Privacy policy

1. What we collect

• Account details — email address, username, name.
• Profile details you add — university, graduation year, degree, avatar, bio.
• Your listings, including photos, prices and the location label you set.
• Messages you exchange with other users.
• Orders — what was bought and sold, amounts, delivery status.
• Favorites and follows.
• Technical basics — IP address and the cookies needed to keep you signed in.

We never see or store card numbers. Payments go directly through Stripe.

2. Why we use it

• To run the marketplace — show listings, deliver messages, process orders.
• To verify that sellers belong to a university, via a code sent to your university email. Codes expire after 15 minutes.
• To email you about your account, offers and orders.
• To show listings near you, based on the location a listing or university has.
• To keep the platform safe — handling reports, preventing fraud and scams.

Under the GDPR, we rely on the contract with you for running the marketplace, on legal obligations for payment records, and on legitimate interest for safety work. Anything optional rests on your consent, which you can withdraw.

3. Who processes your data

We use a small set of processors to run GradSwap. Each receives only what its job needs.

• Supabase — database, sign-in and file storage.
• Stripe — payments, payouts and the checks Stripe requires for sellers.
• Resend — transactional email, such as verification codes and order updates.
• Mapbox — the maps shown in the app.
• Vercel — hosting the website.

We do not sell your data, and there is no advertising tracking.

4. Your rights

You can ask for a copy of your data, correct it, object to processing, or take it with you. Most profile details can be edited directly in your dashboard settings.

Deleting your account removes your profile, listings, messages, favorites and follows. Order records may be kept where accounting or consumer law requires it.

5. How long we keep things

Your data stays for as long as your account exists. Verification codes expire within minutes. When you delete your account, the data above is removed rather than archived, except where the law says otherwise.

6. Cookies

We use essential cookies only: keeping you signed in and remembering your theme preference. No third-party ad cookies.

7. Changes and contact

If this policy changes in a way that matters, we will tell you by email or in the app first. For anything else, use the report and support links in the app, or read the terms of service.