Privacy
What we store, and who can see it.
Last updated 22 October 2026
The short version: your passport is private. Nobody sees it unless you share a link, and you choose what that link shows. Your surname, your email and your messages are never public. TrustColive stores no phone number at all.
Who is responsible
TrustColive is an independent student project run by Santiago Trillo in Cork, Ireland. It is not affiliated with or endorsed by University College Cork. For anything on this page, email santitrillo05@gmail.com.
What we collect, and why
| Data | Why | Who can see it |
|---|---|---|
| Email address | To sign you in and send the notifications you turn on | Only you and us. Never shown publicly |
| First name and surname | To build your passport, and later to match the name on your ID | Only you and us. When you share, people see your first name and last initial unless you choose otherwise |
| Where you live now (city and country) and your situation | So your passport helps with the right thing first | Only you and us, and whoever you share your passport with if you include it |
| What you study or do, languages, a short note | Optional, self-declared, for landlords to read | Only you and us, and whoever you share your passport with if you include it |
| Identity check result, if you verify with Didit | To show that your identity is verified | Only you and us. People you share with see “verified” and the date — never your document or photo, which Didit keeps, not us |
| Your rentals and rent payments: city, area, exact address, dates, rent, deposit, how you paid | To build your rental record | Only you and us. If you share your rentals, people see the city, area, dates and evidence level — never the address, the rent or the deposit |
| Documents you upload (contracts, transfer receipts, residence letters) | To back a fact with evidence. We store a SHA-256 fingerprint and the time we received it | Only you. Stored privately in the EU and opened only through a one-minute private link |
| Your landlord's name and email, if you add them | Only to ask them to confirm your rental | Only you and us. We email them only when you ask us to, and never for anything else |
| When a landlord answers: the name they give, their email, the time, and a fingerprint (hash) of their network and browser | To check that a confirmation isn't the tenant confirming their own record | The tenant sees the name and the result. Nobody sees the fingerprints |
| A random browser identifier (the tc_dev cookie) and a fingerprint (hash) of your network when you edit your records | Security only: to detect someone confirming their own rental. It is never used for tracking or advertising | Nobody. We keep only the hash |
| Messages | To let people contact each other | Only the people in that conversation. Not us, unless you report something |
| Notification preferences and the language you chose | So we only send what you asked for, in the right language | Only you and us |
| Feedback you send | So we can fix what you tell us is broken | Only you and us. It includes the page you were on |
| Push subscriptions, if you install the app | To deliver reminders to that device | Only you and us. Remove the app and it stops |
| Board profile, only if you created one before October 2026 | The earlier version of TrustColive was a flatmate board | Public on that board only if you switched it on. You can hide it in Settings |
We do not collect a phone number. There is no column for one in the database. We do not sell anything to anyone.
Analytics
We do not use advertising trackers. Product analytics are not switched on in this version; when they are, they will be hosted in the EU, you will be asked first, and saying no will cost you nothing.
Your consent, and taking it back
These are switched off until you turn them on, and each is separate — turning one off never affects the others:
- Email when you get a message.
- Reminders and notifications about your own records, each switchable by type and by channel.
- Only if you created a board profile before October 2026: appearing on that board, and emails about matching profiles.
All of them live in Settings and can be changed at any time.
Your rights under the GDPR
- See your data. Settings → Download my data gives you everything we hold about you as a JSON file.
- Delete it. Settings → Delete my account removes your profile, your messages and your account permanently. It cannot be undone.
- Correct it. Re-run the questionnaire at any time to update your answers.
- Withdraw consent. The switches above.
- Complain. If you think we have handled your data badly, you can contact the Irish Data Protection Commission. dataprotection.ie
Where your data lives
The database is hosted by Supabase in the EU (Ireland). The site is served by Vercel. Notification emails are sent by Resend. Each of these processes data on our behalf, and only to run the service.
How long we keep it
Until you delete your account. Because this is built around one academic year, we intend to contact people at the end of the 2026/27 year and remove profiles that are no longer needed.
One honest caveat
Identity is checked only if you complete the Didit check, and landlord confirmations pass automated checks before they count — but no check is perfect. That is why every fact carries a label saying exactly how it was checked. Use the same judgement you would with anyone online, and use the block and report options if something feels wrong.
Changes
If this policy changes in a way that affects you, we will tell you by email before it takes effect.