Hallmate
Privacy policy
Last updated: 12 October 2026
Hallmate is a community app for the residents of a student residence. This policy explains what data the app processes, why, who can see it, how long it is kept and what your rights are under the GDPR.
1. Who is responsible
The data controller is Alessandro Coron, who develops and runs Hallmate as an individual, based in the Netherlands. For anything about your data write to privacy@hallmate.nl.
2. What we process
| Data | What it is |
|---|---|
| Account | Your email address and password (stored only as a secure hash). |
| Profile | Name, residence, floor and room, and what you choose to add: bio, interests, photos, Instagram handle, the Chill/Open mode, when you were last active. |
| Who's around | The common area you say you are in, for how long, and an optional note. It clears itself when the time is up. |
| What you post | Messages and attachments (photos, videos, voice messages, documents), group chats, floor tags, listings, activities and sign-ups, comments, reactions, game results, anonymous Spotted posts, bookings, maintenance reports, flat chores and expenses. |
| Connect | Crushes you send and profile visits. Others only ever see counts; a name is revealed only when a crush is mutual. |
| Room applications (hospiteren) | If you apply for a room: your name, email, age, study, introduction and photo, and the scores and comments the flatmates give. |
| Technical | A token to deliver push notifications to your phone, and usage events (for example “opened the Market”, “sent a message with a photo”) that never contain what you wrote. |
We do not collect your location, your contacts, advertising identifiers or payment details. Photos and videos you send come only from what you shoot in the app or pick yourself; the app has no access to the rest of your gallery. There are no ads, and we do not sell or rent your data.
3. Why, and on what legal basis
- Running the app you signed up for — account, profile, chat, activities, market and the other features (performance of a contract, GDPR art. 6(1)(b)).
- Keeping the community to the residents of your building — checking your email against the list your residence provides (legitimate interest, art. 6(1)(f)).
- Notifications about messages, notices and activities (contract). You can switch them off in your phone's settings.
- Improving the app with usage events that contain no content (legitimate interest).
- Safety and moderation of content that is reported (legitimate interest).
4. Who can see your data
- Residents of your own residence see your profile, your listings, the activities and groups you join, where you said you are in Who's around, and the messages you send them. Nobody outside your residence can see any of it.
- Your floor and room are not shown to other residents. Only you and the residence management can see them.
- Spotted posts are anonymous to other residents. The author is stored only so that abuse can be moderated.
- The residence management sees the resident list, notices, maintenance reports, bookings, reported content and aggregate statistics.
- Flatmates deciding on a room (hospiteren) see the applications for their room.
We use these service providers, who process data only on our behalf:
- Supabase — database, sign-in and file storage, hosted in the European Union (Ireland).
- Google Firebase Cloud Messaging — delivers push notifications. A notification passes through Google's servers with the text it shows, for example the sender's name and the start of a message.
- Google Play and Apple App Store — distribute the app under their own privacy policies.
Supabase and Google are companies based in the United States. Where data is transferred outside the EU, this is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
5. How long we keep it
- As long as your account exists.
- When you delete your account (Profile → Settings → Delete account, or by email — see Delete your account), your data and content are erased immediately. Database backups are overwritten within 7 days.
- Anonymous Spotted posts stay visible but are no longer linked to you. Things shared with others — a group chat you started, flat chores, interest tags you added — stay for them without your name.
- Room applications are kept until the vacancy is closed or deleted by the residence, or earlier on request.
- If your residence removes you from its list (for example when you move out), you can no longer sign in. Your account stays until you delete it or ask us to.
6. Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format (GDPR articles 15–22). Write to privacy@hallmate.nl; we answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority of the country where you live.
7. Security
Every request to the database is checked row by row, so you can only reach the data of your own residence. Chat files are private and shared through links that expire. All traffic is encrypted in transit.
8. Age
Hallmate is for adults only: you must be 18 or older to use it.
9. Changes
If this policy changes in a way that matters, we will tell you in the app. The date at the top always shows the current version.