This Privacy Policy explains how SocialXchange ("the App", "we", "us", or "our") collects, uses, stores, shares, and protects information when you use the application. Please read it carefully. By using SocialXchange, you agree to the practices described in this Privacy Policy.
1. Scope of This Privacy Policy
This Privacy Policy applies to personal information processed through the SocialXchange application and its supporting backend services. It does not apply to third-party services that you access independently of SocialXchange; those services have their own privacy policies and terms.
2. Application Overview
SocialXchange enables verified university students to interact with one another. Its features include:
- Marketplace listings — create, browse, comment on, reply to, and save item listings;
- Lost & Found posts — report and browse lost or found items;
- Order posts — post group-order requests (e.g. items to be brought from another destination);
- User profiles — a student profile with a photo and basic information;
- Direct messaging — one-to-one conversations between users;
- Announcements — informational posts published by the App administrators.
Users are responsible for the content they submit and for their interactions with other users.
3. Information We Collect
We collect and process only information reasonably necessary to provide, secure, maintain, and improve the App.
3.1 Account and Authentication Information
Access to SocialXchange requires authentication with a university-provided Microsoft account. Authentication is performed using the Microsoft Authentication Library (MSAL) integrated directly into the App. The App verifies, through our secure backend, that the Microsoft account belongs to the IUS school directory before granting access. We process:
- Your full name;
- Your university email address;
- Microsoft/Azure directory identifiers contained in the authentication token (such as your directory tenant and object identifiers);
- An internal user ID generated for your SocialXchange account.
SocialXchange does not use Sign in with Apple or Sign in with Google.
3.2 Profile Information
Your SocialXchange profile may include:
- Name and university email address;
- Profile photograph (either one you upload, or, as a fallback, your Microsoft account photo);
- Faculty, graduation year, preferred language, and meet-up preference;
- Your notification preferences.
You choose what optional profile information to provide.
3.3 User-Generated Content
SocialXchange lets you create and submit content, which may include:
- Marketplace listings, descriptions, and photographs;
- Comments and replies on listings;
- Lost & Found posts and photographs;
- Order posts;
- Profile photographs;
- Chat messages.
Depending on the feature, user-generated content may be visible to other authorized users of the App.
3.4 Photos and Media
SocialXchange requests access to your camera and photo library only when you choose to take or select a photo for a listing, a Lost & Found post, or your profile. The App does not access your photo library unless you actively select or capture media through its functionality. Photographs are stored in our backend storage and are not used for advertising or facial-recognition purposes.
3.5 Messages and Communications
Messages you send through the App are stored on our backend so the messaging feature can function. Messages are processed to deliver communications, generate notification previews, screen content for safety (see Section 4), maintain security, investigate reports of abuse, and comply with applicable legal obligations. Messages are not end-to-end encrypted. They are protected in transit and at rest by our infrastructure provider, and may be accessible to authorized personnel or automated systems where reasonably necessary for the purposes described in this Policy. Messages are not used for targeted advertising.
3.6 Reminders
If you tap "Remind me" on an announcement, the App will — with your permission — create a reminder in your device's Apple Reminders app. This uses Apple's on-device Reminders functionality. We do not upload the contents of your Reminders app to our servers; only your in-app opt-in is stored.
3.7 Push Notifications
SocialXchange uses the Apple Push Notification service (APNs) to deliver notifications about messages, comments, and saves. To do this, we store your device's push token together with your user ID and platform information. You can disable notifications at any time in your device settings.
3.8 Technical, Security, and Log Information
When you use the App, our infrastructure and service providers may automatically process technical and security information, which may include your IP address, authentication logs, request metadata, error information, and basic device or connection information necessary to operate and secure the service. This information is used for authentication, security, abuse and fraud prevention, and service reliability. It is not used for behavioral advertising or cross-app tracking.
3.9 Information We Do Not Collect
SocialXchange does not collect or request:
- Precise GPS or location data;
- Access to your contacts or address book;
- Microphone or audio recordings;
- Financial account, banking, or payment-card information (the App does not process payments — any exchange between students happens independently of the App and is the users' responsibility);
- Advertising identifiers, or any data used for targeted advertising or cross-app tracking.
4. Automated Content Screening
To keep the community safe and comply with App Store requirements for user-generated content, text that users submit may be sent to Microsoft Azure AI Content Safety and Microsoft Azure Translator for automated screening. These services classify content for categories such as hate, self-harm, sexual, and violent content, and translate text where needed to perform that screening. This automated processing helps us detect and block objectionable content.
5. How We Use Personal Information
We use personal information to:
- Create and maintain accounts and authenticate users;
- Verify eligibility for access to the IUS student community;
- Provide the marketplace, Lost & Found, order-post, profile, messaging, and announcement features;
- Store and display user-generated content and photographs;
- Deliver notifications;
- Provide security, and detect, investigate, and prevent abuse, fraud, and unauthorized access;
- Respond to reports and complaints, moderate content, and enforce our Terms of Use and community rules;
- Maintain and secure our infrastructure and diagnose technical problems;
- Comply with legal obligations and respond to lawful requests from authorities where required;
- Protect the rights, safety, and security of users and the service.
6. Legal Bases for Processing (GDPR)
Where the EU General Data Protection Regulation (GDPR) or similar law applies, we rely on one or more of the following legal bases:
- Performance of a contract — to provide the features you request, including account creation, authentication, and communication;
- Legitimate interests — for security, fraud and abuse prevention, moderation, service reliability, and protecting users, where not overridden by your rights;
- Consent — where processing legally requires it (for example, device permissions you grant); you may withdraw consent where applicable, without affecting prior lawful processing;
- Legal obligations — where we must process or retain information to comply with law.
7. User-Generated Content and Community Safety
SocialXchange contains user-generated content and social functionality. You are responsible for the content you submit and must comply with our Terms of Use & EULA, community rules, and applicable law.
The App provides tools to report inappropriate content or users, and to block other users. You must also accept our End-User License Agreement (EULA), which prohibits objectionable content and abusive behavior, before using the App.
We review reports of objectionable content and act within 24 hours by removing the content and ejecting the user who provided it. We may restrict, remove, or disable access to content or accounts, and may suspend or permanently terminate accounts, to enforce our rules, respond to reports, prevent abuse, protect users, investigate security incidents, or comply with law. To report content or appeal an action, contact us in the App under Profile → Help & Support or by email at rebucate@gmail.com.
8. Third-Party Service Providers
We use selected third-party service providers to operate the App. They may access information only as necessary to provide their services, maintain security, or comply with law.
8.1 Supabase
We use Supabase for backend infrastructure, including authentication, a PostgreSQL database, file/object storage, and server-side (Edge) functions. Information processed through Supabase may include account and authentication information, user IDs, university email addresses, profiles, listings, Lost & Found posts, order posts, comments, photographs, messages, notifications, and technical and security information (such as IP addresses and logs). Supabase may use subprocessors and cloud infrastructure providers to deliver its services.
8.2 Microsoft
We use Microsoft for two purposes:
- Authentication — via Microsoft/Azure Active Directory (Entra ID) and the Microsoft Authentication Library (MSAL), restricted to the IUS directory;
- Content screening — via Microsoft Azure AI Content Safety and Azure Translator, as described in Section 4.
Microsoft processes information in accordance with its own privacy practices, which we do not control.
8.3 Apple
SocialXchange is distributed through Apple's App Store and uses Apple's Push Notification service (APNs). Apple may process information relating to app installation, diagnostics, and notification delivery according to Apple's own terms and privacy policy, which we do not control.
8.4 International Data Transfers
Because we use third-party infrastructure, personal information may be processed or stored outside Bosnia and Herzegovina and outside the country in which you reside. Where applicable law requires safeguards for international transfers, we seek to rely on legally recognized transfer mechanisms and appropriate contractual safeguards.
9. Analytics, Crash Reporting, and Advertising
SocialXchange does not integrate third-party analytics platforms (such as Google Analytics, Firebase, Mixpanel, PostHog, Amplitude, or Segment), third-party crash-reporting SDKs (such as Crashlytics, Sentry, or Bugsnag), or any advertising or attribution SDKs. The App displays no third-party advertisements and does not sell personal information or use it for targeted advertising. Apple may provide us with aggregate or diagnostic information through its own App Store and operating-system mechanisms, subject to your device settings.
10. Data Sharing
We do not sell personal information. We share or permit access to information only where reasonably necessary for providing App functionality, authentication, hosting, storage, security, abuse prevention, moderation, technical support, legal compliance, protecting users and the service, or in connection with a corporate transaction if one occurs. We do not share personal information with advertisers for targeted advertising.
11. Public and Private Content
Some information you submit may be visible to other users — for example, marketplace listings, Lost & Found posts, order posts, profile information, and associated photographs. Please avoid publishing sensitive personal information in areas visible to others. Direct messages are intended to be private between participants but may be accessed as described in Section 3.5. We cannot guarantee the confidentiality of information you voluntarily make visible to others.
12. Data Retention
We retain personal information only for as long as reasonably necessary to provide the App, maintain security, enforce our policies, resolve disputes, and comply with legal obligations. Retention periods vary with the type of information, whether your account remains active, and applicable legal requirements. Inactive conversations that all participants have hidden are automatically deleted after a period. When information is no longer required, it is deleted or anonymized. Residual copies may persist in secure backups for a limited period before being overwritten.
13. Account Deletion
You may delete your account and associated personal information at any time, directly in the App: go to Profile → Delete Account and confirm. When you delete your account, we remove the personal information associated with it — including your profile, listings, Lost & Found posts, order posts, saved items, notifications, device (push) tokens, your participation in conversations, and your authentication record. Certain information may be retained temporarily where required for legal compliance, security, fraud prevention, or dispute resolution, and residual copies may remain in secure backups for a limited period before being overwritten.
14. Data Security
We use reasonable technical and organizational measures to protect personal information, including authentication and access controls, encrypted connections (TLS), encryption of stored data by our infrastructure provider, database and storage access controls, security monitoring, and regular maintenance. No system or method of transmission is completely secure, so we cannot guarantee absolute security.
15. Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to the processing of your personal information; to data portability; to withdraw consent; and to lodge a complaint with a competent data-protection authority. Where applicable U.S. state privacy laws apply, you may have rights to know, access, correct, delete, and opt out of the sale or sharing of personal information for targeted advertising — which we do not do. To exercise any right, contact us at rebucate@gmail.com. We may need to verify your identity before responding, and some rights are subject to legal limitations and exceptions.
16. Children's Privacy
SocialXchange is intended for university students and is not directed to children. Access requires a valid IUS Microsoft account. We do not knowingly collect personal information from children in violation of applicable law. If we learn we have done so, we will take reasonable steps to delete that information.
17. Cookies and Similar Technologies
The native SocialXchange app does not use browser cookies for advertising or behavioral tracking. Our authentication and infrastructure providers may use technical mechanisms necessary for authentication, session management, security, and service operation.
18. Third-Party Links
The App may contain links or references to services operated by third parties. Those services operate independently and have their own privacy policies and terms. We are not responsible for the privacy practices of services we do not control.
19. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and, where appropriate, provide additional notice through the App or other reasonable means. Please review this Policy periodically.
20. Contact Us
For privacy questions, requests, complaints, or concerns regarding SocialXchange, contact:
- Developers: Kayra Yılmaz and İsmet Ozan Karabınar
- Country: Bosnia and Herzegovina
- Email: rebucate@gmail.com
- Privacy Policy: https://kayraobi.github.io/socialxchange-support/privacy.html
If you are exercising a legal privacy right, please clearly describe your request. We may request information necessary to verify your identity and protect your account.