Privacy Policy

When you create an account:

• your email address and your name
• either a hashed password or, if you sign in with Google, an identifier from Google — never both, and never your Google password
• a profile photo, if you add one

Then, depending on what you do:

• your campus, and whether it has been verified
• your phone number, only if you add one, plus whether you have made it visible and whether you accept WhatsApp
• your listings — titles, descriptions, prices, categories and photos
• a record of each time a buyer reveals a seller’s contact details, on both sides of that exchange

We do not run advertising, we do not sell anything about you, and we do not build a profile of you for anyone else.

Your email identifies your account and is how we send verification and password resets. Your name and campus are what let another student know who they are meeting. Listings exist so people can find your things.

The contact-reveal record exists for safety: it means a phone number cannot be collected quietly at scale, and there is a trail if someone misuses one.

From the domain of your email address, and nothing else. A recognised college domain matches your account to that campus. We do not read your email, and we have no access to your inbox — we only look at what comes after the @.

Your name and campus appear on your listings. Your phone number does not — it is hidden unless you choose to make it visible, and even then a buyer has to actively request it rather than read it off the page.

Your email address is never shown to another user.

Only the services that make the product work, and only with what they need to do their job:

• an email provider, to deliver verification codes and password resets
• an image host, to store and serve listing photos
• Google, but only if you choose to sign in with Google

We may also disclose information where the law requires it. Beyond that, nothing is shared with anyone.

• Your account and listings: until you delete them.
• A deleted account: there is a 30-day grace period during which signing in restores it. After that it is permanently anonymised and cannot be recovered.
• Verification codes: 10 minutes.
• Password reset links: 1 hour.

You can see and correct your details in your profile, change whether your phone number is visible, and delete your account from Settings. You can also ask us for a copy of what we hold, or ask us to erase it, and we will respond within a reasonable time.

HostelBucket is intended for students at the campuses we support. Some first-year students are under 18, and Indian data protection law sets additional requirements for handling the personal data of anyone under that age. If you are under 18, please use HostelBucket with your parent or guardian’s knowledge and consent.

Passwords are stored hashed, never in a form we could read. Traffic is encrypted in transit. Access to the production database is limited to the people who run the service. No system is perfectly secure, and we will tell you promptly if something happens that affects you.

If this policy changes in a way that matters, we will say so in the product before the change takes effect. The date at the top always reflects the current version.

For anything about your data, including a request to see or delete it, write to contact@hostelbucket.com.