Privacy
How Uni-Verse handles your data now that real accounts are live — covering your profile, direct messages, and the choices you have over your own data.
What we collect
Your Cardiff University account: email (must end @cardiff.ac.uk), name, username, year and course, and anything optional you add — a bio or profile photo. The direct messages you send and receive. The societies you join, events you RSVP to, and items you save. If you're a society/admin account, the events you post. We also keep a few small things in your own browser's local storage (your session, saved items, calendar) — those never leave your device. We do not store your IP address.
Why we collect it
To run your account, show you the right events and societies, let you message other students, and remember what you've saved or RSVP'd to.
Lawful basis
Mostly this is us providing the service you signed up for (performance of a contract). Optional extras like your bio or profile photo are given on the basis of your consent.
Who sees it
Your profile (name, username, year, course, bio) is visible to other signed-in Cardiff students, so they can find and message you. Your direct messages are visible to you and whoever you're messaging. If either of you reports a conversation, an admin may read it to review the report fairly. We don't sell your data. Two infrastructure providers host it on our behalf and never use it for their own purposes: Supabase (accounts and the database) and Cloudflare (hosting).
How long we keep it
While your account is active. Deleting your account (Profile → Account → "Delete my account") immediately deactivates it, signs you out everywhere, and hides your profile and messages from other students. The underlying records are then permanently removed by the team — right now that's a manual step rather than instant; we're working on making it automatic.
Your rights
Under UK GDPR you can access, export or delete your data. Use "Download my data" and "Delete my account" in Profile → Account, or email [email protected] for anything those don't cover.
Cookies and local storage
No tracking cookies, no third-party ad trackers. We keep a few small things in your browser's local storage — your login session, your saved items and calendar, and (if you use the Map signed out) a random id so your "I'm going tonight" tap only counts once. None of this is sent to advertisers.
Changes
If anything here changes in a way that matters, we'll update this page.
Last updated when this page was built.