Privacy Policy

Chapter is operated by Chapter Technologies Limited (Companies House No. 14743161), registered at 2 Marston Brook, Hilton, Derbyshire DE65 5HS, United Kingdom. We act as the data controller for personal data processed via the Chapter app.

Privacy contact: [email protected].

1. 2.1 Minimum Age. The Service is intended for individuals 16 years and older. We do not knowingly collect personal data from children under 16.
2. 2.2 Misrepresentation. If we become aware that an under-16 has provided personal data, we will delete it promptly.

1. 3.1 Account Data: name, email, hashed password, date of birth for age verification, settings.
2. 3.2 University Journey Data: course interests and selections, accommodation preferences, societies, events followed, onboarding responses you provide.
3. 3.3 User-Generated Content (UGC): messages, posts, chats, photos, comments, ratings, polls, uploads.
4. 3.4 Device & Usage Data: device model, OS, app version, crash logs, diagnostics, usage analytics (Mixpanel).
5. 3.5 Location (optional): approximate or precise location when permitted for maps and nearby features.
6. 3.6 Notifications (optional): device tokens via Firebase/APNs to deliver push notifications.
7. 3.7 Support Data: information you provide when contacting support.
8. 3.8 Special Category Data: not intentionally collected. If users choose to post sensitive data (e.g., wellbeing), we process it only to operate and secure the Service and discourage public disclosure.

1. 4.1 Directly from You: account creation, onboarding, UGC, support requests.
2. 4.2 Automatically: device/usage data, analytics, diagnostics.
3. 4.3 Consent-based: location and notifications via system permissions you can change at any time.

1. 5.1 Contract/Legitimate Interests: operate the Service; authenticate users; enable features (course matching, accommodation search, societies/events, chats and forums); moderation and safety; debugging and improvement.
2. 5.2 Consent: location services, push notifications, and other optional features where required by law; you may withdraw consent at any time.
3. 5.3 Legal Obligation: compliance with laws, regulations, and lawful requests.

1. 6.1 Provide/Personalise: courses, accommodation, societies/events, maps.
2. 6.2 Communication: group chats, forums, notifications (when enabled).
3. 6.3 Safety: moderation, fraud and abuse prevention.
4. 6.4 Sponsored Placements: clearly labelled listings from universities, accommodation providers, or student businesses. No personalised ads at this time.
5. 6.5 Analytics & Improvement: Mixpanel and diagnostics for quality and performance.
6. 6.6 Compliance: legal obligations and rights enforcement.

We may share personal data with:

1. 7.1 Processors: Supabase (hosting/auth/DB/ storage), Cloudflare (CDN/images/DNS/security), Firebase/APNs (notifications), Mapbox (maps/geolocation), Mixpanel (analytics); each bound by contract to process only per our instructions.
2. 7.2 Sponsorship Partners: universities, accommodation providers, student-focused companies for clearly labelled sponsored placements; not for personalised ads.
3. 7.3 Legal/Protection: where required by law, to protect rights, users, or the Service.

7.4 No Sale: we do not sell personal data.

Where personal data is processed outside the UK/EEA, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or adequacy decisions, as applicable.

1. 9.1 Principle: retain only as long as necessary for the purposes described or as required by law.
2. 9.2 Account Deletion: we delete or anonymise personal data upon account deletion, subject to legal, security, and anti-fraud obligations.
3. 9.3 Illustrative Examples: basic account and log data may be retained for a limited period for security, auditing, and legal compliance.

1. 10.1 Measures: appropriate technical and organisational measures proportional to risk, including encryption in transit, access controls, and secure hosting.
2. 10.2 No Absolute Guarantee: no system is 100% secure; we continuously improve safeguards.

1. 11.1 Sponsored/Featured: clearly labelled placements from universities, accommodation providers, or student businesses.
2. 11.2 No Personalised Ads: if introduced in future, we will provide notice and obtain consents where required.

1. 12.1 Analytics: Mixpanel and diagnostic SDKs measure usage and performance.
2. 12.2 Controls: you can adjust device or in-app settings to limit analytics, notifications, or location (where available).

1. 13.1 UK/EU GDPR: rights to access, rectification, erasure, restriction, objection (including to profiling), portability, and to withdraw consent at any time.
2. 13.2 Global Users: we consider comparable rights under applicable local laws where you reside.
3. 13.3 Exercising Rights: contact [email protected]. We will respond within statutory timeframes.
4. 13.4 Complaints: UK residents may contact the Information Commissioner’s Office (ICO).

Although the Service is 16+, we align with the UK Age Appropriate Design Code principles: high privacy by default, data minimisation, and avoiding nudges to overshare.

The Service may link to or integrate third-party platforms (e.g. ticketing or accommodation providers). Their privacy practices apply; review their notices before sharing data.

1. 16.1 Territorial Scope: the Service is focused on UK universities; students globally may use it.
2. 16.2 Applicable Law: we primarily apply UK GDPR and, where relevant, EU GDPR; other local laws may also apply depending on your residence.

We may update this Privacy Policy from time to time. Material changes will be notified in-app or via email. Continued use after the effective date constitutes acceptance.