Privacy policy

This policy says what LPORT stores about you, why, who else handles it, how long it is kept, and how to get rid of it. Last updated October 2026.

Who is responsible for your data

LPORT is an independent project run by students, from Morocco, and is responsible for the personal data described here (the "responsable du traitement" under Moroccan Law 09-08). LPORT is independent of Al Akhawayn University and is not run by the university. Contact: privacy@lport.ma.

What LPORT stores, and why

• Your account: username, password (hashed with bcrypt, never readable), profile photo and bio if you add them, and the date you joined. To identify you, let you sign in, and show your profile to others.
• Your university email address: confirmed with a code when you sign up, so that only members of the university can join, and used to send you a password reset link if you ask for one. It is not shown to other users, and never used for marketing.
• What you post and send: posts, comments, direct messages, confession submissions, votes, bookmarks and uploaded files. To deliver them to the people they are meant for and show them in the app.
• Who you follow and block, and which group chats you are in. To build your feed and friends list, and to enforce blocks everywhere.
• Which posts you have opened. So the feed can tell new posts from ones you have already seen.
• Notifications sent to you, so you can see them again in the app.
• A push token if you allow notifications, so the server can reach your device. Signing out or removing the app deletes it.
• LWALLET card taps: when you open someone's card, their app shows that your account opened it, and when; you see the same list for your own card. Repeat taps within an hour count once. This is the feature itself: showing a card owner who opened it.
• Course watches, only if you use Add/Drop, so the app can tell you when a seat opens.
• Reports and moderation records: what was reported, by whom, and what moderators did. To keep the community rules enforced, and to handle appeals and repeat abuse.
• Server logs: request paths, timings and your account id, to diagnose faults. Sign-in lines also record your IP address, to detect attacks on accounts.

What LPORT does not do

• No advertising, no ad identifiers, no tracking across other apps or websites.
• No analytics profile of you, and nothing sold or rented to anyone, ever.
• No location collection. The app never asks for your position.
• No reading of your contacts, your calendar, or files you have not picked yourself.

Anonymous confessions

A released confession is shown without your name. The moderators who review confessions cannot see who sent them, and no screen in the app shows it.

The server does keep the link between a submission and the account that sent it. Only the operator, with direct access to the database, can look it up, and only when reasonably necessary to investigate a threat or serious abuse, to enforce the community rules, to protect someone's safety, or to answer a lawful request. In those cases the information may be passed to the university or to the competent authorities, where that is necessary or required by law.

Released confessions are public: they appear in the app, and may be shared on social media accounts run by LPORT or a partner page, such as on Instagram.

Who else sees your data

• Other people in the app see what you share with them: your posts, comments, messages you send, and your profile, within the privacy settings you choose.
• Moderators see reported content, the reports themselves (including which account filed them), and a list of accounts with their username, join date and moderation status. They do not see email addresses or passwords. Moderation actions are logged.
• If the law requires it, data may be disclosed to the competent authorities. Serious cases, such as threats of violence, may be passed to the university.

LPORT's server, database, uploaded files and backups run on hardware the operator manages in Morocco. These outside services handle some data on LPORT's behalf, and only for the purpose given:

• Cloudflare: all traffic between the app and the server passes through Cloudflare, which protects the server and hides its address. It handles your IP address and requests in transit; it does not keep your content. It also forwards email sent to lport.ma addresses.
• Vercel: hosts the lport.ma website, and serves shared post links and these policy pages through it.
• Mailtrap: sends LPORT's emails, such as sign-up codes and password resets. It receives your email address and the message.
• Expo, with Google Firebase Cloud Messaging on Android and Apple Push Notification service on iPhone: deliver notifications to your device. They receive your push token and the notification text, unless you turn previews off in settings.
• Sentry (servers in the European Union): receives crash and error reports, so faults can be found and fixed. A report contains your account id, your device model and system version, the app version and the error. It never contains message content, passwords, tokens or your IP address. Sentry keeps reports for at most 90 days.
• YouCan Pay, only if you pay for Add/Drop on the website: processes the card payment. Card numbers go to them directly; LPORT never sees them.

Nobody else receives your data.

How long things are kept

• Your account, profile, posts, comments, messages, files, follows and blocks: until you delete them or your account.
• Which posts you have opened, your notifications, and LWALLET tap history: 90 days.
• Confession submissions: rejected ones, with their link to your account, are deleted 90 days after review. For a released confession, the link is kept while it stays published, and is deleted with your account.
• Moderation records and closed reports: 12 months.
• Server logs, including the IP addresses in sign-in lines: 30 days.
• Sign-up codes: deleted within a day. Password reset links: expire after one hour and work once.
• Encrypted database backups: 30 days, then deleted.

Your rights

Under Moroccan Law 09-08 you can ask what personal data LPORT holds about you and get a copy, have inaccurate data corrected, object to a use of your data for legitimate reasons, and have your data deleted. Much of this you can do yourself in the app (edit your profile, delete posts, delete your account). For anything else, write to privacy@lport.ma from your account's email address, or say which account it is; you will get an answer within 30 days. If you are not satisfied, you can contact the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel), www.cndp.ma.

Deleting your account

Settings, then Recovery email, then Delete account. It asks for your password and your username typed back, and then it removes, straight away and for good:

• your account and profile;
• your posts, and every comment and vote on them;
• your comments, and the replies underneath them;
• your direct messages and your one-to-one conversations;
• your uploads, votes, follows, blocks, bookmarks, course watches, LWALLET taps and notifications;
• your confession submissions, and the link between any released confession and your account.

Group chats carry on for the people still in them. A released confession stays published, with no connection to you left anywhere. Records of moderation actions about your account are kept for up to 12 months, for appeals and repeat abuse. Backups and server logs age out within 30 days, as above. There is no undo and no grace period.

This deletes LPORT's copies. It cannot delete copies or screenshots other people have already saved or shared outside LPORT, or confessions already published on social media; ask at the address below and those LPORT controls are taken down.

Keeping it safe

Traffic runs over HTTPS. Passwords are hashed and never stored in a readable form. Backups are encrypted. Documents added to the shared library are scanned for malware before anyone else can open them. Recovery links are stored as hashes, expire, and work once. A password reset signs out every device.

Age

LPORT is for university students aged 18 and over, and is not meant for anyone younger. An account found to belong to someone under 18 is closed and its data deleted.

Changes

If this policy changes in a way that affects what is collected or who receives it, the app will say so before the change takes effect.

Contact

Questions, or a request about your data: privacy@lport.ma.