What we collect, and why

Last updated 26 September 2026.

Who we are

Skull Edu is a tuition platform operating in the Maldives. It is run by Skull Solutions Pvt Ltd, a company registered in the Maldives, which is the data controller responsible for everything described here. To contact us about anything on this page, use the details on our contact page.

What we collect

When you create an account

• Your name, as you choose to display it.
• A username and an email address.
• A password, which we store only as a one-way hash. We cannot read it.

Your email address is confirmed before the account is created, so an account only exists for an address somebody can actually read.

If you fill in a profile

• A photograph, a short biography, a location and any links you add.
• Whether you want the profile to be public. It is not public unless you say so.

If you apply to teach

• The subjects you want to teach and what you say about your experience.
• A document proving a qualification. This is private: it is never shown on the site, and only administrators can open it.

If you take lessons or buy a course

• What you asked for, and which teacher.
• The receipt you upload for a bank transfer. This is private and is only opened by an administrator checking the payment.

We do not take card payments and we never see your card details. Payment is a bank transfer you make yourself.

If you write or message

• Articles you write, and whether you published them.
• Private messages between you and administrators or teachers.

Automatically

• A session cookie, so you stay signed in, and a CSRF cookie that protects forms from being submitted by another site. We set no advertising or tracking cookies.
• Your IP address, used to rate-limit sign-in attempts and public forms and recorded in our audit log against significant actions. This is how we stop passwords being guessed at machine speed.
• An audit record of actions that change something, such as signing in, editing a profile or approving an application. We keep this so that if an account is disputed there is a record of what happened.

Who we share it with

We do not sell your data. We do not share it for advertising. We use:

• Amazon Web Services: hosting and backups, in the United States.
• Cloudflare: serving the site and protecting it from attack.
• Amazon SES: sending the emails described above.
• Google Meet: where lessons happen, under Google's own terms.
• WhatsApp: where we talk to you, if you contact us that way.

How long we keep it

• Your account and profile: until you delete the account.
• An unconfirmed registration: about three days, then it is deleted and the address is free again.
• Database backups: up to 90 days.
• Records of payments and lessons: kept after an account is deleted, with the account detached from them, because they are financial records.

What you can do

• See it. Download everything we hold about you as a file.
• Change it. Your profile, your email address and your password are all editable from your profile.
• Delete it. Delete your account. This removes your profile and anything you published. Records of payments and lessons are kept but detached from you.
• Ask us. If you want something we have not listed, write to us.

Children

Students on this platform may be under 18. If you are a parent or guardian and want to see, correct or delete what we hold about your child, contact us and we will do it.

Security

The site is served over HTTPS only. Passwords are hashed. Private documents are never served directly and are only reachable through a page that checks who is asking. Backups are encrypted. Nobody but the people running the platform has access to the database.

No system is perfect. If you find a security problem, please tell us before telling anybody else, and we will fix it.

Changes

If this notice changes in a way that matters, we will say so on the site rather than quietly editing the page.