Privacy Policy

This policy explains what information NORSU Campus Marketplace keeps about you, why, who can see it, and how to ask us to change or delete it. We wrote it to match what the site actually does.

Last updated: October 31, 2026

1. Who we are

NORSU Campus Marketplace (norsumarketplace.store) is an independent student project. It is not operated by Negros Oriental State University.

For anything about your information, email [email protected].

2. What we collect

Your account: full name, email, student ID, campus, and, if you add them, a profile photo and bio. Your password is stored only as a secure hash, so nobody, including us, can read it.

Your listings: item name, description, price, category, condition, meetup or delivery details, photos, and an optional payment QR code.

Messages: what you send, to whom and when, including purchase requests. If you choose to share your live location in a chat, we keep it only while sharing is on.

Security records: failed log-ins (the email or student ID typed and the network address, kept for one day), and one-time email codes and links, which are stored scrambled and expire within minutes or hours.

Reports: when you report a listing or an account, what you reported, the reason and any details you add, and who sent it.

View counts: how many times a listing was opened, counted once per visit and not linked to who viewed it.

3. Kept only on your device

Your favorites, cart, light or dark theme, and a copy of your name and photo for quick display are saved in your own browser, not on our server. See the Cookie Policy.

4. How we use it

  • To run the marketplace: show listings, deliver messages and purchase requests
  • To confirm your email and help you reset a forgotten password
  • To keep accounts safe, for example by slowing down password guessing
  • To remove listings or accounts that break the Terms and ConditionsPrivacy Policy

We do not sell your information, show ads, or use tracking or analytics tools.

5. Who can see what

  • Anyone visiting the site: listings, with the seller's name, photo and meetup spot, and seller profile pages
  • The student you message: your messages, and your live location only while you share it
  • Administrators: account details (such as name, email and student ID) and listings, so they can review and remove content, and the reports students send (including who sent them). The admin dashboard does not show private messages.
  • The student you report: nothing about the report. They only see what an administrator decides, such as a removed listing.

6. Services that help run the site

These handle some information on our behalf, only as needed:

  • Our web host stores the site and its database
  • Cloudflare delivers pages securely and protects against attacks; it sees your network address
  • Resend sends our emails, so it receives your email address and the code or link we send
  • Google Fonts provides the text font; your browser loads it from Google
  • Unsplash hosts some sample item photos
  • OpenStreetMap and cdnjs provide the map shown when a location is shared in Messages
  • The Campus Tour page shows a map from norsu.top

7. How long we keep it

  • Your account, until you ask us to delete it
  • Listings, until you or an administrator remove them
  • Messages: deleting a chat removes it for you; the other student keeps their copy
  • Live location: deleted as soon as sharing stops or ends
  • Reports: kept after they are reviewed, as a record of how problems were handled. A report is deleted with the reported account; if your account is deleted, reports you sent are kept without your name.
  • Failed log-ins: one day. Email codes: 10 minutes.
  • Backups of the site, used only to recover from problems: the latest 14 are kept and older ones are deleted

8. Your rights

Under the Data Privacy Act of 2012 (Republic Act No. 10173), you can ask to see the information we hold about you, correct it, have it deleted, or object to how it is used.

You can edit your name, email, campus, photo and bio yourself in Profile. For anything else, including deleting your account, email [email protected] from the address on your account. If you are not satisfied with our answer, you can contact the National Privacy Commission at privacy.gov.ph.

9. Keeping it safe

We use HTTPS, scrambled passwords, email verification and other protections described in the Security Policy. No website is perfectly secure, so please use a password you don't use anywhere else.

10. Changes to this policy

We may update this policy as the site changes. The date at the top shows the latest version.