Privacy Policy for GalaGala Exames
Welcome to GalaGala Exames("we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a transparent understanding of how your personal information is collected, used, and shared when you use our mobile and web application (the "App").
Please read this Privacy Policy carefully before using GalaGala Exames. By accessing or using the App, you agree to the collection and use of your information in accordance with this policy.
1Age Requirement & Eligibility
GalaGala Exames is designed for pre-university students, university students, and adult learners aged 16 years and older. The App is not directed at children under the age of 16. If you are between 16 and 17 years old, you may only use GalaGala Exames under the supervision and explicit consent of a parent or legal guardian, who is responsible for reviewing this Privacy Policy on the minor's behalf. We do not knowingly collect personal data from children under 16 without appropriate parental consent, and we will delete such data if we become aware it was collected in error.
Prize payouts to minors: Because mobile money accounts and financial transactions generally require legal capacity, users aged 16–17 who win a prize may be asked to provide a payout method registered to a parent or legal guardian, or to confirm guardian approval before a payout is processed.
2Information We Collect
We collect several types of information to provide, improve, and secure our services:
A. Account & Profile Information
When you sign up and create a profile on GalaGala Exames, we collect:
- Identity Information: Your display name (username), email address, profile picture (avatar URL), and unique user identifier.
- Authentication Identifiers: Social authentication identifiers (such as your Google Account ID) when signing in via Google Sign-In.
B. Financial & Prize Payout Data
- Subscription Records: History of subscription plan selections, payment request timestamps, and chosen payment methods.
- Prize Payout Details: If you participate in gamification features or win daily reward prizes, we collect your preferred Prize Payout Method and Prize Payout Phone Number (e.g. mobile money services such as M-Pesa or e-Mola) to fulfill prize transfers.
We do not store full mobile money PINs, passwords, or account credentials — only the phone number/method needed to route a payment.
C. User-Generated Content & Study Materials
- Uploaded Materials: Study documents (PDFs, images, docx), companion solution/answer keys, material titles, descriptions, academic years, terms, subjects, and school names.
- Community Engagement: Ratings, reviews, comments, contribution points, and problem reports submitted regarding study materials.
- Third-party personal data in uploads:Uploaded documents (e.g. scanned exams) may incidentally contain another person's handwritten name or other identifying marks. If you believe your personal information appears in content you did not upload yourself, you can request its removal — see Section 9.
D. AI Analysis Data
When you upload a study document for automated categorization, images of the document (such as the cover or first page) are processed using artificial intelligence models (Google Gemini API) to extract relevant metadata (school name, subject, exam year, and material type). These images are sent to Google for processing; see Section 4 for how Google may handle this data.
E. Telemetry, Analytics & Session Replay
- Device & Usage Data: Operating system version, app version, screen views, button taps, feature interactions, and lifecycle events.
- Session Replay Recordings: We use analytics software (PostHog) to capture session replays (visual playback of user interactions on screen) to identify technical issues, diagnose software bugs, and optimize user experience. Payment and payout input fields are masked in these recordings and are never visible in replay data.
F. Local Device Storage
The App stores temporary configuration data on your device, including theme settings (light/dark mode), PDF display preferences, cached document files, and onboarding completion flags.
3How We Use Your Information
We use the collected information for the following purposes:
- Core Service Delivery: To operate, maintain, and provide the study material repository, search, upload, and browsing features.
- Account Management & Authentication: To authenticate your identity, maintain user profiles, and manage subscription access.
- AI Metadata Extraction: To automatically process uploaded document cover pages and pre-fill document details for faster contribution.
- Reward & Prize Distribution: To process daily points, leaderboards, and prize transfers to your designated payout phone number.
- App Analytics & Diagnostics: To analyze usage trends, monitor app performance, and review session replays (with payment fields masked) for debugging and UI improvements.
- Communication & Moderation: To respond to user feedback, review reported materials — including third-party personal data complaints — and enforce community content guidelines.
4Third-Party Service Providers (Sub-Processors)
We share information with trusted third-party service providers who assist us in operating our application. These third parties are bound by confidentiality and security obligations:
| Provider | Purpose | Data Handled |
|---|---|---|
| Supabase Inc. | Cloud database, authentication, file storage & backend services | Profile data, authentication tokens, study materials, subscription records, prize payout info |
| Google LLC | Social authentication (Google Sign-In) & AI model processing (Gemini API) | Email, profile name, Google ID token, document images sent for AI metadata extraction. Google's standard Gemini API terms may apply to how submitted content is temporarily processed and retained for abuse monitoring; we do not enable model-training data sharing where an opt-out is available. |
| PostHog Inc. EU Cloud | Product analytics, event tracking & session replay recording | Screen navigation, user IDs, interaction logs, session replay recordings (with payment/payout fields masked) |
| M-Pesa / e-Mola | Subscription payment processing & daily prize payouts via M-Pesa / e-Mola | Transaction IDs, payment methods, payout phone numbers |
*Note: We do not sell your personal data to third parties or data brokers.*
International data storage:Some of the providers above may store or process data outside Mozambique (e.g. PostHog's EU infrastructure, Google's global infrastructure). We select providers with appropriate security and confidentiality safeguards in their terms of service.
5Account Deletion & Data Retention
- •In-App Account Deletion: You can request the deletion of your account at any time directly within the App settings.
- •Web Account Deletion Request: You can view step-by-step instructions or submit a deletion request online at our Account Deletion Request Page.
- •Soft-Deletion Policy: Upon requesting account deletion, your profile enters a soft-deleted status for one (1) calendar year. During this 1-year grace period, your account data remains inactive and invisible to other users, but may be restored upon request if you change your mind.
- •Permanent Deletion: After the 1-year soft-deletion period expires, your personal account details, profile data, and associated payout information are permanently and irreversibly purged from our active database.
- •Public Contributions: Anonymized study materials or public contributions uploaded prior to deletion may remain in the global repository to preserve educational resources for the community, with all personal uploader attribution removed.
6Data Security & Storage
We implement industry-standard technical and organizational security measures to protect your personal data, including HTTPS encryption in transit, secure token exchange, and Row-Level Security (RLS) database policies. However, no electronic transmission or storage method is 100% secure, and we cannot guarantee absolute security.
7Your Rights
Depending on your jurisdiction, you have the right to:
- Access and inspect the personal data we hold about you.
- Request correction or updating of inaccurate personal data.
- Request the deletion or restriction of your personal data.
- Opt out of certain analytics tracking or withdraw consent.
- Request removal of your personal information if it appears in content uploaded by another user (see Section 2C).
Mozambique does not yet have a dedicated data protection authority or comprehensive data protection law in force (a proposed law is pending parliamentary approval as of 2026); today, applicable rules derive primarily from Lei n.º 3/2017 (Electronic Transactions Law) and the Constitution. We honor the rights above as best practice regardless.
To exercise any of these rights, please contact us using the information below.
8Cookies & Web Tracking Technologies
If you access GalaGala Exames via our web application, we and our analytics provider (PostHog) may use cookies or similar local storage technologies to keep you signed in, remember preferences, and record analytics events described in Section 2E. You can control cookies through your browser settings, though disabling them may affect app functionality.
9Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in technology, legal requirements, or our services. Any updates will be posted in the App and on our web page, with an updated "Last Updated" date. Your continued use of GalaGala Exames after changes are posted constitutes acceptance of the revised policy.
10Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy, our data practices, or to report personal information belonging to you that appears in another user's upload, please contact us: