Privacy Policy

1. Who is responsible

HUCSC Market is an independent student project operating in London, Ontario, in collaboration with the Huron University College Students’ Council. For the purposes of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), the student operators of the Site are accountable for the personal information described here.

Privacy questions, access requests, and deletion requests all go to ryanplumley25@gmail.com. That address is the Site’s designated privacy contact.

2. What we collect, and why

We collect the minimum needed to run a noticeboard. There is no profile builder, no behavioural profiling, and no data collected “just in case”.

What we deliberately do not collect

• No payment information ever. The Site never processes money, so there is no card number, no bank detail, and no transaction record to lose.
• No analytics, advertising, or tracking. There is no Google Analytics, no advertising pixel, no session recorder, and no third-party tracker of any kind loaded on this Site.
• No passwords, because sign-in is passwordless.
• No location data from your photos. Uploaded images have their embedded metadata, including GPS coordinates, stripped before the photo is stored or made public.
• No student numbers, no home addresses, no date of birth, no government ID.

3. Anything you publish is public

4. Cookies and local storage

This Site uses strictly necessary cookies only. We do not set advertising, analytics, or profiling cookies, which is why you are not asked to consent to any. Under PIPEDA and equivalent rules, consent is not required for cookies that are essential to deliver a service you have requested. Here is the complete list:

If you sign out, or clear cookies for this site in your browser, the session cookie is gone and you are anonymous again. Browsing listings does not require a cookie at all.

5. Who we share it with

We do not sell, rent, or trade personal information, and we do not share it for advertising. We use a small number of service providers to run the Site, and each one only receives what it needs:

• Supabase hosts the database, the authentication system, and photo storage. Data is held in a managed Postgres database with row-level security enabled.
• Vercel hosts and serves the Site, and keeps standard server logs.
• Resend delivers the “someone is interested in your book” email. It receives the recipient seller’s email address, the interested buyer’s email address as a reply-to, and the listing title.

These providers store and process data on servers that may be located outside Canada, including in the United States. That means the information can, in principle, be accessed by foreign courts or law enforcement under the laws of those countries. We chose managed providers with standard contractual protections, but you should know this before you post.

We will also disclose information if we are legally required to, or where we believe in good faith that it is necessary to prevent serious harm to someone.

6. Emails we send

We send exactly two kinds of email, and neither is marketing:

1. Your sign-in link, sent only when you request it on the login page.
2. A notification to a seller when a signed-in buyer taps “I’m interested” on their listing. The buyer’s email is set as the reply-to so the seller can answer from their own inbox.

We do not run a mailing list, and we do not send promotional email, so there is nothing to unsubscribe from. Should that ever change, we will ask for your consent first and include an unsubscribe link in every message, as Canada’s anti-spam legislation requires. If you do not want interest notifications, delete the listing or contact us.

7. How long we keep it

• Listings stay until you delete them, or until they expire and you choose not to relist. Expired and sold listings are hidden from the public.
• Your account stays until you ask us to delete it.
• Photos are deleted from storage when the listing they belong to is deleted.
• Reports are kept while the moderation matter is open and for a reasonable period afterwards, so that a repeat pattern can be recognised.
• Server logs are kept on our hosting provider’s standard schedule, typically a matter of weeks.

8. Your rights, and how to use them

Under PIPEDA you can ask what we hold about you, ask us to correct it, withdraw consent, and ask us to delete it. Several of these you can do yourself, immediately:

• See and correct your listings: go to My listings and edit any of them.
• Take a listing down: mark it sold or delete it from the same page. Deletion removes the listing row and its stored photos.
• Stop being contactable: edit the listing and remove or change the contact methods on it.
• Delete your whole account: email ryanplumley25@gmail.com from your school address with the subject “Delete my account”. We will remove your account, your listings, and your photos, and confirm when it is done. We aim to complete this within 30 days.
• Get a copy of your data: email the same address and ask. We will send you what we hold, in a readable format, at no charge.

If you are unhappy with how we handled a privacy request, you can complain to the Office of the Privacy Commissioner of Canada (opens in a new tab).

9. How we protect it

• All traffic is encrypted in transit over HTTPS.
• The database enforces row-level security, so an account can only reach its own records even if the application layer were bypassed.
• Every form submission is validated on the server. Ownership and administrator status are derived from the verified session, never from anything the browser sends.
• Uploaded images are checked by their actual file bytes rather than their filename, and their metadata is stripped.
• Sensitive actions are rate-limited. There are no passwords to leak.

No system is perfectly secure. If we ever discover a breach that creates a real risk of significant harm, we will notify affected users and the Privacy Commissioner, as PIPEDA requires.

10. Children

The Site is for post-secondary students and is not directed at children under 16. If you believe a younger person has created an account, contact us and we will remove it.

11. Changes

If this policy changes, the “last updated” date at the top changes with it. For a change that materially affects your privacy, we will flag it on the Site rather than quietly swap the text.