Privacy Policy

This Privacy Policy explains how UNIPIA Ltd ("UNIPIA", "we", "us", "our") collects, uses, discloses, and protects your personal data when you use the UNIPIA application (a study planner, timetable, anonymous department community, anonymous question box and record for UK university students) and related services (the "Service").

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Data Controller

UNIPIA Ltd is the data controller responsible for your personal data.
Contact: info@unipia.business

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Account Information

Name, email address (including your university email used for verification), date of birth (to confirm you are 18 or over), profile photo (optional), university and department. We verify your university by sending a code to your university email address; the code is held in memory for up to 30 minutes and is not stored after verification.

Accounts created from the web. If your first contact with UNIPIA is asking a question in someone's question box on our website, we create an account for you at the moment you verify your university email. That account holds your university email, the university we matched from its domain, and the question you sent. It has no password; you sign in to the app with the same email using Google or Apple sign-in. If you never install the app, the account stays dormant and you can delete it at any time from unipia.co.uk/delete-data.

2.2 Study Data

The modules you add, your class times and rooms, deadlines and assignments you record, their status (to do, in progress, done, completed on time or late), and any links or notes you attach to them. This data builds your personal Record, which only you can see unless you choose to export or share it.

You can export your Record at any time. An export contains only your own study data: the modules you added, each deadline with its date, status and whether it was completed on time, and any links or notes you attached. Exports are produced at your request and are yours to share or keep.

2.3 Community and Chat Data

Posts, replies, votes and event sign-ups in the community, and messages you send in your department chat or focus room. Community posts show your university name, not your personal name. Department chat and focus-room messages are shown without your name and are deleted automatically at midnight (UK time) on the day they are sent; notices that classmates confirm may be kept pinned until they expire.

Anonymous to other students, accountable to us. Anonymity applies to what other users see. Behind the scenes, every post, reply and chat message stays linked to the verified account that sent it. We use that link only to investigate reports, enforce our Terms and Community Guidelines, and respond to lawful requests. If a message is reported, we keep that message and its link to your account long enough to review the report and to deal with any appeal, and no longer than 30 days, which covers the 24-hour review and the 14-day appeal window set out in our Community Guidelines. Messages that are not reported are deleted on the normal schedule, and the link to your account goes with them.

2.4 Question Box Data ("Ask")

A question box lets a verified student (the host) receive anonymous questions from other verified UK students (askers) through a link they share, for example on Instagram.

If you host a box, we store the handle you choose (this becomes part of your public link, so it is visible to anyone who has the link), your prompt, whether the box is open, your answers, and the questions you ignore, report or block.

If you ask a question, we store the question text, the optional hint you write about yourself (up to 40 characters), the time it was sent, and the account it came from. The host sees only the question and your hint, never your name, email or university. Your identity is held by UNIPIA alone, for the purposes in section 2.3 (investigating reports and enforcing our Terms), and is not shown to the host, in the app, or on any shared card.

Answer cards. When a host answers, the app creates an image containing the question text, the answer, the host's handle and UNIPIA branding, which the host may share outside the Service (for example as an Instagram story). Your hint is included on that card only if you chose to make it public when asking. Once shared outside the Service, the card is governed by that platform's terms and we cannot recall it.

Instagram and other platforms. We do not connect to Instagram or use its API. Sharing uses your device's standard share sheet, and we receive no data from Instagram about who viewed or tapped a link.

2.5 Presence Data ("Live")

If you choose to set a status (in class, library, focusing, free), we store that status and show it to your department only as an aggregated count. We do not show who set which status, and we hide counts for departments with fewer than 10 active members. Your status is cleared automatically each day. We do not use your device location.

2.6 Usage Data

Device identifiers (IDFA, AAID), IP address, app version, operating system, time zone, language, in-app activity, crash reports, and analytics data.

2.7 Communication Data

Push notification tokens (Firebase Cloud Messaging), email correspondence with our support team.

2.8 Payment Data

In-app purchase records (we do not collect or store payment card details; these are handled by Google Play and Apple App Store).

3. Legal Bases for Processing

We process your personal data on the following legal bases:

• Contract: to provide the Service you have requested, including creating your account when you verify your email to send a question, delivering your question to the host, and telling you when it is answered;
• Legitimate Interest: to operate, secure, improve, and personalise the Service, prevent fraud, and enforce our Terms. In practice this covers: keeping the Service running and backed up; investigating reports and removing content that breaches our Guidelines; blocking spam, bots and duplicate accounts; measuring which features are used so we can improve them; and defending legal claims. We balance these against your rights and you can object at any time (see section 8);
• Consent: for optional features such as push notifications, sharing your Live status, and marketing communications (you may withdraw consent at any time);
• Legal Obligation: to comply with applicable laws and regulations.

4. How We Use Your Personal Data

• To create and manage your account and verify your university affiliation.
• To provide, maintain, and improve the Service.
• To provide your timetable, deadlines and Record, and to let you share a deadline with a classmate by link when you choose to.
• To enable community features (posting, replies, department chat, focus rooms, question boxes and aggregated Live status).
• To notify a host when a question arrives and, where you asked a question, to email you at your university address when it is answered. These are service messages, not marketing.
• To send push notifications, transactional emails, and service announcements.
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• To enforce our Terms of Service and Community Guidelines.
• To comply with legal obligations and respond to lawful requests from authorities.
• To deliver advertisements (we use Google AdMob; you can opt out of personalised ads in your device settings).

5. Disclosure of Personal Data

We do NOT sell your personal data. We may share your data with:

5.1 Service Providers

Cloud hosting (AWS), authentication (Firebase Auth), analytics (Google Analytics, Firebase), advertising (AdMob), push notifications (FCM), payment processing (Google Play, Apple).

5.2 Legal Authorities

When required by law, court order, or to protect our rights, property, or safety.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.

5.4 Your Record

We do not share your Record, your modules, your deadlines or any export of them with employers, universities, recruiters, advertisers or any other third party. If we ever offer a feature that sends your Record to someone else, it will be entirely optional and will ask for your explicit consent first, naming who receives it and what it contains. You will be able to withdraw that consent at any time.

5.5 Other Users

Community posts and replies are visible to other verified users with your university name (not your personal name). Department chat and focus-room messages are visible to members of the same department without your name. A question you send is visible to the host without your name, and the question text may appear on an answer card the host shares publicly. Your study data and Record are private to you unless you share a deadline by link or export your Record.

6. International Data Transfers

Some of our service providers are based outside the United Kingdom. When transferring data internationally, we use appropriate safeguards such as Standard Contractual Clauses and adequacy decisions to ensure your data remains protected.

7. Data Retention

7.1 Account data is retained for as long as your account is active.

7.2 If you delete your account, your personal data will be deleted within 30 days, except where retention is required by law (e.g. financial records up to 7 years). Where we keep aggregate figures (for example how many people were active in a department), we strip out every identifier first, so the remaining data cannot be linked back to you by us or by anyone else, and cannot be reversed.

7.3 We keep automated database backups for 7 days on a rolling basis, so a copy of your data may remain in a backup for up to 7 days after you delete it. Backups are encrypted and are only ever used to restore the Service after a failure.

7.4 Department chat and focus-room messages are deleted at midnight (UK time) on the day they are sent. Live status is cleared daily.

7.5 Question box data: questions and answers are kept while the host's box exists so the host can see their history. A question the host ignores is deleted 30 days after being ignored. A reported question is handled as in section 2.3. Blocks are kept for as long as the host keeps them. If a host closes or deletes their box, its questions are deleted within 30 days; the link between a question and the asker's account goes with it.

7.6 If we update these terms or this policy in a way that requires your renewed agreement and you do not agree within 30 days of being asked, your account will be paused and then deleted in line with section 7.2.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: request a copy of your data;
• Right to Rectification: correct inaccurate data;
• Right to Erasure: request deletion of your data;
• Right to Restriction: limit how we process your data;
• Right to Data Portability: receive your data in a structured, machine-readable format;
• Right to Object: object to processing based on legitimate interest or for marketing;
• Right to Withdraw Consent: for any consent-based processing;
• Right to Lodge a Complaint: with the Information Commissioner's Office (ICO) at https://ico.org.uk/.

To exercise your rights, contact info@unipia.business. We will respond within one calendar month.

9. Cookies and Similar Technologies

The Service uses minimal device-level identifiers required for core functionality. We do not use browser cookies in the mobile app. Web-based admin interfaces may use functional cookies only.

10. Children's Privacy

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we discover such data, we will delete it promptly.

11. Security

We implement appropriate technical and organisational measures including encryption in transit (TLS), access controls, role-based permissions, and regular security audits. However, no system is completely secure; you use the Service at your own risk.

If a personal data breach occurs, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it where the law requires, and we will tell affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Our notice will describe what happened, what data was involved, what we are doing about it, and what you can do.

12. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties; please review their respective privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted within the app and on this page with a new "Effective Date".

Material changes (including any change to the purposes for which we use your data, such as the September 2026 change from a general community app to a study app with anonymous community and question-box features) are not accepted by continued use. We will ask you to read and explicitly agree to the updated policy and Terms in the app, with no boxes pre-ticked. If you do not agree within 30 days, your account is paused: nothing new is collected and you cannot post. A paused account is deleted 30 days later as described in section 7.2. We email your university address 7 days and 1 day before each of those dates. You can agree at any point before deletion, or delete the account yourself sooner.

14. Contact Us