Credify

Privacy Policy

Last updated 27 October 2026

This policy explains what personal information Credify collects when you use the Credify mobile app, this website (credifysa.com) and the CREDIFY3 System Thinking Challenge, why we collect it, who can see it, and the choices you have. Credify is the responsible party for your personal information under South Africa’s Protection of Personal Information Act, 2013 (POPIA).

The short version
  • We collect what you give us to run your account, profile and posts, plus basic server logs.
  • Your profile and posts are public. Your messages are private between you and the people you message.
  • We don’t sell your information, show adverts or use third-party analytics or tracking.
  • You can delete your account at any time, in the app or at credifysa.com/delete-account.

1. Information we collect

Information you give us

  • Account: your name, username, email address and password. Your password is stored only as a one-way encrypted hash; nobody at Credify can see it.
  • Profile (optional): profile and cover photos, headline, bio, location, tagline, website, skills, experience, projects, and up to three photos and three PDF documents you choose to add.
  • Posts and activity: videos, images and captions you post, drafts, comments and @mentions, the skill credits and likes you give, posts you save, and the people you follow.
  • Messages: direct messages you send and receive. When you delete a message, its text is erased from our systems.
  • Verification: if you apply for a verified badge, the type of proof, the institution or company, and the document you upload.
  • CREDIFY3 applications: your full name, email address, phone number, location, occupation, institution, field and year of study, and your answers to the motivation questions.
  • Jobs: jobs you post and applications you make, and their status.
  • Paid plans: the plan, billing period, amount and a payment reference. We never receive or store your card number.
  • Reports, blocks and support: reports you file, accounts you block, and emails you send us.

Information collected automatically

  • Server logs: your IP address, the date and time, and which part of the service was requested. We use these to keep Credify secure, prevent abuse (for example, limiting repeated sign-in attempts) and fix problems.
  • On your device: the app stores your sign-in token and your app settings on your phone. The website stores your sign-in session in your browser’s local storage. We don’t use advertising cookies.

Device permissions

The app asks for the camera and microphone only so you can record video posts, and for your photos and files only when you choose a picture or PDF to upload. You can turn these permissions off in your phone’s settings at any time.

What we don’t collect

We don’t collect your precise location, your contacts, or your device’s advertising ID, and the app contains no third-party advertising, analytics or tracking tools.

2. How we use your information

  • To create and run your account and show your profile, posts, comments and messages.
  • To calculate your professional reputation from the skill credits other people give you.
  • To suggest people and content on Discover and to send you in-app notifications.
  • To send emails you need: password-reset links, CREDIFY3 application confirmations and results, and replies to support requests.
  • To run, judge and award the CREDIFY3 challenge.
  • To review verification requests, reports and job applications.
  • To keep Credify safe, enforce our Terms of Use, and meet legal obligations.

We process your information because it is needed to provide the service you signed up for, because you have agreed to it (for example, optional profile details and device permissions), or because we have a legitimate interest in keeping Credify secure, as POPIA allows. We don’t use your information for automated decisions that have legal or similarly significant effects on you.

3. Who can see your information

  • Everyone: your name, username, profile photo, profile details, profile photos and documents, posts, comments, reputation and follower counts are public. They can be seen by other members, by guests browsing without an account, and by anyone you share a profile or post link with. Only add to your profile what you are happy for others to see.
  • People you message: messages are visible only to the people in the conversation. We don’t read them unless we need to investigate a report of abuse or the law requires it.
  • Recruiters: when you apply for a job on Credify, the recruiter who posted it sees your profile and your application.
  • The Credify team: authorised administrators review verification documents, reports and CREDIFY3 applications. Challenge applications are seen only by the team running the challenge.
  • Service providers: companies that run parts of Credify for us and may only use your information to do so:
    • MongoDB Atlas — database hosting
    • Render — application servers and storage of uploaded files
    • Vercel — website hosting
    • Google (Gmail) — sending our emails
  • When the law requires it: we may disclose information to comply with a legal obligation or a valid request from a court or authority, or to protect someone’s safety.

We do not sell or rent your personal information to anyone.

4. Where your information is stored

Our service providers store information in data centres outside South Africa. We only use providers that protect personal information to a standard comparable to POPIA, as section 72 of POPIA requires.

5. How long we keep it

  • Your account information and content: for as long as your account exists.
  • Deleted messages: the text is erased immediately.
  • Password-reset links: they expire after 30 minutes and work only once.
  • CREDIFY3 applications: while the challenge and its follow-up are running, then deleted when no longer needed or when you delete your account.
  • Server logs: kept by our hosting provider for a limited period, then deleted.
  • When you delete your account, your information is deleted straight away. Backup copies held by our hosting providers are removed on their normal cycle, within 30 days. Records of paid plans are kept without your name or email for our financial records.

6. Your rights and choices

Under POPIA you have the right to:

  • ask what personal information we hold about you and get a copy;
  • correct or update it — most of it you can change yourself under Edit profile;
  • have it deleted;
  • object to how we process it, or withdraw consent you gave;
  • complain to the Information Regulator of South Africa (inforeg.org.za).

To use any of these rights, email credifysystems3@gmail.com from the email address on your account. We will reply within 30 days. You can also block or report people, delete your messages, and control permissions in your phone’s settings.

7. Deleting your account

You can permanently delete your account in the app under Profile → Settings → Delete account, or on the web at credifysa.com/delete-account. That page explains exactly what is deleted and what is kept.

8. Security

We use encrypted connections (HTTPS) for all traffic, store passwords and password-reset tokens only as one-way hashes, check every upload’s type and size, and limit administrator access. No system is perfectly secure; if a breach affects your information, we will tell you and the Information Regulator as POPIA requires.

9. Children

Credify is for people aged 18 and over. We don’t knowingly collect information from anyone younger. If you believe a child has given us personal information, email credifysystems3@gmail.com and we will delete it. See our Child Safety Standards.

10. Changes to this policy

If we change this policy, we will update the date at the top of this page. If the changes are significant, we will also tell you in the app or by email before they take effect.

11. Contact us

Questions about this policy or your information: credifysystems3@gmail.com.