Privacy policy
Last updated: September 9, 2026
Who operates this service
UniSell is an independent student marketplace. UniSell Contact: [email protected]
Information we collect
We collect the following, and nothing beyond it. We do not buy personal data, we do not enrich your profile from outside sources, and we do not track you across other websites.
| What | Why | Who can see it |
|---|---|---|
| Your UT Dallas email address | To verify inbox access and sign you in | You and the operator. Never shown to other members. |
| Authentication records and sign-in timestamps | To keep you signed in and detect abuse | The operator |
| Terms acceptance and its version and time | To record which terms you agreed to | The operator |
| Listings: title, description, price, category, condition, meetup area | To show your item on the marketplace | Signed-in, verified members |
| Photos you upload | To illustrate your listing | Signed-in members, through short-lived links. The storage bucket is private. |
| Messages between buyer and seller | To let you arrange a trade | Only the two participants, and the operator if reported |
| Reports you file, and their outcome | To moderate the marketplace | Administrators |
| Suspension status and moderation history | To enforce the rules and keep an audit trail | Administrators |
| IP addresses and technical request logs | To deliver pages and defend against attacks | Our hosting and authentication providers |
We do not collect your name, phone number, student ID, date of birth, payment details, or location beyond the meetup area you type into a listing yourself. Please do not put any of those into a listing, message, or report.
Automated decision-making and AI
UniSell does not use artificial intelligence or machine learning. Your listings, photos, and messages are not analysed by any AI system, are not used to train any model, and are not sent to any AI provider. There is no automated profiling, scoring, or content classification.
Moderation decisions — removing a listing, suspending an account — are made by a human administrator reviewing a report. The only automated rules in the service are mechanical limits: how many listings or messages an account may post in a given period, and a check that text contains no control characters. These affect whether a post is accepted, never how a person is judged.
If AI processing is ever introduced, this section will be updated to say exactly what it does and what data it receives before that processing begins.
How we use and share information
We use this data to verify inbox access, show listings to signed-in members, deliver messages, investigate reports, and protect the service. Your listing details and photos are visible to eligible members. Messages are available to conversation participants. Administrators can access reports and moderation records; authorized backend operators can access stored data for support and security. The interface does not publish your email to buyers or sellers.
Third parties we share data with
These are every external party involved in running UniSell. They act as our service providers, processing data on our instructions to operate the service — not for their own marketing.
| Provider | Role | What it processes |
|---|---|---|
| Supabase | Authentication, database, and image storage | Your email, listings, messages, photos, and access logs. Data is held in the region selected for our project. |
| Cloudflare | Website hosting, content delivery, and attack protection | IP addresses and request metadata. Sets its own security cookies — see the cookie policy. |
| Our email provider | Delivering sign-in codes | Your email address and the message containing your code. The operator must name the provider here before launch. |
| Cloudflare Web Analytics | Counting visits so we know whether the site is being used | Page visited, referring site, country, browser and device type, and page load timings. No cookies, no persistent identifier, and no profile — see below. |
We do not sell or rent your personal data, and we do not share it for advertising, cross-context behavioural advertising, or any other party’s independent purposes. There are no advertising networks, social media pixels, data brokers, or AI providers involved.
Analytics
We use Cloudflare Web Analyticsto see how many people visit and which pages they read. We are being specific about it because “we use analytics” can mean very different things.
It sets no cookies and stores nothing in your browser. It does not assign you a persistent identifier, does not follow you to other websites, and is not used to build a profile or to target advertising. Visit counts are estimated from a short-lived, non-reversible value rather than anything that identifies you. We see totals and trends, not individuals, and we cannot connect a visit to your account.
What is recorded: the page visited, the site that referred you, your country, your browser and device type, and how quickly the page loaded. Your IP address is processed to derive the country and is not stored by the analytics product for us to see.
Because Cloudflare inserts this at the network edge rather than through our code, we cannot switch it off for individual visitors. If you would rather not be counted, a content blocker or your browser’s tracking protection will stop it, and the site works normally without it.
We may disclose data where we are legally required to — a valid legal request, court order, or law enforcement demand — or where it is necessary to investigate a serious safety concern or protect someone from harm. If UniSell were ever transferred to another operator, your data would move with it and you would be told before that happened.
Your rights
You can ask us to give you a copy of your data, correct it, export it, or delete it, and you can object to or restrict how we use it. Email the address on the contact page from your UT Dallas address so we can verify the request. We will not treat you differently for exercising these rights, and we do not charge for them.
Depending on where you live, you may also have the right to complain to a data protection authority. Texas residents have rights under the Texas Data Privacy and Security Act; students in other states or countries may have rights under their own laws. We honour verified requests regardless of where you live rather than checking whether a particular law applies to you.
Cookies and browser storage
Your sign-in session is held in your browser for the current tab only and is discarded when you close it, unless you tick “keep me signed in on this device” when you sign in — so by default a session is not left behind on a shared computer. Your light/dark choice is remembered between visits only if you allow it. Sign out when you finish on a shared device. No advertising or cross-site tracking technologies are included, and the analytics we do use sets no cookies and stores nothing in your browser — see “Analytics” above. The cookie policy lists every item stored, why it is stored, and how to remove it.
Retention and your choices
Removing a listing hides it from the marketplace; it does not by itself erase the stored record or the uploaded photo. To request access, correction, export, or deletion of your data, email the address on the contact page from your UT Dallas address so we can verify the request.
When we act on a deletion request we remove your account, listings, conversations, messages, reports, and uploaded images. Moderation records are kept so the history stays auditable, with the account identifier removed so they no longer identify you. Some records may also need to be retained for legal obligations, open disputes, or security investigations.
The operator must set and publish specific retention periods here before launch, and must state how long backups and provider logs are kept, as those are held separately by our service providers.
Security and age limit
Access controls restrict marketplace data to eligible accounts and messages to their participants. No system can guarantee complete security. Do not upload sensitive documents or share passwords, financial account information, or sign-in codes. This service is for users aged 18 and older.
Updates
Material policy changes will be dated and communicated in the service. The operator must review this draft against actual practices and applicable privacy requirements before launch.