1. Who is responsible
This Policy covers the RoomMate 0.0.1 beta and its public pages. Young Jun Chi is the individual operator and data controller. Registered address: Stieltjesweg 12, 2628 CK Delft, Netherlands. For privacy questions or requests, contact support@roommate.ac.
2. What we use and why
- Account details: email, password hash, verification and session records, policy records and your dated 18+ statement, to provide and secure your account under our contract with you or steps you request before joining.
- Feature data: profiles, memberships, posts, comments, images, reviews, listings, messages, votes, searches, favourites, listing views and notifications, to provide the features you choose under that contract.
- Study data: selected courses and saved grades, to provide study tools under that contract. Timetables and what-if grades stay on your device per account; saved grades also go to the service.
- Security and safety data: IP addresses, device/app/network information, failed logins, request and error logs, reports, blocks, moderation records, appeals and support correspondence. Our legitimate interests are preventing fraud and abuse, securing the service, handling complaints fairly and protecting legal claims. Applicable legal duties also apply where required.
- Supporter records: contact details, messages and payment/refund/dispute records received through optional Ko-fi support, for our legitimate interests in administering support and resolving problems, and accounting or tax obligations where applicable.
We also handle information needed for valid authority requests under applicable legal obligations, or to protect vital interests in an emergency where the legal conditions are met.
Account and security data is needed for access. Optional content, profile and study data is needed only for the features you choose. Data comes from you, your device and activity, service providers, other users' content or reports, Ko-fi and lawful authority requests. Course information comes from public TU Delft Study Guide and TimeEdit sources. Share only necessary personal information, especially sensitive data or allegations about others.
We do not use advertising or product analytics, sell personal data or track you across websites. The app stores sign-in and feature data on your device; public pages store your theme choice. We do not request precise device location. Photos can contain location and other metadata that reaches the server before removal from the stored image.
The 18+ statement does not collect your birth date, identity documents or biometric age estimates. Credible age concerns may require proportionate evidence and human review.
3. Who can see data
Listings and Community content reach the feature's audience. Community posts and comments show your display name unless you choose anonymous display. Your display name and avatar, where provided, appear in listing conversations. Anonymous contributions and course reviews hide your account identity from peers, but retain an internal account link for safety, blocking, moderation and lawful requests. Reporting does not automatically identify the reporter or give access to a hidden author's identity.
Listing messages are for their participants; grades and account controls are private to your account. Necessary authorised access may include messages, reports, moderation records and hidden account links for support, safety and lawful requests. We do not continuously read or scan every contribution.
Uploaded images have public links: anyone with a link can open it outside RoomMate. People may keep copies or screenshots of content they can see. TU Delft receives mailbox messages and delivery metadata, not other RoomMate activity merely because you use its email service. Authorities, courts, emergency services and professional advisers may receive necessary information where there is a valid legal basis.
4. Providers and overseas processing
Providers receive the data needed for their services when you use the app, send email or access our domain:
- Supabase Pte. Ltd. stores account details, content, images and related records, with primary project hosting in Ireland. The provider is based in Singapore. Privacy contact · Subprocessors.
- Railway Corporation hosts the application and temporary service records in the Netherlands, and handles application data and request/error logs. The provider also processes data in the United States. Privacy contact · Subprocessors.
- Plus Five Five, Inc. (Resend) sends account verification and recovery email, processing email addresses, message content and delivery records. Messages are sent from Ireland; email data is stored in the United States. Privacy contact · Subprocessors.
- Google Cloud EMEA Limited (Google Workspace) provides support email, processing correspondence, attachments and delivery information. Google uses global facilities, including the United States. Privacy contact · Subprocessors and locations.
- Namecheap, Inc. provides domain resolution through its global DNS network, processing DNS requests and related network information. Privacy contact · Service privacy details.
Providers may use the subprocessors linked above for relevant services; not every listed provider function receives your data. Retention is described in §6. Personal data may also be accessed from South Korea or processed outside the European Economic Area (EEA) as described above.
The EU's South Korea adequacy decision covers qualifying transfers to South Korea. Supabase's standard data-processing terms include EU Standard Contractual Clauses for applicable transfers, as does Resend's DPA. Transfers outside an adequacy decision's scope require another lawful transfer mechanism and any required safeguards. Contact support@roommate.ac for transfer information and copies of applicable safeguards.
5. Optional Ko-fi support
The support link opens ko-fi.com/roommatejun externally after confirmation, without adding a RoomMate account identifier or tracking parameter. Ko-fi and its payment provider receive browser/network information and handle payments under their own notices.
Depending on your choices and payment settings, the operator may receive your display name, email, message, amount, currency, support status and transaction, refund or dispute details. Supporter data is not matched to RoomMate accounts or used to give app benefits or favourable treatment. Use the providers' controls for their records and monthly-support cancellation; RoomMate account deletion does not do either.
6. Retention and deletion
Verification codes normally expire after 15 minutes and incomplete registrations after 24 hours. Unattached uploads become eligible for cleanup after 24 hours. Expiry or eligibility does not mean immediate deletion.
Account and feature data normally remains while your account is active. Delete it through Home profile avatar → Profile → Advanced settings → Delete account, or email support@roommate.ac with “Account deletion.” Account deletion removes your account, profile, posts, comments, reviews, listings, listing messages and grades. Communities you created may remain after their creator-account link is removed; stored images are removed through later cleanup, with retries if removal fails.
Necessary records may be retained or detached from the account for unresolved reports, appeals or disputes, security investigations, legal duties or claims. Retention depends on resolving the matter, applicable legal time limits and any legal hold. Detached records are not necessarily anonymous. A limited block entry may remain until the blocking user removes it or deletes their account.
Routine support mail is deleted 90 days after resolution. Minimum privacy-request and completed moderation evidence is kept for six calendar months after closure or final appeal. Necessary longer retention for ongoing restrictions or unresolved safety work, disputes or legal holds is reviewed every three months; we delete the retained evidence within 30 days after that reason ends, once its ordinary retention period has also ended. Deleting your RoomMate account does not automatically remove support mail.
Resend keeps email and delivery logs for 30 days on our plan, with seven-day backups. Other people's copies and provider recovery copies may remain after active records are deleted.
Supporter records remain for administration and unresolved refunds or disputes, and for applicable accounting, tax or legal-claim periods. We use restricted access and account security controls to protect retained data.
7. Your rights
Subject to applicable conditions, you can request access, a copy, correction, deletion, restriction or portability. You can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting earlier lawful processing.
Email support@roommate.ac; no sign-in is needed. We may request proportionate information to verify you or someone acting for you. Rights, deletion and available appeals remain accessible during account restrictions or if you decline an update. Automated checks for expired verification, excessive requests or app tampering can refuse verification, delay requests or restrict access; you can request human review by email.
You may complain directly to a competent authority, including the Netherlands' Autoriteit Persoonsgegevens. Material privacy changes receive notice where required; a policy update does not retroactively authorise a new purpose or legal basis.