🔒 Privacy Policy

We keep things simple and honest. Here's exactly what data we collect, why we collect it, and how we protect it.

📌 Overview

MCM Square is a student-built platform operated independently by a Caleb University student. It runs the campus marketplace at mycampusmarketsquare.site exclusively for Caleb University students. This Privacy Policy explains how we handle personal data when you use our platform, in line with the Nigeria Data Protection Regulation (NDPR).

By creating an account or using MCM Square, you agree to the practices described in this policy. If you have questions, contact us at mycampuscravingssupport@gmail.com.

📋 What Data We Collect

Email address — your @calebuniversity.edu.ng address, used to verify your student status and log you in. It is never shown publicly.
Display name & matric number — entered during profile setup, visible to other logged-in students on your listings and profile.
WhatsApp number (optional) — only collected if you choose to add it. Visible only to other logged-in Caleb students, not to the public.
Listing content — titles, descriptions, prices, photos, and pickup locations you post. This is public to logged-in students.
Messages — in-app chat messages between buyers and sellers, stored to deliver the conversation.
Profile avatar — uploaded profile photos stored on Supabase cloud storage.
Usage data — basic browser and device info (e.g., screen size, browser type) used to improve the experience. We do not use tracking cookies or third-party analytics.
Payment metadata — if you boost a listing via Paystack, Paystack processes the payment. We receive a transaction reference and boost status only — we never see your card details.

⚙️ How We Use Your Data

To verify you are a Caleb University student and create your account.
To display your listings and profile to other logged-in students.
To enable real-time messaging between buyers and sellers.
To process listing boosts via Paystack and apply them to your listings.
To send account-related emails — such as password reset links and OTP codes.
To enforce community guidelines and investigate reports of violations.
To improve the platform based on how it's being used.

We do not use your data for advertising, sell it to third parties, or share it with anyone outside of the services listed below.

🔗 Third-Party Services

MCM Square uses a small number of trusted third-party services to operate:

Supabase — our backend database, authentication, and file storage provider. All user data (accounts, listings, messages, images) is stored on Supabase servers. Supabase is SOC 2 compliant. See their privacy policy at supabase.com/privacy.
Paystack — processes boost payments (₦300 Basic / ₦1,000 Premium). Paystack handles all card data securely. MCM Square never stores or sees your payment details. See their privacy policy at paystack.com/privacy.
Netlify — hosts the MCM Square website. Netlify may log standard server access logs (IP address, request path, timestamp) for security purposes. See netlify.com/privacy.

👁️ Who Can See Your Data

Your email address — never shown publicly. Only used internally for authentication.
Your display name & profile — visible to all logged-in Caleb students.
Your WhatsApp number — visible only to logged-in Caleb students on your listings, if you add it.
Your listings — visible to all logged-in students.
Your messages — visible only to you and the person you're chatting with.
Admins — MCM Square admins can review flagged content and reported listings to enforce community guidelines. They do not browse user messages without cause.

🗂️ How Long We Keep Your Data

Your account and profile data is kept for as long as your account is active.
Listings are kept until you delete them or your account is closed.
Messages are stored to maintain conversation history while your account is active.
If your account is banned or deleted, your personal data is removed from public view. Residual data may be retained for up to 90 days in backups before permanent deletion.

✅ Your Rights

You have the right to:

Access — request a copy of the data we hold about you.
Correction — update your profile information directly in the app at any time.
Deletion — request that we delete your account and associated data by contacting us at mycampuscravingssupport@gmail.com.
Withdrawal — you can stop using MCM Square at any time. Deleting your account removes your data from the platform.

To request data deletion or access, email us at mycampuscravingssupport@gmail.com with the subject line "Data Request" and we will respond within 7 days.

🛡️ Security

All data is transmitted over HTTPS (TLS encryption).
Passwords are never stored — authentication is handled by Supabase Auth using secure, hashed tokens.
Listing images are stored in private Supabase buckets with access controls.
Row-Level Security (RLS) policies on our database ensure users can only access data they are permitted to see.
We do not store payment card data — all payments go through Paystack's PCI-DSS compliant infrastructure.

🍪 Cookies & Local Storage

MCM Square does not use tracking cookies or third-party advertising cookies. We use browser localStorage only for:

Remembering your theme preference (light or dark mode).
Storing your authentication session token (so you stay logged in).

These are essential for the app to function and are never shared with third parties.

👶 Minors

MCM Square is intended for Caleb University students. By registering, you confirm you are at least 18 years old. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, please contact us.

MCM Square respects intellectual property rights. If you believe that content posted on the platform — such as a listing image or description — infringes your copyright, please contact us at mycampuscravingssupport@gmail.com with the subject line "Copyright Infringement" and include the following:

A description of the copyrighted work you believe has been infringed.
A link to or description of the listing on MCM Square where the content appears.
Your name and contact information.
A statement that you have a good-faith belief the use is not authorised by the copyright owner.

We will review all valid claims and remove infringing content promptly. Repeat infringers may have their accounts suspended or banned.

📝 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date below. Continued use of MCM Square after changes are posted means you accept the updated policy. For significant changes, we'll notify you within the app.