Privacy Policy

PLEASE READ THIS PRIVACY POLICY CAREFULLY

1. General

This Privacy Policy describes how UoSwap (“UoSwap”, “we”, “us”, or “our”) collects, uses, discloses, retains, and protects personal information in connection with the UoSwap mobile applications, the UoSwap website, the administrative dashboard made available to participating institutions, and all related features and services (collectively, the “Services”).

UoSwap is the organization accountable for the personal information described in this Policy, except in respect of the Lost and Found service, where the participating institution is accountable as described in Section 4.

By creating an account or otherwise using the Services, you consent to the collection, use, disclosure, and retention of your personal information as described in this Policy. Where you provide information about another person, you confirm that you are authorized to do so.

Not all features described in this Policy are available to every user. Some are offered only at participating institutions, and some are made available progressively. Provisions describing a feature that is not available to you do not apply to you.

2. Information We Collect

We collect the following categories of personal information.

2.1 Information you provide

• Registration and profile information, including your name, institutional email address, credentials, institution, program and year of study, general location, and any optional profile image or description you choose to add.
• Listing and transaction information, including the descriptions, categories, prices, course or product identifiers, and images you submit, and the records of items you mark as sold.
• Communications, including messages you exchange with other users, and your correspondence with our support team.
• Lost and Found submissions, including the identifying and descriptive information required to establish ownership of an item. See Section 4.
• Carpooling information, including the origin and destination you select, travel times, seat availability, the cost share you set, and any optional vehicle description you provide.
• Optional preference information, including a gender identity you may choose to record. This information is optional, may be changed or removed at any time, and is used solely to operate the safety preference described in Section 3. It is not used for advertising or for any other purpose.
• Ratings, feedback, and reports, including ratings you leave for other users, users you block, and reports you submit about content, conduct, or safety.

2.2 Information collected automatically

• Device and technical information, including device type and model, operating system, and application version. We also store the push notification token issued by your device's operating system, which identifies your installation so that notifications reach the right device. We do not collect or store your IP address.
• Usage information. We do not operate general analytics or behavioural tracking in the application, and we do not build a profile of how you use it. Searches you run are sent to our search provider in order to return results. We count how many times each listing has been opened, how long it has been listed, and how many conversations it has started, and we show those totals to the person who posted it. Those counts are totals only and do not record who viewed a listing.
• Diagnostic information, including technical reports generated when the application encounters an error, which describe the error and the device and application state at the time. These reports are built to record what failed rather than who it failed for: we never attach your name, email address, or account identifier to them, and they are not used to identify you. A technical error message may occasionally contain an internal system identifier, which is why we do not treat these reports as anonymous.
• Preference information, including your selected language, so that communications reach you in English or French.

2.3 Information we do not collect

The Services do not request access to, collect, or track the geographic location of your device. We do not use GPS, do not collect location in the background, and do not record where you are when you use the Services. Place information used in carpooling is limited to locations you enter and select yourself, and is recorded at an approximate level of detail sufficient to match travel routes.

We also do not collect or store your IP address. As with any internet service, your IP address is necessarily visible to the providers that carry and serve your traffic, and an approximate region can be inferred from it. Our advertising network may do so, as described in Section 6. That is not device location, we do not receive it, and we do not combine it with your account to determine where you are.

3. How We Use Your Information

We use personal information for the following purposes:

• to establish, maintain, and secure your account, and to verify your student status;
• to operate the Services, including publishing your listings, enabling search and discovery, facilitating communications between users, operating the Lost and Found service on behalf of participating institutions, and operating carpooling, including the optional preference by which a user may choose to see rides offered by women and non binary drivers first;
• to calculate and display ratings and reputation information;
• to process payments for optional paid features, through our payment processor;
• to send you service communications by in-app notification, push notification, and email, including messages, transaction and claim updates, and notices required under these policies;
• to display and measure advertising, as described in Section 6;
• to maintain, secure, and improve the Services, including diagnosing defects and developing new features;
• to produce statistical and analytical information in a form that does not identify any individual;
• to detect, investigate, and prevent fraud, abuse, prohibited activity, security incidents, and breaches of our Terms of Use; and
• to comply with applicable law and to establish, exercise, or defend legal claims.

We will not use your personal information for a materially different purpose without first obtaining your consent, except where permitted or required by applicable law.

4. Lost and Found

Where a participating institution operates a Lost and Found service using the Services, UoSwap acts as a service provider to that institution. The institution determines the purposes for which Lost and Found information is collected and the period for which it is retained. UoSwap may hold that information, but control of it, and responsibility for it, remain with the institution. UoSwap does not use Lost and Found information for its own purposes. This arrangement is governed by a written agreement between UoSwap and each participating institution.

Ontario universities and colleges are subject to the Freedom of Information and Protection of Privacy Act, and an institution elsewhere in Canada is subject to the public sector privacy legislation of its own province. The institution's obligations under that legislation, and its own privacy policies, govern the Lost and Found information it collects through the Services. This Section concerns that information only. It does not affect our own accountability to you for the account and platform information described elsewhere in this Policy.

Information you submit in connection with a claim or a report is accessible to the personnel authorized by your institution to administer that service, and is not accessible to personnel of any other institution. Published item listings show limited information only.

Requests to access, correct, or delete Lost and Found information should be directed to the institution operating the service, or to us, in which case we will act on that institution's instructions. Section 8 describes the retention of this information.

5. Disclosure of Your Information

We disclose personal information only as described below.

• To other users. Your name, profile image, institution, program, verification status, ratings, and the content of your listings are visible to other users of the Services. Where you offer or request travel, the information reasonably necessary to arrange it, including your identity, rating, route, times, cost share, and any vehicle description, is visible to the other users concerned.
• To holders of a shared link. Listings may be shared by link. Where a listing is shared, the published information in that listing is accessible to any person holding the link, whether or not that person has an account. You should treat a shared link as public.
• To participating institutions, as described in Section 4.
• To service providers that perform functions on our behalf, including cloud hosting and storage, authentication, search indexing, payment processing, email and push message delivery, place name lookup, diagnostic reporting, and advertising. Service providers are permitted to use personal information only for the purposes for which we engage them.
• In connection with a transaction, including a financing, reorganization, merger, or sale of all or part of our business, subject to appropriate confidentiality protections.
• As required or permitted by law, including in response to a subpoena, court order, or other lawful request, to cooperate with law enforcement or a regulatory authority, or where we consider disclosure necessary to investigate a suspected breach of our Terms of Use, to protect the safety of any person, or to establish, exercise, or defend legal claims.

We do not sell or rent personal information. We do not disclose records identifying which user purchased which item to any third party, and such records are not visible to any user other than the parties to that transaction.

We may produce, publish, and commercially use statistical information derived from activity on the Services, including typical price ranges and category level trends. Such information is produced only in aggregate form and only where the underlying number of transactions is sufficient that no individual can reasonably be singled out, and it contains no names, email addresses, student identifiers, or other direct identifiers. We describe this information as de-identified rather than anonymous, because de-identification reduces the risk of re-identification without eliminating it.

6. Advertising

The Services display advertising delivered by third party advertising networks. Those networks, and not UoSwap, select the advertisements shown to you.

To deliver, limit the repetition of, and measure advertising, an advertising network may collect or receive technical and device information, including device and advertising identifiers made available by your device, your approximate region as derived from your IP address, and records of the advertisements displayed to you or with which you interacted. Advertising networks may combine that information with information they hold from other sources, in accordance with their own privacy policies.

We do not disclose your name, email address, institution, student identifier, messages, Lost and Found information, travel information, or any optional preference information to advertising networks.

Your device settings allow you to limit advertising personalization and to reset or restrict access to your advertising identifier. Where applicable law or platform policy requires your permission before an identifier may be used to track you across the applications and websites of other organizations, that identifier is not used for that purpose unless you have given that permission.

7. Your Rights and Choices

• Access and correction. You may access and correct your profile information within the Services. You may also request access to the personal information we hold about you, and we will respond within thirty days of receiving your request, or within any shorter period required by applicable law. Where we require more time, we will tell you before that period expires and explain why. We may decline a request in the limited circumstances permitted by law, including where disclosure would reveal personal information about another individual, and we will explain the reason for any refusal.
• Optional information. You may remove optional profile information, including any gender identity, vehicle description, image, or description, at any time without affecting your access to the Services.
• Deletion and withdrawal of consent. You may delete your account within the Services or by contacting us. Deletion removes your account, your profile, your listings, your favourites, your conversations, and your ratings from our active systems. Residual copies may persist for a limited period in routine system backups and technical logs. We do not use those copies to restore deleted content, access to them is restricted, and they are overwritten in the ordinary course of our backup cycle. Our Terms of Use describe the corresponding limits on the content licence you grant us. You may withdraw your consent to our processing of your personal information at any time, subject to legal and contractual restrictions and on reasonable notice; withdrawing consent may mean we can no longer provide some or all of the Services to you.
• Communications. You may manage notifications in the Services and in your device settings. We may continue to send communications necessary to administer your account, your transactions, and these policies.
• Lost and Found information. See Section 4.
• Complaints. You may raise a concern with us at studentservice@uoswap.ca, and we will respond. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the privacy regulator of your province. A question concerning Lost and Found information held by a participating institution may also be directed to that institution.

We may require information sufficient to verify your identity before acting on a request.

8. Protection and Retention

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, including encrypted transmission and storage, authenticated access, role based access restrictions for institutional personnel, server side access controls subject to automated testing, and automated measures to detect and prevent abuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Some of our service providers store or process personal information outside Canada, including in the United States. Where that is the case, the information remains subject to this Policy and we require comparable protection by contract, and it is also subject to the laws of the country where it is held.

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, and thereafter only as long as permitted or required by applicable law, including for the purposes of resolving disputes, enforcing our agreements, and meeting legal, audit, and reporting obligations. Where personal information is no longer required for any such purpose, it is deleted or rendered no longer capable of identifying an individual.

In respect of Lost and Found information, and in addition to the above, records relating to a claim or report are retained for six months after it is concluded, meaning the item was returned or the claim or report was refused or withdrawn, and are then deleted by a scheduled process that runs monthly. Deletion therefore occurs within approximately one month after the end of that six month period. Identifying information recorded when an item is returned is removed on the same basis. Records of items held by an institution belong to that institution and are retained according to its own requirements. A claim or report that is still open is not deleted while it remains open.

Breaches. Where a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you and report the breach to the Office of the Privacy Commissioner of Canada, and to any other regulator to which we are required to report, as soon as feasible in the circumstances. We maintain a record of every such breach, whether or not it is notifiable, for the period required by applicable law. Where a breach concerns Lost and Found information, we will also notify the institution responsible for it.

9. Children’s Privacy and Eligibility

The Services are intended for students of post secondary institutions, and registration requires verification of an institutional email address. The Services are not directed to, and we do not knowingly collect personal information from, individuals under the age of sixteen. If we become aware that we have collected personal information from such an individual, we will delete it.

10. Changes to This Policy

We may amend this Policy from time to time. The effective date appears at the top of this page. Where we make a material change, we will provide notice by a prominent notice within the Services or by other reasonable means, and, where required, will ask you to accept the amended Policy before continuing to use the Services. An amended Policy takes effect when you next use the Services after notice is given or thirty days after notice is given, whichever is earlier. Your continued use of the Services after that date constitutes your acceptance of the amended Policy.

---

Last updated: September 19, 2026. See also our Terms of Use.