Privacy Policy

Loot ("we", "us", "our") is a student marketplace operated in Canada. This Privacy Policy explains what information we collect, how we use it, and your rights as a user. By using Loot, you agree to the practices described here.

1. Information we collect

When you create an account

Email address (for verification and account access)
Display name and profile photo (photo is optional)
University affiliation (inferred from your university email domain when you sign up for the app)

When you use the app

Listing content: photos, descriptions, prices, course codes
Messages sent through in-app chat
Ratings and reviews you give or receive
Listings you save to favourites
Device type, OS, and app version (for bug fixes only)

When you join the waitlist

First name, last name, email address, and school selection.

2. How we use your information

To provide the service: account creation, listing display, messaging, ratings
To verify your student status: confirming your email domain matches a supported institution. Re-verification is required annually to keep your account active.
To send transactional emails: verification links, password resets, notifications you've opted into
To enforce community standards: reviewing reports of problematic listings or users
To improve the product: understanding how features are used (aggregate and anonymised only)

We do not sell your personal data to third parties. We do not run advertising.

3. What we share

Your email is never shown to other users. Your display name, university, profile photo, ratings, and active listings are visible to other verified Loot users.

We use the following third-party services to operate Loot:

Supabase: database, authentication, and file storage
Stripe: payment processing for in-app transactions. Your card details go directly to Stripe and are never stored by Loot.
Resend: transactional email delivery
Cloudflare Turnstile: bot protection on public-facing forms
Vercel: web hosting

Each service has its own privacy policy. We share only the minimum data each needs to function.

4. Data retention

We keep your account data for as long as your account is active. If you delete your account, we delete your personal information within 30 days, except where retention is required by law. Listings you delete are removed immediately.

5. Your rights

Under PIPEDA and applicable provincial privacy law, you have the right to access, correct, or delete your personal information. To exercise these rights, email privacy@lootapp.ca.

6. Security

We use encrypted connections (HTTPS/TLS), hashed passwords, and row-level database security policies. No system is perfectly secure, but we take the protection of student data seriously.

7. Children

Loot is intended for university and college students aged 16 and over. We do not knowingly collect data from minors.

8. Changes to this policy

We'll notify active users by email for any material changes. The "last updated" date at the top reflects the most recent revision.

9. Contact

Questions about privacy? Email privacy@lootapp.ca or write to Loot, Canada.