Privacy Policy

1. What we collect

Only what the service cannot work without. We buy nothing from data brokers and collect nothing about you from other sites.

• Your university email address. It is what proves you are a student and how you sign in. Your institution is derived from the domain — we never ask you to tell us where you study.
• Profile details you type in yourself: handle (required), first name, study programme, year, avatar icon, bio, interests, dorm and room number, and whether you are looking for a roommate.
• What you do in the app: which activities you signalled, when you last visited, and whether you have answered our one feedback question.
• Technical records needed for safety: your IP address at the moment of a request is used for rate limiting and held only in the server's memory — it is never written to the database.

2. Why, and on what legal basis

The GDPR requires a legal basis for each purpose. Ours are three.

• Performance of a contract (Art. 6(1)(b)): creating your account, signing you in, showing your profile to other verified students, computing roommate compatibility.
• Legitimate interests (Art. 6(1)(f)): abuse prevention — rate limiting, the manual access review, and handling reports. The interest is keeping this a closed student community, which is the entire point of the service.
• Consent (Art. 6(1)(a)): the optional profile fields. You can leave them empty, and you can clear them at any time from profile settings.

3. What other people can see

Bendrabutis is not a public website. A logged-out visitor sees no profiles at all, and that is enforced by row-level security in the database, not merely by the interface.

• Other verified students see your handle, avatar, first name if you added one, institution, programme, year, interests, bio and dorm.
• No other user ever sees your email address. It is never shown on a profile.
• Your room number is visible only to signed-in verified students. It is not sent to a logged-out visitor even at the network level.
• Admins who run the access queue see the list of waiting addresses and their status. That is unavoidable: a person approves each request.

4. Email

We send three kinds of message, each of them only when you ask for it: the address confirmation when you sign up, a sign-in link, and a password reset link. There are no newsletters, no marketing and no reminders, which is why there is nothing to unsubscribe from.

5. Who else processes your data

We use a small number of providers. Each is a processor bound by contract, and none may use your data for their own purposes.

• Supabase — database and authentication (EU region).
• Resend — delivery of the sign-in and confirmation emails.
• Vercel — hosting and aggregate traffic statistics.
• Where data reaches a provider outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Your profile and account: until you delete them. Deleting the account removes the profile irreversibly.
• Access requests: 12 months after a decision, so a refusal cannot be sidestepped by simply asking again.
• Analytics rows: 24 months, then deleted.
• Abuse reports: 24 months after they are resolved.

7. Your rights

Under the GDPR you may access your data, correct it, erase it, restrict processing, receive it in a portable format, and object to processing based on legitimate interests. Most of this you can do yourself in profile settings; for the rest, write to privacy@bendrabutis.lt. We answer within 30 days.

If you believe we are handling your data improperly, you may complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt).

8. Age

Bendrabutis is for higher-education students. We do not create accounts for anyone under 16. If we learn of one, we remove it.

9. Security

There are no passwords — you sign in with a one-time code, so there is nothing of that kind to leak. Database access is constrained by row-level security: even holding the app's public key, another student's rows cannot be read. Traffic is encrypted with TLS.

No system is perfect. If you find a flaw, write to privacy@bendrabutis.lt — we will answer, and we will not pursue anyone for reporting in good faith.

10. Changes

If we change this policy materially, we will say so in the app before the change takes effect. The current version always lives at https://bendrabutis.vercel.app/privacy.