Privacy Policy
# MUNI PRIVACY POLICY
Last Updated: August 21, 2025
This Privacy Policy (the “Privacy Policy”) explains how **MUNI MARKETPLACE, LLC**, a Delaware limited liability company (“MUNI,” “we,” “our,” or “us”), collects, uses, and shares information when you access and use the MUNI platform, site, app, software, content, and all related products and services (collectively, the “Platform”).
By using the Platform, you acknowledge that you have read and understood this Privacy Policy and our Terms of Service, and you agree to the collection, use, and disclosure of information as described herein. The Platform is intended for U.S. student users with valid .edu email verification (currently supporting George Washington University and University of Virginia; others may join a waitlist). The Platform is U.S.-only.
---
## 1. Personal Information
“Personal Information” means any information from or about a person that directly identifies that person, or makes them identifiable when combined with other information.
---
## 2. Information We Collect
We collect information in three ways: (i) information you provide; (ii) information collected automatically; and (iii) information from third parties.
### 2.1 Information You Provide
The app is built on Firebase (Auth, Firestore, Storage, Cloud Functions, App Check). Depending on how you use the app, we collect:
* **Account & Profile (Firebase Auth/Firestore):** .edu email, password (handled by Firebase Auth; we never receive plaintext), display name, school/university ID/name (derived from email domain), optional phone number, optional profile photo URL.
* **Listings & Media (Firestore/Storage):** Listing details you publish (title, description, price, condition, category, type (sell/rent/sublet), availability dates, roommate preference for sublets, universityId, sellerId, status) and photos you upload. Listing images are stored in Firebase Storage and referenced by URL.
* **Wishlist (Firestore):** Items you save, including a snapshot of the listing (title, image URL(s), price, type, sellerId, universityId, status) and timestamps.
* **Messaging (Firestore):** Chats you participate in, including message text and optional listing attachments (title, image URL, price), senderId, timestamps, and per‑user unread counts/read status.
* **Reports & Safety (Firestore):** Reports you submit (type, reason, optional details, IDs involved, snapshot of the listing at report time). When you block a user, we store the block relationship and timestamp.
* **Waitlist (Firestore):** If your email domain is not currently supported, you may submit your email to the waitlist. We store your email and domain under `waitlist/{domain}/entries/{email}` and maintain a per‑domain count.
* **Support & Requests:** Content of messages you send to support.
We do not collect government IDs or other sensitive categories unless you choose to provide them (please don’t).
**Sensitive Data:** Please do not provide Social Security numbers or sensitive personal information (e.g., race, religion, health, biometrics, union membership) on the Platform.
### 2.2 Automatically Collected Information
Collected via Firebase SDKs and the app runtime:
* **Device/App Data:** App version, OS version, device model.
* **Usage/Diagnostics:** Basic feature usage and errors for debugging; server timestamps written by Firestore.
* **Network Info:** IP address is visible to our Cloud Functions (e.g., to rate‑limit verification requests and for security logging). We do not access precise GPS location.
* **Security Signals:** Firebase App Check attestation tokens to protect the backend from abuse.
### 2.3 Public or Shared Information
* **On-Platform Content:** Posts, profiles, and messages may be visible to other Users. Use caution in sharing identifying details.
* **Third-Party Services:** Links to social media or external sites may allow those services to collect or share information. Their privacy policies apply.
---
## 3. Tracking Technologies
We and service providers use SDK signals and local storage (e.g., Firebase SDK caches) to secure the app and improve performance. We do not use third‑party ad trackers in the app.
---
## 4. How We Use Information
We use Personal Information to:
1. Provide, maintain, and improve the Platform (listings, messaging, wishlist, waitlist, moderation).
2. Verify eligibility (.edu status and supported domains).
3. Personalize your experience and recommend content.
4. Communicate about features, security, and promotions (opt-out available).
5. Detect, prevent, and investigate fraud, abuse, or illegal activity.
6. Enforce our Terms of Service and resolve disputes.
7. Comply with legal obligations and respond to lawful requests.
8. Protect the rights, property, and safety of MUNI, Users, and the public.
9. Generate aggregated, de-identified, or anonymized analytics.
---
## 5. Sharing & Disclosure
We may disclose information to:
* **Other Users:** To facilitate transactions and communications.
* **Service Providers:** Firebase (Auth, Firestore, Storage, Functions, App Check), Apple frameworks, and limited analytics/hosting vendors. If in‑app payments are added later, a PSP would process payments on our behalf (we don’t store full card numbers).
* **Universities, Law Enforcement, & Regulators:** Where legally required or to protect safety.
* **Affiliates & Successors:** In connection with mergers, acquisitions, or corporate restructuring.
We do **not** sell your Personal Information. If this changes, we will update this Policy and comply with applicable law.
---
## 6. Security
We use industry‑standard safeguards and Firebase security features (App Attest/App Check, authentication, Firestore security rules, signed storage URLs). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
---
## 7. Your Choices & Rights
* **Account Settings:** You can correct or delete account information in-app or by emailing **[support@muni-marketplace.com](mailto:support@muni-marketplace.com)**.
* **Deletion:** Upon request, we will delete Personal Information within a reasonable period, subject to legal obligations.
* **Do Not Track:** We do not currently respond to browser “Do Not Track” signals.
---
## 8. California Residents (CCPA/CPRA)
California residents may exercise rights to:
* **Know** what Personal Information we collect and disclose.
* **Delete** Personal Information (with statutory exceptions).
* **Correct** inaccurate Personal Information.
* **Non-Discrimination:** We will not discriminate for exercising privacy rights.
Submit requests via **[support@muni-marketplace.com](mailto:support@muni-marketplace.com)**. We will verify identity and respond within required timelines.
---
## 9. International Use
MUNI is U.S.‑based and intended only for U.S. residents. Data is processed in the United States (primarily in Google Cloud’s us‑east4 region and other regions used by Firebase to deliver the service). By using the Platform, you consent to U.S. processing.
---
## 10. Data Retention
We retain Personal Information for as long as necessary to provide the Platform, meet legal obligations, resolve disputes, and enforce agreements. Examples:
* Listings and media: retained until you delete them or your account is deleted.
* Messages: retained to provide chat continuity unless you delete your account (some metadata may persist for fraud prevention or legal obligations).
* Reports, blocks, and moderation logs: retained as needed for community safety and legal obligations.
* Waitlist submissions: retained until your school is supported, you request deletion, or the list is no longer needed.
We then delete or de‑identify data.
---
## 11. Changes
We may update this Privacy Policy from time to time. The “Last Updated” date reflects the latest revision. If material changes occur, we will notify you by email or in-app notice where feasible. Continued use of the Platform after changes constitutes acceptance.
---
## 12. Contact
If you have questions about this Privacy Policy or our data practices:
**Email:** [support@muni-marketplace.com](mailto:support@muni-marketplace.com)
**Mailing Address:** \[Mailing Address:]
**Website:** muni-marketplace.com