Security Policy

1. Account security

• Accounts are protected by email and password sign-in, with passwords stored in hashed form — nobody, including our team, can read your password.
• New accounts confirm their email with a six-digit code that expires after ten minutes.
• Password resets are only possible through a link and code sent to your registered email address.
• You can also sign in with Google, Microsoft, Facebook or Apple if you prefer not to use a password.
• Sessions expire, and signing out clears the session on that device.

2. What we protect

This covers your account details, your housing applications, your PurplePlug Pass, and the listings, resources, jobs and rides linked to your account. Your housing applications are private to you, our admins and the landlord you applied to; public listings are, by design, visible to other students.

3. Access control

• Everyone signs in with their own account — there are no shared logins.
• Housing applications can only be created by the applicant and read by that applicant, the landlord concerned and platform admins.
• Listings can be edited or deleted by the student or reseller who created them, and by platform admins.
• Administrative access is limited to the platform owner and is reviewed regularly.

4. How the platform is protected

• Data is encrypted in transit, and stored on infrastructure with encryption at rest.
• Automated backups and monitoring run in the background so that problems are spotted quickly.
• Access to the app's database and settings is restricted to authorised accounts.
• We apply security updates to the platform as they are released, and review the app for common web vulnerabilities.

5. Your responsibilities

• Use a strong, unique password and never share it.
• Do not reuse your NWU password on PurplePlug or anywhere else.
• Be careful on shared computers and sign out when you are done.
• Keep your listing and contact details accurate so other students know who they are dealing with.
• Report anything suspicious — a fake store, a stolen photo, a landlord asking for a deposit before a viewing — as soon as you notice it.

6. Scams and fraud

PurplePlug never asks for your banking details, OTP or PIN. Anyone who does — in a listing, in a WhatsApp message or by email — is not us. Never pay a deposit before viewing a room, never send money for a hustle you have not received, and confirm a lift and its cost directly with the driver. Where money has been taken under false pretences, report it to the South African Police Service and to us.

7. Reporting a security concern

If you believe an account has been compromised, a listing is fraudulent, or you have found a technical vulnerability, contact us through the app's contact channel with as much detail as you can. Please do not access other people's accounts or data while testing — we will work with you on a responsible report.

We investigate reported vulnerabilities, fix confirmed issues as a priority, and will tell affected users if their data was ever put at risk.

8. Review

This policy is reviewed at least twice a year, and after any security incident, so it reflects what we actually do. Questions about our security practice can be sent through the app's contact channel.