Campus ("we", "us", "our") is a social network exclusively for university students. We are the data controller for the personal information you provide when using Campus. If you have questions about this policy, contact us at WinterA9@cardiff.ac.uk.

When you create an account and use Campus, we collect:

• Your name, university email address, and password (stored as a secure hash)
• Your course, year of study, and university
• Profile picture and bio, if you choose to add them
• Posts, comments, likes, and other content you create
• Connection data — who you link with, which boards you follow
• Usage data — pages visited, actions taken, timestamps
• Technical data — IP address, browser type, device information

We use your information to:

• Provide and operate the Campus platform
• Verify your university affiliation via email OTP
• Personalise your feed and experience
• Send notifications about activity relevant to you
• Understand how people use Campus so we can improve it
• Detect and prevent abuse, spam, or security threats
• Comply with legal obligations

We process your data under the following legal bases:

• Contract — to provide you the service you signed up for
• Legitimate interests — to improve Campus, ensure security, and understand usage patterns
• Legal obligation — where required by law
• Consent — for any optional communications you opt into

We do not sell your personal data. We may share it with:

• Service providers — such as our email provider (Resend) and hosting provider (Render), who process data on our behalf under data processing agreements
• Other Campus users — your name, profile picture, course, posts, and public activity are visible to other verified students on the platform
• Law enforcement or regulators — if required by law or to protect safety

We keep your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it for legal or security purposes. Posts you delete are marked as deleted and hidden immediately, and permanently removed within 30 days.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, email us at WinterA9@cardiff.ac.uk. We will respond within 30 days.

Campus uses a session cookie to keep you logged in, and browser local storage to remember your theme preference (dark or light mode). We do not use third-party tracking cookies or advertising cookies.

Passwords are hashed and never stored in plain text. We use HTTPS for all data in transit. University affiliation is verified by email OTP. Despite these measures, no system is completely secure — please use a strong, unique password.

We may update this policy from time to time. If we make significant changes, we will notify you via the platform. Continued use of Campus after changes means you accept the updated policy.

Questions or concerns? Email us at WinterA9@cardiff.ac.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).