Privacy Policy

Effective [EFFECTIVE DATE] · Last updated September 17, 2026

Draft for attorney review. This template is written for ReDorm's stack and data model. Replace every bracketed item and have counsel review it before publishing. Delete this box when you go live.

ReDorm is a marketplace where verified college students buy and sell items from each other on campus. This policy explains what we collect, why, and what you can do about it. We try to collect as little as we can.

Who we are

ReDorm is operated by [REDORM LEGAL ENTITY NAME, e.g. ReDorm LLC], a [STATE] limited liability company. Mailing address: [REGISTERED AGENT OR BUSINESS ADDRESS — not a dorm room]. Email: privacy@[YOURDOMAIN].

What we collect

Data we collect and why
Data	Why we need it	Source
School email address	To verify you're a student and place you in your campus feed	You
Display name and username	So other students know who they're dealing with	You
School (derived from your email domain)	To show you listings at your campus only	Derived
Listings you post (photos, title, price, description, pickup spot)	To display your items to other students	You
Messages you send and receive on ReDorm	To deliver them, and to review them if a user is reported	You
Ratings you give and receive	To show a seller's track record	You / other users
Basic usage data (pages viewed, features used, approximate device type)	To understand what works and fix what doesn't	Automatic
Log data (IP address, browser, timestamps)	Security, abuse prevention, and keeping the service running	Automatic

What we don't collect

Your phone number, date of birth, student ID number, or government ID
Your precise location. Pickup spots are campus landmarks you choose, never GPS
Your dorm or room number. We ask you not to put it in listings or messages
Location data embedded in photos. We strip EXIF metadata when you upload
Payment information. [While payments happen off-platform, we never see them. UPDATE THIS SECTION IF YOU ADD STRIPE.]

How we use it

Run the marketplace: show listings, deliver messages, verify students
Keep people safe: investigate reports, enforce our Terms, prevent fraud and abuse
Send you service messages, like a new-message notification or a security alert
Send you occasional product updates, only if you opted in, and every one has an unsubscribe link
Understand how ReDorm is used, in aggregate, to improve it
Comply with law and respond to valid legal requests

We do not sell your personal information, and we do not share it with advertisers.

Who we share it with

Only service providers that help us run ReDorm, and only what they need:

Supabase — database, authentication, and image storage
Vercel — hosting
Resend — sending email
PostHog — product analytics, configured without cookies and with IP addresses anonymized
[Stripe — payments, if and when you enable in-app checkout]

Other students see your username, display name, listings, ratings, and the messages you send them. We may also disclose information if required by law, to enforce our Terms, or to protect the safety of a user or the public. If ReDorm is ever acquired or merges with another company, your information may transfer as part of that deal; we'll tell you before that happens.

How long we keep it

Your account and listings: until you delete them or your account
Messages: 12 months after the related listing is closed, then deleted
Log data: 90 days
Reports and moderation records: up to 2 years, so repeat problems can be identified

If you delete your account we remove your profile, listings, and messages within 30 days, except where we must keep a record for legal, safety, or dispute reasons.

Your choices and rights

Access or download a copy of your data by emailing us
Correct your profile at any time in settings
Delete your account from settings or by emailing us
Unsubscribe from product emails with the link in any message

Email privacy@[YOURDOMAIN]. We'll respond within 30 days and may ask you to confirm your identity from your school email. We won't treat you differently for exercising these rights.

California residents

California law gives you the right to know what personal information we collect, to request its deletion, and to opt out of any sale or sharing of it. We don't sell or share personal information for advertising. To make a request, use the contact above. Under California's "Shine the Light" law you may also ask whether we've disclosed personal information to third parties for their direct marketing; we haven't.

Other states

If you live in a state with its own privacy law, you may have similar rights to those above. Contact us and we'll honor requests that apply.

Security

Data is encrypted in transit and at rest with our providers. Access to your conversations is limited by database rules so only the people in a conversation can read it, plus our team when reviewing a report. No system is perfectly secure; if we learn of a breach affecting your data, we'll notify you as required by law, including Pennsylvania's breach notification statute.

Age

ReDorm is for people 18 and older. We don't knowingly collect information from anyone under 18. If you believe a minor has an account, email us and we'll remove it.

Where your data lives

ReDorm is operated in the United States and our providers store data in the U.S. If you use ReDorm from elsewhere, your data will be processed here.

Changes

If we change this policy in a meaningful way, we'll email you or post a notice in the app before the change takes effect. The date at the top always shows the current version.

Contact

[REDORM LEGAL ENTITY NAME]
[MAILING ADDRESS]
privacy@[YOURDOMAIN]