Privacy Policy

Controller

Data controller: Cenk Yavuz, info@istadi.com. Contact us at this address with any questions.

What data we process

• Account: your e-mail address. If you sign in with a password we store it only as an Argon2 hash, never the password itself; if you sign in with Google, we receive your name and e-mail address from Google. New passwords are checked against known data breaches: only the first five characters of their SHA-1 hash are sent to the Have I Been Pwned service (api.pwnedpasswords.com). If you turn on two-factor authentication, its settings are stored with your account.
• Sign-in security: for each active session, the device (browser) and IP address, so you can see and end your sessions.
• Profile: optional profile and roommate-matching information you provide (university, dorm, room type, a short bio). Other students see only your name, university and short bio until you both accept a match.
• Student Space: notes you publish are public, shown with your first name, your relation to the place (for example “lived here until 2024”) and the month you wrote them. To have a note removed, write to us.
• Newsletter: if you subscribe, your e-mail address and the time you confirmed it (double opt-in). Every newsletter has an unsubscribe link.
• Usage analytics (PostHog, EU hosting): page views, clicks and interactions, session duration. Visitors who are not signed in stay anonymous — no profile is created for them. When you are signed in, events are linked to your internal user ID, never to your name or e-mail. Analytics does not run at all if your browser sends a Do Not Track signal.
• Error monitoring (Sentry): technical details of errors, such as the page, browser and time.
• Contact: the content of forms and e-mails you send us.

Why and on what legal basis

We process data to provide the service and manage your account (performance of a contract, Art. 6(1)(b) GDPR), to keep the site secure and to measure and improve it (legitimate interest, Art. 6(1)(f)), and to send the newsletter (your consent, Art. 6(1)(a), which you can withdraw at any time through the link in every newsletter).

Service providers

These providers process data on our behalf: Vercel (hosting), Supabase (database), Upstash (rate limiting), Resend (e-mail), Sentry (errors), PostHog (analytics, EU region) and Cloudflare (DNS/CDN). Google processes your data under its own terms when you choose to sign in with Google; the Have I Been Pwned service receives only the five-character hash prefix described above.

Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection. You can download everything we hold about you and delete your account from your profile page; for anything else write to info@istadi.com. You also have the right to lodge a complaint with a supervisory authority — in Austria, the Datenschutzbehörde.

Retention

We keep data only as long as necessary or as the law requires. If you delete your account you have 30 days to change your mind; after that the account is anonymised: e-mail, name, password, bio and sign-in methods are removed and your chat messages are replaced with “[deleted]”. Notes you published in Student Space stay, without your name.