Privacy Policy

What we collect

• Account details: your email address, name, username and password (stored only as a secure hash, never readable).
• Profile details you choose to add: your university, profile photo, bio, faculty and year.
• Staff verification (optional): your university staff email, role and department, if you request a staff ribbon.
• Content you create: posts and photos, comments, likes, follows, chat messages and files you send, notes you upload, reviews, and places you list.
• Location, only when you ask: if you tap "Near me" on the campus map, your phone's location is used on your device to centre the map. It is not sent to or stored on our servers. When you add a place, the map pin you choose is saved as that place's location.
• Chat backup (optional): if you turn it on, an encrypted copy of your chat keys, locked with a 6-digit PIN that only you know. We can't open it. After 10 wrong PINs it is deleted for good.
• Credentials (optional): degrees, positions, publications, awards and certifications you add to your profile, visible to other signed-in users. If you ask for one to be verified, the proof you upload (a photo or PDF) is seen only by HashZ admins and deleted as soon as it has been reviewed.
• Calls: a record of each voice or video call in the chat (who called, when, how long, and whether it was answered). We never record or store what is said or shown.
• Push token: an identifier from Google Firebase for your phone, so it can ring for incoming calls when HashZ is closed. It's deleted when you sign out.
• Technical data: sign-in sessions (so you stay logged in) and basic server logs used for security and fixing problems.

We remove hidden location data (GPS/EXIF) from every photo you upload. Photos you send in chats are cleaned on your phone, before they are encrypted.

How we use it

• To run HashZ: show your profile and posts, deliver messages, share notes and list places.
• To keep it safe: verify emails, prevent spam and abuse, review reports, and block malicious files (documents uploaded as notes are scanned for malware). Files sent in chats are end-to-end encrypted, so we can't scan them: only open files from people you trust.
• To send account emails such as verification and password-reset codes. We do not send marketing emails without your consent.

We do not sell your data and we do not show ads.

Who can see what

• Your profile, posts, notes, reviews and listings are visible to other signed-in HashZ users.
• If you verify as university staff, your role ribbon (Professor, Lecturer or Demonstrator) and department are shown on your profile. The staff email you verify is seen only by HashZ admins.
• Chat messages, photos and files are end-to-end encrypted: only the people in the chat can read them, not us and not our providers. To deliver them we still see who is in a chat, when messages are sent, and how big files are.
• People you don't follow can send you one message request. It waits under Message requests, without a notification, until you accept, delete it or block them. They don't know you've seen it until you accept. The same goes for group invites from people you don't follow.
• Your email address is never shown to other users.
• Voice and video calls go directly between the two phones, or through our relay server when a direct connection isn't possible, and are encrypted (DTLS-SRTP). Our server helps the phones find each other and sees who called whom and when, but not the audio or video.
• You can block anyone: they can no longer see your content, message or call you. You can unblock them in Settings → Blocked accounts.
• If you report a message, its text (which only the chat's members can otherwise read) is shared with HashZ moderators together with your report. Moderators can remove reported content and suspend accounts that break the rules.

Service providers

We use trusted providers to run HashZ. They process data only on our behalf:

• MongoDB Atlas (database, hosted on AWS in Mumbai, India)
• Cloudinary (photo and file storage for posts, profiles, notes and listings)
• Oracle Cloud (application servers, and storage for encrypted chat files)
• Brevo (sending account emails)
• Google Firebase Cloud Messaging (waking your phone for incoming calls; the notification contains the caller's name and photo, never message content)
• OpenStreetMap (map images; your device requests map tiles directly from OpenStreetMap servers)

Security

Connections are encrypted (HTTPS). Passwords and verification codes are stored as one-way hashes. Files are delivered only through short-lived signed links. Sign-in tokens on your phone are kept in the device's secure keystore. Chats are end-to-end encrypted: the keys are created and kept on your phone, and you can compare a security code (or scan a QR code) with a friend to be sure no one is in between. If someone's security code changes, the chat tells you.

Keeping and deleting your data

We keep your data while your account exists. You can delete your account at any time in the app (Me → Settings → Delete account) or by following the steps on our account deletion page. Deletion permanently removes your profile and the content you created; direct chats are removed for both people. Activity notifications are kept for at most 60 days.

Your rights

Under Sri Lanka's Personal Data Protection Act No. 9 of 2022 you can ask to access, correct or erase your personal data, and object to its processing. You can edit most of your data directly in the app; for anything else, email us and we'll respond within 30 days.

Age

HashZ is intended for university students and is not directed at children under 16.

Changes

If we change this policy we will update this page and, for significant changes, tell you in the app.