CampuStitch
CampuStitchPakistan
University Student SuperApp

Privacy Policy & Data Safety

Your privacy and student data security are paramount. This policy discloses how CampuStitch collects, verifies, protects, and handles personal data across our Android mobile app and web platform.

Last Updated: October 2026•GDPR, PECA (Pakistan), & Google Play Compliant

1. Overview & Data Controller

CampuStitch ("we", "us", "our") is the data controller for the CampuStitch mobile application and web portal. Our platform provides verified student utilities (carpooling, peer marketplace, campus student services, and student communities) for universities in Pakistan.

We operate under a strict Privacy-by-Design ethos: student information is strictly scoped to your verified university campus, protected with encryption, and never shared or sold to advertising brokerages.

2. Information We Collect

To provide authentic campus services and fulfill Google Play Developer requirements, we collect the following categories of data:

A. Student Profile & Affiliation

Full name, email address, password hash (bcrypt), degree program, student roll number, University ID, and Campus ID.

B. User Content & Activity

Marketplace listing photos and descriptions, carpool routes and pickup locations, campus student service listings, community forum discussions, upvotes, and direct chat messages between students.

C. Device & Security Telemetry

Device model, operating system version, app version, IP address, and session tokens to secure accounts against credential stuffing and unauthorized account access.

3. Device Permissions & Camera Use (Google Play Disclosure)

In accordance with Google Play Developer Policies, we explicitly disclose why specific Android permissions are requested:

  • Camera Permission (android.permission.CAMERA): Required to photograph items for student marketplace listings and update profile avatars. The camera is never accessed in the background or without user initiation.
  • Storage / Media Images (android.permission.READ_MEDIA_IMAGES): Required solely to allow you to upload images for marketplace listings or profile pictures from your photo gallery.
  • Location Permission (Optional): If enabled, used solely to compute distance and convenient meeting or pickup spots for campus carpools.

4. How We Use Your Data

We process your information strictly for the following purposes:

  • Authenticating your student account and issuing cryptographic JWT session tokens.
  • Displaying campus-isolated carpools, second-hand books, and campus services.
  • Enabling student-to-student messaging for coordinating rides and book purchases.
  • Moderating forum content to prevent harassment, fraud, and academic dishonesty.

5. Campus Scoping & Data Security

CampuStitch implements strict Campus Data Isolation. Every record is indexed with a mandatory campus scope:

  • Students from UET Lahore cannot view, query, or interact with private student records, ride schedules, or KYC queues of NUST or FAST students.
  • Campus Administrators are legally restricted to moderating solely their designated university campus.
  • All network transmissions utilize TLS 1.3 encryption. Passwords are salted and hashed using bcrypt.

6. Third-Party Infrastructure & No Sale of Data

We do NOT sell, rent, or trade your personal information with data brokers or advertising networks.

We utilize select, industry-standard infrastructure sub-processors strictly to deliver app functionality:

  • Cloud Database Infrastructure: Secure encrypted relational data storage with role-based access control.
  • Cloudinary: Secure CDN for student ID cards and listing photo uploads.
  • Nodemailer: One-Time Password (OTP) verification email dispatch.

7. Account & Data Deletion Policy (Google Play Mandate)

In accordance with Google Play's Account Deletion Policy, users have the absolute right to delete their account and all associated personal data permanently without hindrance:

Option 1: In-App Deletion

Open the CampuStitch mobile app ➔ Navigate to Profile ➔ Tap Account Settings ➔ Select Delete Account & Data.

Option 2: Web Deletion URL

Submit a deletion request via our dedicated public portal without needing to reinstall the app:

Go to campus-stitch.com/delete-account
Data Purged Upon Deletion: Full account profile, email, hashed credentials, student card photos, KYC live selfie biometric images, active marketplace listings, carpool schedules, and chat history are permanently scrubbed from our production databases within 30 days.

8. Children's Privacy

CampuStitch is designed exclusively for university and college students aged 17 and older. We do not knowingly collect personal data from children under 13. If you believe a minor has registered without authorization, please contact us for immediate account purging.

9. Contact & Data Protection Officer (DPO)

For privacy inquiries, GDPR/PECA data access requests, or regulatory questions:

Data Protection Officer: CampuStitch Information Security Office
Email: hammadismail807@gmail.com
Location: Lahore, Pakistan