Privacy Policy
Last updated: April 3, 2026
What We Collect
When you create an account, we collect:
- Account info — name, email address, profile photo (from Google OAuth or uploaded)
- School info — your high school and college selection, graduation year, intended major
- Profile content — personal quote, posts, comments, reactions, messages
- Usage data — pages visited, features used, timestamps (for analytics and improving the product)
- Device info — browser type, IP address (for security and rate limiting)
How We Use Your Data
- Run the platform — display your profile, show you on the map, deliver messages
- Trust and safety — detect fake accounts, prevent abuse, enforce community guidelines
- Improve OffTo — understand how features are used so we can make them better
- Communicate with you — send important account updates (we won't spam you)
We do not sell your personal data. We do not show ads. We do not share your data with third parties for marketing.
What's Public vs. Private
- Public (if your profile is set to public) — your name, school, major, profile photo, posts, and your share card. Anyone with your profile link can see these.
- Group-only — visible only to members of your groups.
- Private — your email, messages, and account settings are never publicly visible. Direct messages are only visible to you and the recipient.
You can switch between public and private visibility at any time in your profile settings.
Third-Party Services
OffTo uses the following services to operate:
- Supabase — database, authentication, and file storage (hosted in the US)
- Vercel / AWS — hosting and content delivery
- MapTiler — map tiles for the interactive map
- Google OAuth — sign-in (we receive your name, email, and profile photo)
These services have their own privacy policies. We only share the minimum data necessary for them to function.
Data Retention
We keep your data as long as your account is active. When you delete your account, we permanently delete your profile, posts, messages, and group memberships. Some anonymized usage data may be retained for analytics.
Your Rights
You can:
- Access your data — view everything on your profile page
- Edit your data — update your profile at any time
- Delete your data — delete your account from profile settings
- Export your data — contact us and we'll provide a copy
If you're in California (CCPA) or the EU (GDPR), you have additional rights. Contact us at privacy@off-to.app to exercise them.
Children's Privacy
OffTo is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, contact us and we will remove it.
Changes
We may update this policy as OffTo grows. We'll notify you of significant changes through the app.
Contact
Privacy questions? Email privacy@off-to.app.