Privacy Policy

1. Who We Are

Roost is a student-to-student housing marketplace operated in Ontario, Canada. We help McMaster University students find and list housing. This policy explains how we collect, use, and protect your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy law.

2. Information We Collect

We collect only what is necessary to operate the platform:

• Account information — your email address, first name, program, and year of study when you sign up.
• Verification data — your McMaster email address used to confirm student status. We do not store your student ID number.
• Listing content — property address, photos, description, price, and availability dates that you submit when posting a listing.
• Messages — messages sent between users through the in-platform messaging feature.
• Usage data — basic usage logs (pages visited, actions taken) used to diagnose errors and improve the platform. We do not use third-party analytics trackers.

3. How We Use Your Information

• Display your listings and profile to other users browsing the platform.
• Send transactional emails — new message notifications, listing confirmations, and password resets — via our email provider (Resend).
• Verify your McMaster enrollment status to maintain a student-only marketplace.
• Investigate reported listings or user conduct that may violate our Terms of Service.

We do not sell your personal information. We do not use your data for advertising or share it with marketing partners.

4. Third-Party Service Providers

We use the following sub-processors to operate the platform:

• Supabase — authentication, database, and file storage. Data is stored on servers in the United States and/or Canada. Supabase is SOC 2 Type II certified.
• Resend — transactional email delivery. Your email address is transmitted to Resend only when sending you a notification.
• Vercel — web hosting and edge network. Processes request data (IP address, headers) in accordance with Vercel’s privacy policy.

Each provider is contractually required to handle your data only as necessary to provide their service to us.

5. Data Retention

• Account data is retained until you request deletion.
• Listings are retained until archived or deleted by the lister.
• Messages are retained to support ongoing conversations. They are not automatically deleted.
• Usage logs are retained for up to 90 days for debugging purposes.

6. Your Rights

Under PIPEDA, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or incomplete information.
• Deletion — request that we delete your account and associated personal data.
• Withdraw consent — withdraw your consent to non-essential uses of your data at any time.

To exercise any of these rights, email us at roost.housing@gmail.com. We will respond within 30 days.

7. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), row-level security policies on our database, and access controls that limit which data each user can read or modify. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Children

Roost is not intended for users under the age of 16. If you believe a minor has created an account, please contact us and we will remove it promptly.

9. Changes to This Policy

We may update this policy from time to time. We will notify registered users by email when we make material changes. The “Last updated” date at the top of this page reflects the most recent revision.

10. Contact

Questions or concerns about this policy? Email us at roost.housing@gmail.com.