We are a student platform, not an advertising business. We collect what is needed to run the service and nothing we cannot justify.
What we collect
When you create an account: your name, email address, username, and optionally your phone number, department and level. Your password is never stored — only an Argon2id hash of it, which cannot be reversed.
When you use the platform: the content you post (articles, listings, comments, reviews), the items you save, and the courses you enrol in.
Automatically: a hashed version of your IP address, your browser's user-agent string, and which pages you view.
What we deliberately do not store
We do not keep raw IP addresses. Where we need to tell one visitor from another — for rate limiting, or so a page view is not counted twice — we store SHA-256(your IP + a salt that changes daily). That gives us a stable identifier for about 24 hours and then stops being linkable to you at all.
We do not sell personal data. We do not share it with advertisers. We do not run third-party tracking or advertising scripts.
Why we collect it
- To run your account — signing in, verifying your email, keeping you signed in across devices.
- To show your content to other students — a marketplace listing has to display who is selling.
- To keep the platform safe — rate limits, abuse reports, and an audit log of privileged actions.
- To improve what we build — aggregate counts, such as how many people read an article.
Who can see what
Your name, username, avatar and bio are public. So is anything you post publicly.
Your email address and phone number are never shown publicly. Your phone is used to build a WhatsApp link on your own listings, which only appears if you added one.
Posts you make anonymously in the forum hide your name from other students. They are not anonymous to moderators — we retain the author so abuse can be dealt with. Do not treat anonymous posting as a shield for harassment.
How long we keep it
- Account data — until you delete your account.
- Sessions — 30 days, or until you sign out.
- Verification and reset tokens — 24 hours and 30 minutes respectively, then they are dead.
- Page-view records — 90 days, then aggregated and discarded.
- Audit logs — retained for accountability, because their whole purpose is to survive.
Your rights
Under the Nigeria Data Protection Act you can ask us to show you the data we hold about you, correct it, delete it, or export it. Email fuoconnectstv@gmail.com and we will respond within 30 days.
Deleting your account removes your profile and personal data. Content you posted publicly may remain where removing it would break a conversation for others — in that case it is detached from your identity.
Security
Passwords are hashed with Argon2id. Sessions use httpOnly cookies, so a script cannot read them. Refresh tokens are single-use and rotate; if one is ever replayed we revoke the entire session family. All traffic is encrypted in transit.
No system is perfectly secure. If you find a vulnerability, please report it to fuoconnectstv@gmail.com rather than disclosing it publicly, and we will credit you.
Children
The platform is intended for university students and staff. We do not knowingly collect data from anyone under 16.
Changes
If we change this policy in a way that affects you, we will say so on the platform rather than quietly updating the date.