Privacy Policy

Snaggboard ("we", "us") is an independent student project that runs snaggboard.com. It isn't affiliated with or endorsed by any school or university. For anything about your data, email snaggboardhq@gmail.com.

• Account: your school email address (used to sign you in with a one-time code), the display name you choose, your campus, and when you joined. Your J-number is part of your school email, so like your email it's never shown to other people or accepted as a display name.
• Contact handles you add: your Instagram username and/or GroupMe link.
• Listings: title, description, price, category, condition, meetup spot, photos, an optional sticky note on the cover photo (its text, colour, position, and doodle), status (available, on hold, snagged), and dates. Photos are re-saved in your browser before upload, which removes hidden location (GPS) data.
• Events you post: the title, host, category, place, an optional private address (for an off-campus event), details, a link, the dates and times, the flyer, whether it's cancelled, and when you last changed its date, time, or place. Like listing photos, flyers are re-saved in your browser before upload, which removes hidden location (GPS) data.
• Event reports: which event was reported, the reason, any details you add, who reported it, and when, plus a copy of the event's title, host, place, details, flyer, and who posted it.
• Reports: which listing was reported, the reason, any details you add, who reported it, and when. A report also keeps a copy of the reported listing's title, description, sticky note, and seller, so we can act on it even if the listing is deleted.
• Contact form: your message, its topic, and the reply email you give us (if any).
• Coming-soon interest: if you tap “count me in” on a coming-soon page (such as student businesses), which page, which option you chose, and when. We only count these to decide what to build next.
• Technical data: like any website, our hosting and database providers (Vercel and Supabase) process your IP address and basic request information (such as browser type) to deliver pages, sign you in, keep the site secure, and limit abuse. To enforce posting and upload limits, we also record when each listing or event is posted or an event is edited (the account and time), each photo upload's account, time, and size, and each flyer upload's account and time. When you ask for a sign-in code, Cloudflare Turnstile may check your IP address and browser to tell a person from an automated script. We use cookies only to keep you signed in.

We don't collect passwords (there aren't any), payment details, or your location.

• To sign you in, and to check that you can receive email at your school's student address. That shows you have access to the inbox; it isn't proof of current enrollment, which is why you also confirm your eligibility when you sign in (see our Terms).
• To show your listings and events and let signed-in students contact you.
• To review reports, enforce our Terms, and keep students safe.
• To answer messages you send us.
• To prevent spam, fraud, and abuse, and to fix problems.

We don't use your data for advertising, and we never sell or rent it.

• Anyone, even signed out: your listings, including photos, price, description, sticky note, meetup spot, your display name, and campus. Your events, including the flyer, title, host, place, dates, details, and link, but not who posted them: the board says only that a verified student did. Listing and event pages can also be found through search engines such as Google, which may keep their own copy for a while after a listing changes or is deleted.
• Signed-in students only: your Instagram and GroupMe, shown on your available listings so buyers can reach you; on an event you posted, your display name and those handles; and an event's private address.
• No other student: your school email, your account details, which coming-soon options you tapped, or who reported a listing or an event. Sellers and event posters are never told who reported them.

We use a few service providers to run Snaggboard. They handle data only to provide their service to us:

• Supabase: database, sign-in, and photo storage. It keeps its own sign-in records, including IP addresses.
• Vercel: website hosting.
• Cloudflare (Turnstile): the check on the sign-in page that stops automated scripts from requesting codes. It processes your IP address and browser information for that check.
• Resend: sending sign-in codes and notification emails. It keeps a log of the emails it sends.
• Google (Gmail): our operations inbox. Copies of contact-form messages, report notifications (including the report details), and our email conversations with you are stored there.
• GitHub: runs our nightly backup job, which handles the data for a few minutes while it makes and encrypts the backup.
• Backblaze: stores our backups. They're encrypted before they leave the backup job, so Backblaze can't read them.

We may also share information if the law requires it, or if it's needed to protect someone's safety or investigate a violation of our Terms (for example, with campus police).

We use only essential cookies, which keep you signed in. We don't use advertising, analytics, or tracking cookies.

• Your account: while it's active. If you ask us to delete it, we delete your account, profile, listings, events, and every photo and flyer you uploaded within 30 days.
• Coming-soon interest: until you take your tap back or your account is deleted. When a feature launches, or we decide not to build it, we delete its taps.
• Listings: until you delete them. A snagged listing leaves the board after 30 days, but its page still opens for anyone with the link until you delete it. Deleting a listing deletes its photos from our storage right away; if that automatic removal ever fails, we remove the leftover files within 7 days. We can't remove copies outside Snaggboard: our photos tell browsers to stop reusing a saved copy after a day, but that isn't a guarantee: anyone who viewed a photo could have kept it (for example, as a screenshot), and we can't reach into other people's devices.
• Events: deleted automatically 30 days after their last date (cancelled ones too), and their flyers within 7 days after that. A changed or removed flyer is deleted within 7 days as well. To have an event deleted sooner, email us.
• Reports and contact messages: as long as needed to handle them and keep the community safe, and no longer than 12 months (including the copies in our operations inbox). Emails you send straight to our inbox (for example, a deletion request) are also deleted within 12 months. Reports about a listing or an event are kept for that time even if the listing, event, or the account that posted it is deleted, so we can spot repeat problems. Copies in our backups last up to 4 weeks longer.
• Backups: every night we make an encrypted backup of the database and photos, so we can recover from a mistake or an outage. Each backup is deleted automatically 18 days after it's made, and our storage provider erases deleted backups within 5 more days, so anything you delete is gone from every backup within 4 weeks of being deleted. If we ever restore from a backup, we first re-apply every deletion and removal made since that backup, so deleted accounts, listings, and photos don't come back. To do that, we keep a short internal record of each deletion, and of each account suspension or reinstatement (an ID, photo file names, and for a suspension, until when; never names, emails, or listing text) for 4 weeks, and its backup copies for up to 4 weeks more. One limit: if our live database itself were ever lost, deletions made after the latest backup (up to about a day's worth) wouldn't be recorded anywhere. If that happens, we'll post a notice on the site, redo every deletion request you've emailed us, and you can delete anything that reappears.
• Technical logs: our providers keep their own logs for limited periods: Supabase's sign-in records (time, email address, and IP address) for 7 days, Resend's log of the emails it sent you (address, subject, and whether it arrived) for 30 days, and Vercel's request logs for its normal short period. Our records of listing and event posts and event edits (account and time), photo uploads (account, time, and size), and flyer uploads (account and time) are deleted within 3 days (a daily clean-up removes anything older than 48 hours), and their backup copies last up to 4 weeks longer. If your browser reports that our security policy blocked something on a page, we keep a running tally for each kind of block: the kind of page, the rule, the blocked site's address, how many times it happened, and when it was first and last seen (no IP address or browser details). A tally is deleted 30 days after it was last reported, and its backup copies last up to 4 weeks longer.

• Change your display name and contact handles anytime in Settings.
• Edit, put on hold, mark as snagged, or delete your listings anytime in My Listings.
• Change your events, skip one of their dates, or cancel them anytime in My Events.
• Take back a coming-soon tap anytime by tapping it again on its page.
• Ask for a copy of your data, a correction, or account deletion by emailing snaggboardhq@gmail.com from your school address. We'll respond within 30 days.

We use database-level access rules so each student can change only their own data. Contact details are shown only to signed-in students, and school emails are never displayed. No system is perfectly secure, though. If a breach affects your information, we'll tell you as required by law.

Snaggboard is only for students aged 18 or older. We don't knowingly collect information from anyone younger. If we learn that we have, we'll delete it.

If we change this policy, we'll update the effective date above, and for significant changes we'll give notice on the site. See also our Terms of Service.

Questions or requests about your information? We're happy to help. You can reach us by email or through our contact form.