Privacy Policy

1. Who we are

Loot Marketplace Inc. ("Loot", "we", "us", "our") operates the Loot mobile application and website at lootapp.ca. We are incorporated in Ontario, Canada. Questions about this policy can be directed to privacy@lootapp.ca.

2. What information we collect

Account information: When you create an account, we collect your university email address, the name you provide, and your institutional affiliation (derived from your email domain).

Listing information: Content you post to the platform including titles, descriptions, prices, photos, course codes, and listing status.

Messages: In-app chat messages between users. These are stored to deliver the messages and support dispute resolution.

Usage data: Standard app usage data including pages viewed, features used, and timestamps. We use this to improve the product, not to sell to advertisers.

Device information: Device type, operating system, and push notification tokens (if you enable notifications).

3. What we do NOT collect

• We do not collect payment information. All payments are made between users directly.
• We do not collect government ID, student ID, or any identity documents.
• We do not track your location in real time or in the background.
• We do not build advertising profiles or sell your data to third parties.

4. How we use your information

• To verify your student status and activate your account
• To display your profile and listings to other verified users on your campus
• To deliver in-app messages between users
• To send transactional emails (email verification, password reset, launch notifications)
• To send push notifications you've opted into
• To investigate reports, enforce our community rules, and remove bad actors
• To improve the product through anonymized usage analytics

5. What other users can see

Your first name, university, member since date, rating average, rating count, bio (if set), and your active listings are visible to other verified Loot users. Your email address is never shown to other users.

6. Data sharing

We do not sell your personal information. We share data with:

• Supabase — our database and authentication provider, hosted in Canada where possible
• Resend — our email delivery provider, for transactional emails only
• Expo — push notification delivery
• Law enforcement — when required by a valid legal process under Canadian law

7. Data retention

We retain your account data for as long as your account is active. If you delete your account, we delete your personal information within 30 days, except where retention is required by law or for active dispute resolution.

Anonymized, aggregated analytics data may be retained indefinitely.

8. Your rights (PIPEDA)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Withdraw consent and request deletion of your data
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, email privacy@lootapp.ca.

9. Security

We use industry-standard security practices including encrypted data transmission (TLS), encrypted data storage, and row-level security policies on our database. No security system is perfect — if you discover a vulnerability, please email security@lootapp.ca responsibly.

10. Children

Loot is for university and college students. We do not knowingly collect information from anyone under 17. If you believe a minor has created an account, contact us and we will remove it.

11. Changes to this policy

We will notify users by email and in-app notification before making material changes to this policy. Continued use of Loot after changes constitutes acceptance.

12. Contact

Questions, requests, or concerns: privacy@lootapp.ca

Loot Marketplace Inc., Toronto, Ontario, Canada