Privacy Policy
This Privacy Policy explains how Tiko Learn ("Tiko", "we", "us") collects, uses, shares and protects information when you use our training platform, mobiliser application or staff portal.
1 Who we are
Tiko Learn is a training platform that supports community mobilisers and partner organisations working on sexual and gender-based violence (SGBV) prevention and response.
For questions about this policy, or to exercise your privacy rights, contact us at privacy@tiko.org.
2 Information we collect
Account information
- Your name, chosen username, or email address
- Your country and region (for scoping training content)
- Your organisation or CBO (if you are a staff user)
- A hashed password (we never store plain passwords)
- Preferred language and profile avatar
- For mobilisers: how long you have been a Tiko mobilizer (one choice, such as "Under 3 months"). We use it only to understand and support different groups of mobilisers, and it is shown to others only as grouped totals
Learning activity
- Modules started, in progress, and completed
- Your answers to decisions, quizzes and assessments
- Time spent per module and session metadata
- Points earned, certificates issued, streaks
- Your tick-boxes when you say you set up the Tiko app on your own phone, and whether your master trainer or CBO manager confirmed it. We do not collect your phone number, screenshots or anything from the Tiko app for this
- Whether you opened or reviewed a "what's new" update about the training
Technical information
- Device type (mobile, tablet, desktop) and browser
- Approximate IP address (used for security and rate limiting)
- Application version and session identifiers
We do not collect: health records, biometric data, precise location, contacts, or the contents of your device.
3 Google Sign-In — what we access
If you choose to sign in to the Staff Portal with Google, we use Google Identity Services. This grants us limited access to information from your Google Account.
- Your email address — used to match you to a Tiko staff account
- Your display name — shown in the staff interface
- Your profile picture URL — optional, used as your avatar
- Google account ID (sub) — stored to recognise repeat sign-ins
- Hosted domain (hd) — verified to confirm you are in an authorised workspace
What we do NOT do with Google data:
- We do not access your Gmail, Drive, Calendar or any other Google service
- We do not sell or share Google user data with third parties
- We do not use Google user data for advertising or profiling
- We do not transfer Google user data to data brokers or unrelated parties
4 How we use your information
We use the information we collect to:
- Deliver and personalise your training
- Track your progress, points, and certificates
- Authenticate you and prevent unauthorised access
- Detect fraudulent or abusive behaviour
- Provide aggregated, anonymised insights to your organisation or funder
- Improve the training content and platform
- Communicate essential service notifications
5 How we share information
We do not sell your personal information. We may share information only in these limited cases:
- With your organisation — staff and supervisors can see the training progress of mobilisers within their scope
- With service providers — infrastructure and hosting providers who process data on our instructions and under confidentiality agreements
- When required by law — to comply with a valid legal request, or to protect safety
- Aggregated and anonymised — programme-level reporting that cannot identify any individual
6 Data storage and security
Your data is stored on secured servers. Access is restricted to authorised personnel who need it to operate the service.
- Passwords are hashed using industry-standard algorithms
- Authentication tokens are signed and expire automatically
- Rate limiting protects against brute-force attacks
- Transport is encrypted in transit (HTTPS)
No system is completely secure. If we become aware of a breach affecting your personal data, we will notify affected users and relevant authorities as required by applicable law.
7 Data retention
We retain account information and learning records while your account is active and for a reasonable period afterwards for training verification and reporting.
You may request deletion of your account and associated personal data at any time (see Section 8).
8 Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Request deletion of your account and data
- Withdraw consent for optional processing
- Object to or restrict certain processing
- Lodge a complaint with a data protection authority
To exercise any of these rights, email privacy@tiko.org. We will respond within 30 days.
9 Children's privacy
Tiko Learn is intended for adult training participants and professional staff. We do not knowingly collect personal information from children under 18 through this platform.
If you believe a child has provided us with personal information, contact us at privacy@tiko.org and we will delete it.
10 International transfers
Your information may be processed in countries other than your own. Where this happens, we take appropriate safeguards to ensure your information receives an adequate level of protection.
11 Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Material changes will be communicated through the platform.
12 Contact us
Tiko Learn
Email: privacy@tiko.org
Website: tiko.org