Privacy Policy

Sukuu Report is operated by NayyCodes Solutions, Teshie — Agblezaa M-78, Accra, Ghana, Ghana. You can reach us at nicholasayim81@gmail.com.

Sukuu Report is a service schools use to record marks and produce report cards. Most of the information in it is about children, so the rest of this page is deliberately specific rather than general.

Which of us is responsible for a given piece of information depends on whose information it is, and the distinction matters:

• Student information belongs to the school.The school decides what to record, how long to keep it and who may see it. The school is the data controller; we act on its instructions as a data processor. We do not decide what happens to a child’s record, and we do not use it for anything of our own.
• Account information belongs to us to manage.For the person who signs up and runs the school’s account, we are the controller — we decide to hold their email address so they can sign in and be billed.

About the school

Name, short code, contact email, location, motto, crest, head teacher’s name, the grading scale and the class/exam weighting, and the report card design chosen for each level.

About the administrator

Name, email address, phone number, and how they sign in — either a password held by our authentication provider, or a Google or GitHub account. We never see or store a password in readable form.

About teachers

Name, staff ID, email address and phone number where the school supplies them, and a PIN. The PIN itself is never stored — only a scrypt hash of it, which cannot be reversed. We also record when a teacher last signed in and how many failed attempts they have made, so accounts can be locked after repeated wrong PINs.

About students

Name, index number, class, gender, and either a date of birth or an age recorded at admission. Where the school provides them: a guardian’s name, phone number and email address. Then the academic record itself — marks by subject and term, attendance, conduct, and teachers’ and the head teacher’s written remarks.

About changes to marks

Every change to a mark, every submission, review and publication is written to an audit log with who did it and when. This exists so a school can answer a parent who disputes a grade. It is kept for as long as the school’s account is active.

About payments

Subscription payments are processed by Paystack. Card details are entered on Paystack’s systems and never reach ours. We store the amount, the reference, the status and the plan.

When an administrator chooses to sign in with Google, we receive from that Google account: the email address, the name on the account, and the profile picture where one is set. We use these only to create and identify the administrator’s account, and to address them by name in the product.

We request no other permissions. We do not access Gmail, Google Drive, Google Contacts, Google Calendar or any other Google service, and we hold no Google credentials of any kind. We do not sell this information, we do not transfer it to anyone except the infrastructure providers listed below who host it on our behalf, and we do not use it for advertising or to train any model. The same applies to GitHub.

An administrator can disconnect Sukuu Report at any time from their Google Account permissions page, and can ask us to delete their account entirely using the address at the end of this page.

Access is narrower than most people assume, by design:

• A teacher sees only the classes and subjects the school has assigned to them, for the current academic year, and only their own marks until they are published.
• A head teacher or administrator sees everything belonging to their own school, and nothing belonging to any other school.
• Nobody outside the schoolsees anything until the head teacher publishes a class’s results. Before that moment there is no way to reach them.
• After publication, anyone holding a student’s index number can view that student’s published report cards. That is how a student or parent checks results, and it means an index number should be treated as private.
• If a school withholds a published result, it stops being reachable immediately — including through any link already shared.

A student may generate a link to share one report card. The link expires after 30 days, and the report behind it is rebuilt from the live record each time it is opened rather than frozen at the moment it was shared.

We use a small number of providers to run the service. They act on our instructions and may not use the information for their own purposes:

• Supabase — the database and authentication system where everything above is stored.
• Vercel — hosting for the application itself.
• Paystack — subscription payments.
• Resend — one-time codes and notification emails.
• Google and GitHub — only where an administrator chooses to sign in with them.

Some of these store data outside Ghana. Where that happens, it is done under the provider’s contractual protections and in line with the Data Protection Act, 2012 (Act 843).

• Everything travels over an encrypted connection.
• Teacher PINs are hashed with scrypt, which is deliberately slow, so a stolen database still does not reveal them.
• Session tokens are stored only as hashes; the value itself lives in the browser and nowhere else.
• A school’s records are scoped to that school at the database level, not merely hidden in the interface.
• Changes to marks are recorded in an append-only audit log.

No system is perfectly secure. If a breach affects a school’s information we will notify the school without undue delay, together with the Data Protection Commission where the law requires it.

Student records are kept for as long as the school’s account is active, because a report card from three years ago is precisely the thing a school needs later. If a school closes its account, we keep its data for 90 days so it can be recovered or exported, and then delete it.

Records of payments are kept for as long as Ghanaian tax and accounting law requires.

Under the Data Protection Act, 2012 (Act 843) you may ask to see what we hold about you, have it corrected, have it deleted, or object to how it is used.

If you are a parent or student:ask the school first. The school controls its own records and can correct a name, a mark or a guardian’s contact details directly. If the school cannot help, write to us at nicholasayim81@gmail.com and we will assist it.

If you are a school administrator: write to us at nicholasayim81@gmail.com. We will respond within 30 days.

You may also complain to the Data Protection Commission of Ghana at dataprotection.org.gh.

Sukuu Report is not offered to children directly. Accounts are held by schools and their staff. A student uses the service only to look up their own published results with an index number their school issued, and we ask them for nothing while they do it — no account, no email address, no sign-in.

If we change anything material, we will update the date at the top and tell schools by email before it takes effect.

NayyCodes Solutions
Teshie — Agblezaa M-78, Accra, Ghana
nicholasayim81@gmail.com
+233 55 632 7844 / +233 20 871 0418
Monday to Saturday