankfurt, Germany).
- Resend: delivery of verification emails.
- Cloudflare: hosting for cohortfounding.com and the job feed.
- Apple: distribution of the app through the App Store, under Apple's own privacy policy.
These operators process information only on our instructions and under agreements that require them to keep it secure. Because our database is hosted outside South Africa, we transfer personal information across borders only to recipients bound by law or agreements that give it protection comparable to POPIA (section 72).
Who can see what
- Other members see your room handle, your badge and what you post. Never your email, account identifier or employer name (only its type, and only if you choose that badge detail).
- Moderators see posts and reports, not your email or account details.
- Employers and recruiters never get personal information from Cohort.
- Authorities. We disclose information only where the law requires it, for example under a court order. Because we don't hold names or email addresses, what we can disclose is limited.
We don't sell personal information or use it for direct marketing.
How long we keep it
- Your account and contributions: until you delete them or your account.
- Verification codes: 10 minutes. Rate-limit records: 2 days.
- Records of reports and moderation decisions: up to 3 years, to handle complaints and legal claims.
- Pay entries: while they contribute to published figures, and in any case no longer than 5 years. They aren't linked to you.
- Backups expire on our provider's schedule, normally within weeks.
Security
Data is encrypted in transit and at rest by our providers. The app can reach the database only through functions that check who is asking; no one can read tables directly. Secret keys are kept in an encrypted vault. Handles are derived with a secret key so they can't be linked across rooms. If a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.
Your rights
- Access: download your data in the app (You, Data and account).
- Deletion: delete your account in the app. This deletes your posts, answers, notes, reports, ratings and blocks, and your sign-in.
- Correction and objection: change your profile in the app, or email us.
- Complaints: email us first and we will respond within 30 days. You may also complain to the Information Regulator: POPIAComplaints@inforegulator.org.za, inforegulator.org.za.
Children
Cohort is for people aged 18 and over. We don't knowingly process information about children.
Changes
We will update the effective date when this policy changes, and tell you in the app about material changes.
Contact and Information Officer
Privacy questions and requests: highveldreefai@gmail.com