Privacy Policy

When you create an account:

• your email address and your name
• either a hashed password or, if you sign in with Google, an identifier from Google — never both, and never your Google password
• a profile photo, if you sign in with Google — it comes from your Google account, and uploading your own is not available yet

Then, depending on what you do:

• your campus, and whether it has been verified
• your phone number, only if you add one, plus whether you have made it visible and whether you accept WhatsApp
• your listings — titles, descriptions, prices, categories and photos
• a record of each time a buyer reveals a seller’s contact details, on both sides of that exchange
• a second college email address, if you verify your campus with an address you do not sign in with
• the messages you send through in-app chat — the text itself, who the conversation is between, when each message was sent, and whether it has been read
• a short preview of each message, copied into the recipient’s notifications so their bell is readable without opening the thread

We do not run advertising, we do not sell anything about you, and we do not build a profile of you for anyone else.

Your email identifies your account and is how we send verification and password resets. Your name and campus are what let another student know who they are meeting. Listings exist so people can find your things.

The contact-reveal record exists for safety: it means a phone number cannot be collected quietly at scale, and there is a trail if someone misuses one.

A verified campus always comes from an email domain. Either the address you sign in with is at a recognised college domain, or you verify a college address separately — we email a code to it, and confirming that code is what proves it is yours. In both cases we only look at what comes after the @: we do not read your email, and we have no access to your inbox.

You can also pick your campus from the list while you are unverified, so the marketplace has somewhere to put you before a domain has confirmed anything. A campus chosen that way is not a verified one, and once verification has set your campus you can no longer change it yourself.

Your name and campus appear on your listings. Your phone number does not — it is hidden unless you choose to make it visible, and even then a buyer has to actively request it rather than read it off the page.

Your email address is never shown to another user.

Only the services that make the product work, and only with what they need to do their job:

• an email provider, to deliver verification codes and password resets
• an image host, to store and serve listing photos
• Google, but only if you choose to sign in with Google
• PostHog, a product analytics service — what it does and does not receive is set out below

We may also disclose information where the law requires it. Beyond those services and that duty, nothing is shared with anyone.

We use PostHog to understand whether HostelBucket works — which parts of the marketplace people actually use, and whether listings lead to someone getting in touch. It measures the product in two places: in your browser, and on our servers.

In your browser, and never linked to you. We count the pages that are visited, which category was searched for, how many results came back, and which listings are opened. We also record where a visit came from — the site that linked to it, and the campaign tags on the link if it came from one of our posts.

We do not build a profile of you and we cannot recognise you across visits. No cookie is stored. While a tab is open, the pages visited in it are grouped together so that one visit counts as one visit rather than several; when you close the tab that grouping is gone and nothing about it is kept on your device. Coming back tomorrow is a new visit that we have no way of connecting to today’s.

Being signed in changes nothing. Your account is never attached to any of this — not your name, not your email address, and not the internal account identifier our servers use. There is deliberately no way for us to ask what a particular person did.

We never record what you type into the search box. We record only that a search happened, which category it was in, and how many results it returned. Web addresses are cleaned before they are sent: we remove the contents of every part of the address except the campaign tags, so a verification link never carries your email address, a password-reset link never carries its token, and a sign-in redirect never carries your access token. We do not record what you click, we do not record anything you type into a form, and we do not record your screen.

Where a listing is involved we record what kind of thing it was — its category, its campus, whether it is for sale or for rent, its condition, and a price range rather than a price. Never its title or description, and never the seller. When a seller’s contact details are revealed we record which kind of contact it was, never the number itself. When a message is sent we record that one was sent, never a word of what it said.

On our servers. Separately, our server sends PostHog six things, and only when they happen:

• an account finishing sign-up
• a campus being verified
• a listing being published
• a seller’s contact details being revealed to a buyer
• a chat being started
• a listing being refused because the campus is not verified yet

Each one carries an internal account identifier — not your email address or your name — and, where it applies to that event, your campus, the category and type of listing, and which kind of contact was revealed. It never carries your name, email address, phone number, listing titles or descriptions, or anything you write in a message. The contact-reveal event records that a number was handed over, never the number itself.

• Your listings: until you delete them.
• Your account: for as long as you have one. Deleting it yourself is not available in the app yet — you can ask us to erase it by email, and we will respond within a reasonable time.
• Your messages: we keep them. Archiving a conversation hides it from your inbox rather than deleting it, and the other person keeps their copy either way. If you want a conversation removed, write to us at the address below.
• Verification codes: 10 minutes.
• Password reset links: 1 hour.
• Analytics: nothing is kept on your device beyond the tab you are using. The counts themselves are held by PostHog and are not linked to your account.

You can see and correct your details in your profile, and change whether your phone number is visible. Deleting your account yourself is not available yet. You can ask us for a copy of what we hold, or ask us to erase your account, and we will respond within a reasonable time.

HostelBucket is intended for students at the campuses we support. Some first-year students are under 18, and Indian data protection law sets additional requirements for handling the personal data of anyone under that age. If you are under 18, please use HostelBucket with your parent or guardian’s knowledge and consent.

Passwords are stored hashed, never in a form we could read. Traffic is encrypted in transit. Access to the production database is limited to the people who run the service. No system is perfectly secure, and we will tell you promptly if something happens that affects you.

If this policy changes in a way that matters, we will say so in the product before the change takes effect. The date at the top always reflects the current version.

For anything about your data, including a request to see or delete it, write to [email protected].