Thandomzb/alara-edu

Alara Education: A private, stigma-free web app delivering merit-based Adolescent Sexual and Reproductive Health (ASRHR) education to teens in Africa. Complete lessons, earn real rewards (airtime, data, FNB accounts), and learn without shame. Built for the FNB App Of The Year Hackathon 2025. # Alara Education A private, stigma-free web app delivering merit-based ASRHR education to teens in South Africa... Alara Education Technical Documentation FNB Hackathon 2025 Submission 🔗 Live Application Web App: alara-edu-9b790.web.app Demo Video: youtu.be 📁 Source Code GitHub Repository: github.com 🏗️ System Architecture Alara is a privacy-first, mobile-optimized web application built for adolescents in high-stigma environments across South Africa and the SADC region. Architecture Diagram 1.User (Mobile Browser) ↓ 2.Firebase Hosting (HTTPS, Global CDN) ↓ 3.Firebase Authentication (Phone OTP) ↓ 4.Cloud Firestore (User progress & rewards) Key Design Principles Zero backend server → reduced attack surface Client-side logic only → fast, lightweight, works on 3G No app install required → lowers access barrier Safe Exit button → one-tap redirect to neutral site (e.g., google) ⚙️ Tech Stack Frontend HTML5, CSS3, JavaScript Authentication Firebase Authentication (Phone OTP) Database Cloud Firestore Hosting Firebase Hosting Security HTTPS, Firestore Rules, No Third-Party Scripts Deployment Manual upload via Firebase Console Why this stack? Built for low-literacy, shared-device, data-constrained contexts without compromising safety or impact. 🔒 Security & Privacy (SSDLC) 1. Security Requirements Goal: Protect teens from stigma, exposure, and data misuse Data Minimization: Only store phone (hashed), lesson progress, reward redemptions No PII: Quiz answers, gender, location, or school never collected 2. Threat Modelling (STRIDE) Spoofing: Mitigated by official *.web.app domain Information Disclosure: Prevented by Safe Exit, no analytics, no logs Elevation of Privilege: Firestore rules enforce user isolation 3. Secure Coding Practices No eval(), innerHTML, or dangerous JS patterns All assets served locally Phone input sanitized HTTPS enforced by Firebase Hosting 4. Security Testing Manual privacy testing …