Privacy Policy
[bracketed] placeholder needs a real answer, and the whole page needs review for your actual jurisdiction, entity, and school agreements before this product opens to anyone (ARCHITECTURE.md §21 R4).Last updated: [date].
1. The short version
We collect the minimum needed to verify you're a student, run the matching and call itself, and keep the service safe. We do not show your name, username, or any photo to anyone, ever — there isn't one on file to show. The person you're matched with only ever sees which school you attend.
2. What we collect
| Data | Why | Retention |
|---|---|---|
| Email address | Verify school affiliation; sign in; contact you about your account | Until account deletion (see §5) |
| School (derived from your email domain) | Matching; shown to whoever you're matched with | Until account deletion |
| Match records (who you were matched with and when, not what was said) | Safety investigations; abuse patterns | Indefinitely, but only shown to you for 7 days (§4) |
| Chat messages from a call | Available as evidence if either of you reports the conversation | 7 days, then permanently deleted — unless reported, see §4 |
| Reports and moderation actions | Safety enforcement and appeals | At least 1 year |
| IP address (transient, for abuse rate-limiting) | Prevent spam sign-ups and abuse | Not stored beyond the rate-limit window |
We do not collect or ask for your name, a username, a profile photo, or any other student ever sees a stable identifier for you. This absence is deliberate, not an oversight: it is what keeps the people you talk to from being able to recognize or look you up later.
3. How your email is stored
Your email address is encrypted at rest; we look it up by a separate one-way index rather than storing it in a searchable plain form. A database compromise alone does not hand over a usable list of email addresses.
4. Why some things last only 7 days and others don't
The list of who you talked to is only shown to you, and reportable, for 7 days — long enough to report something that happened over a weekend once you've had time to think about it, short enough that we are not holding a long-running record of who-spoke-to-whom that becomes a bigger privacy risk the longer it exists. Chat transcripts are permanently deleted after 7 days unless either of you reports the conversation first, in which case the transcript from that specific conversation is preserved as evidence for that report. We keep lightweight metadata about matches (that one occurred, when, how long, why it ended) indefinitely, without the content, because that pattern-level record is what makes it possible to catch someone who is repeatedly reported by different people over time.
5. Deleting your account
You can request deletion at any time [via account settings, not yet built / by emailing privacy@[domain]]. When you do, we stop storing your email in readable form and revoke your sessions immediately. We retain match records, reports, and moderation history tied to your (now anonymized) account, because deleting those would also destroy the record of any report you filed against someone else, and any report filed against you. This is a deliberate trade-off between your right to erasure and other users' safety; see §7 if you are covered by GDPR and want more detail on how we reconcile the two.
6. Who sees what
The person you're matched with sees only your school name, for the duration of that one call. Nothing else about you is visible to them — not before, during, or after. We do not sell your data. [List any processors you actually use — hosting provider, email provider, video provider, error-tracking — by name here, since GDPR/CCPA disclosure obligations depend on knowing exactly who they are.]
7. International students and GDPR
If you are in the EU/EEA or UK, you have rights to access, correct, and erase your data, and to object to or restrict some processing. [This section needs an actual GDPR compliance review — the retention trade-off in §5 in particular, the lawful basis for each category of processing in §2, and whether a data protection officer or EU representative is required for your scale, are all real open questions, not filled in here.]
8. Video calls
Video and audio are relayed through a third-party video provider [name it once chosen] to connect your call; we do not record calls ourselves, and no recording is stored by us afterward. We cannot prevent the other participant from recording the call outside our systems — see the Terms of Service.
9. Changes to this policy
We'll post updates here with a new “last updated” date.
10. Contact
Privacy questions: privacy@[domain]. Safety reports: safety@[domain].