Privacy Policy

This Privacy Policy ("Policy") explains how FlatGrad ("Company," "we," "us," or "our") collects, uses, shares, retains, and protects information when you access or use our website, mobile applications, platforms, and related services (collectively, the "Platform").

By using the Platform, you acknowledge that you have read, understood, and agree to the terms of this Policy. If you do not agree, you must immediately discontinue use.

The FlatGrad website marketplace uses Supabase for its account system. The FlatGrad mobile app uses a separate Firebase account system. These accounts are not connected, and website account changes—including deletion—do not automatically affect a mobile app account.

• Personal Data: Information that identifies or can reasonably identify a natural person (e.g., name, email, phone number, device ID).
• Non-Personal Data: Aggregated, anonymized, or de-identified data not linked to a specific user.
• Processing: Any operation performed on data (collection, storage, profiling, sharing, sale).
• Sale: Disclosure of Personal Data in exchange for monetary or other valuable consideration (per CCPA).
• Cookies/Trackers: Files, scripts, or technologies used for analytics, personalization, advertising, and functionality.

We collect the following categories of information on the FlatGrad platform:

• Account Information – Name, username, password, email, profile details, verified university-issued email address.
• Student Verification – University email address and domain for marketplace eligibility verification.
• Contact Information – Phone number, mailing address, location (campus/city).
• Listing Information – Housing posts, ticket listings, item descriptions, photos, prices, availability.
• Transaction Data – Buyer/seller identities, listing details, communication history, dispute reports.
• Uploaded Content – Photos, images, descriptions you post on listings or in your profile.
• Messaging Data – Messages between users, conversation history, reported suspicious communications.
• User Reports – Reports of fraud, abuse, or policy violations, and information submitted in support requests.
• Launch Notification Signups – Email addresses voluntarily submitted to request a campus or feature launch notification.
• Technical Data – IP address, device IDs, browser type, operating system, cookies.
• Usage Data – Login times, searches, browse history, interactions on the platform, feature usage.

• Directly: When you sign up, fill forms, upload, transact, or contact us.
• Automatically: Through cookies, analytics, and similar technologies.
• Combined: We may link data across devices, sessions, and sources.

We use collected data to:

• Operate and maintain the FlatGrad marketplace platform.
• Verify ownership of a university-issued email address to determine platform eligibility.
• Facilitate listings and connect buyers and sellers.
• Enable messaging and communication between users.
• Process and display housing posts, ticket listings, and items.
• Detect, prevent, and respond to fraud, abuse, scams, and illegal conduct.
• Moderate accounts, suspend violators, and enforce Community Guidelines.
• Investigate user reports of fraud or misconduct.
• Send product updates, launch news, giveaways, and promotional email that you explicitly opted in to receive, and honor unsubscribe requests.
• Secure the platform with encryption and access controls.
• Improve platform features and user experience.
• Comply with legal obligations and law enforcement requests.
• Retain data only as long as reasonably necessary for the purposes above.

We may share data with:

• Service Providers – Cloud hosting, analytics, security, and technical infrastructure providers.
• Law Enforcement – When legally required by subpoena, warrant, or court order to protect rights or safety.
• Other Users – Seller/buyer information visible in transactions; your listings and profile information as you choose to display.
• Corporate Transactions – In case of merger, acquisition, or restructuring.

Payment Processing. If FlatGrad introduces payment functionality in the future, payment information will be processed exclusively through trusted third-party payment processors. FlatGrad will not directly handle credit card or banking data.

We Do Not Sell Data. FlatGrad does not sell, trade, or monetize personal data to data brokers or advertisers. We do not purchase data from external data vendors.

Account Deletion. You may delete your FlatGrad website marketplace account from authenticated Account Settings, or request help by emailing team@flatgrad.com with subject line "Account Deletion Request." In-app deletion removes website account data that FlatGrad can delete directly. Email requests are processed within 30 days unless legally required to retain the data and may require reasonable verification of account ownership. Website account deletion does not delete or change a separate FlatGrad mobile app/Firebase account.

Retention Periods. FlatGrad retains information only for as long as reasonably necessary to:

• Comply with legal obligations, including tax and regulatory requirements.
• Resolve disputes and enforce the Terms of Service.
• Prevent fraud and repeated abuse.
• Protect the security and integrity of the Platform.
• Maintain account history as needed by users.

After Account Deletion. FlatGrad may retain limited information from deleted or suspended accounts when reasonably necessary to investigate fraud, prevent repeat violations of Community Guidelines, enforce the Terms of Service, or comply with legal obligations. This may include moderation and safety records, reports, strikes, appeals, records needed to preserve the integrity of shared marketplace communications, and—when an account was terminated for enforcement reasons—a one-way hash of the account email used only to prevent circumvention and repeat registration. The plaintext email is not stored in that termination-hash record. Anonymized and aggregated data may be retained for analytics and platform improvement. Supabase, Formspree support processing, Vercel Analytics, Cloudflare Turnstile, hosting logs, and provider backup copies may have separate retention or deletion processes outside FlatGrad’s direct application cleanup. Backup copies may persist temporarily beyond deletion.

On the FlatGrad website, we use the following technologies for the purposes described below:

• Supabase authentication and session storage – Necessary sign-in, session persistence, account security, and protected marketplace functionality.
• flatgrad-theme localStorage – Remembering the light/dark theme preference; this is browser storage, not a cookie or analytics tracker.
• Vercel Analytics – Website measurement through the analytics service currently rendered by FlatGrad.
• Cloudflare Turnstile – Human verification and abuse prevention during authentication; Cloudflare may process technical and security information needed to provide the challenge.
• Formspree – External processing of support requests.

FlatGrad does not currently use advertising pixels, tracking beacons, device fingerprinting, advertising trackers, or a separate advertising/marketing analytics provider on the website. The website does not currently provide a cookie banner, consent manager, preference center, or account-level cookie settings. Users can manage or clear cookies and browser storage through browser settings. For complete information, please review our Cookie Policy.

FlatGrad implements reasonable administrative, technical, and organizational safeguards to protect your data:

• HTTPS/TLS encryption for all data in transit.
• Secure cloud infrastructure with access controls.
• Encrypted password storage using industry-standard hashing.
• Authentication, session management, content moderation, and abuse-reporting tools.
• Row-level access controls for protected user data.

Security Limitations. No internet transmission or electronic storage system is guaranteed to be 100% secure. You are responsible for safeguarding your account credentials, maintaining device security, and keeping your password confidential. Report unauthorized access immediately to team@flatgrad.com.

FlatGrad's website marketplace is intended only for students 18 years or older. We do not knowingly collect data from children under 13 (or under 16 in certain jurisdictions). If we discover that a person under 18 has created or used a marketplace account, we may restrict or terminate the account and handle associated data according to this Privacy Policy and applicable legal, security, fraud-prevention, moderation, and backup-retention requirements.

The Appearance & Media Release separately collects a participant's date of birth to determine adult eligibility and maintain release evidence. Access to that information is restricted, and retention may differ from ordinary marketplace profile data because release records may need to be retained for legal or audit purposes. Date of birth is not collected during ordinary marketplace registration.

By using FlatGrad outside the U.S., you consent to transfer and processing of your data in the United States and other jurisdictions where FlatGrad operates. Where required by applicable law, FlatGrad implements appropriate safeguards for international transfers of personal information.

Depending on your jurisdiction, you may have the following rights:

• Right to Access – Request a copy of the data FlatGrad holds about you.
• Right to Correct – Request correction of inaccurate or incomplete data.
• Right to Delete – Request deletion of your account and personal data (subject to legal retention).
• Right to Data Portability – Request your data in a portable format.
• Right to Restrict Processing – Request limitation on how your data is used.
• Right to Withdraw Consent – Withdraw consent for processing (where applicable), including unsubscribing from FlatGrad promotional email at any time.

Submit Requests: To exercise privacy rights, email team@flatgrad.com with subject line "Privacy Rights Request." Include your name, email, and description of your request. We respond within 30 days (or as required by law).

You are responsible for ensuring the accuracy and completeness of the information you provide to FlatGrad. Do not upload, share, or store unnecessary sensitive personal information (such as social security numbers, financial account details, or government IDs) on the Platform.

FlatGrad may remove or restrict access to content that violates this Privacy Policy, the Terms of Service, Community Guidelines, or applicable law. Users are responsible for understanding and complying with all applicable laws and regulations in their jurisdiction.

For users in the European Union and United Kingdom:

• Legal basis for processing: consent, contract performance, legal obligation, or legitimate interests.
• Right to lodge a complaint with your local data protection supervisory authority.
• Where required by applicable law, data transfers are protected by appropriate safeguards.

For privacy inquiries from EU/UK users, contact team@flatgrad.com.

California and other state residents with similar privacy laws have the right to:

• Know what categories of personal information FlatGrad collects.
• Delete personal information (subject to exceptions).
• Opt-out if FlatGrad were to sell data (FlatGrad does not sell data).
• Exercise rights without discrimination.

FlatGrad may link to or integrate with third-party services. These services have their own privacy policies. FlatGrad is not responsible for third-party privacy practices or data handling.

FlatGrad may update this Privacy Policy at any time. Material changes will be posted with 30 days' notice. Continued use of the Platform constitutes acceptance of updated policies.

For privacy questions, requests, or concerns, contact:

Privacy Questions
Email: team@flatgrad.com
We respond to privacy requests within 30 days or as required by applicable law.

© 2026 FlatGrad LLC. All rights reserved.