Flag-UniMatchFlag-UniMatch — Privacy Policy
Effective date: 1 November 2026
This policy explains what personal data the Flag-UniMatch app (the "App") collects, why, who can see it, how long we keep it and what your rights are under Malaysia's Personal Data Protection Act 2010 (as amended in 2024).
1. Who we are
The App is run by Shotaro Denda, Shah Alam, Selangor, Malaysia ("we", "us"). Contact for anything about your personal data: privacy@flag-unimatch.com
2. The short version
- Other students only see what you put on your profile. Nobody else ever sees your email address or date of birth.
- You only appear to students of your own university.
- Chats are deleted after 48 hours.
- We do not sell your data, show ads or track you across other apps.
- We never receive your card or payment details — Apple or Google handle payments.
- You can delete your account at any time in the App.
3. What we collect and why
| Data | Why | Who can see it | How long we keep it |
|---|---|---|---|
| University email address | Sign-in, confirming you are a student, investigating impersonation reports | Only us (never other users) | Until you delete your account |
| Date of birth | Checking you are 18 or older | Only us (your age is not shown) | Until you delete your account |
| Profile: display name, avatar or profile picture, up to 5 photos, country, faculty, year, gender, languages, interests, places, headline, bio | Your profile and finding friends with shared interests | Students of your university | Until you change it or delete your account |
| Social accounts you add (Instagram, WhatsApp number, WeChat ID or QR code) | Sent to a friend only when you choose to share them | Only the friends you send them to | Until you remove them or delete your account |
| Chats with a friend: text, photos, voice messages, stickers, reactions | Talking with your friends | You and that friend | 48 hours |
| Flags you post (activity, title, time, place, note, number of people, who can see it) | Finding people to join you | Your friends, or students of your university if you choose "everyone" | 30 days after the flag ends |
| Requests to join a flag (with an optional note) | Letting the host decide | Only the host of that flag | 30 days after the flag ends |
| Group chats of a flag: text, photos, stickers, reactions, group name and icon | Talking with the people who joined | Current members of that group | Messages: 48 hours. Name and icon: until the group closes |
| Read state (when you last read each chat) | Showing "Read" to the people you talk with | The friend or group members in that chat | Until you delete your account |
| Stickers you save | Sending them in chats | Only you (and the people you send them to) | Until you delete them or your account |
| Labels you give and receive | Sending anonymous impressions | Received labels: only the ones you choose to show. Who gave a label: nobody | Until you delete your account (removed if you block each other) |
| Subscription status (store, product, end date, auto-renew on/off) and a random billing ID | Knowing whether you can use all features | Only you | Until you delete your account |
| Free pass (end date, note) | Free access given by us | Only you | Until you delete your account |
| Device ID and push notification token | Limiting abuse, sending notifications | Nobody | Until you sign out or delete your account |
| Hashed IP address | Limiting repeated code requests | Nobody | 24 hours |
| Record of the documents you agreed to | Proof of consent | Only us | Until you delete your account |
| Reports you make or receive, and a copy of the reported conversation | Keeping the community safe | Only our moderators (every view is logged) | 90 days |
We do not collect: your real name (your display name can be anything), your location (location data is removed from photos before upload), your contacts, your student ID, or any payment card details.
We keep some data in a one-way coded form (a "hash") instead of your email address. A hash cannot be turned back into your email, but lets us recognise the same email again:
- Free trial: a hash of your email and the date your trial started, so the free trial can only be used once per email. We keep this after you delete your account for 2 years.
- Suspensions and bans: a hash of the email of a suspended or banned person, until the suspension ends (forever for a permanent ban), so they cannot sign up again.
- Open reports: if you delete your account while a report about you is open, a hash of your email for up to 90 days, so a ban can still be applied.
4. Our legal basis
We process your data with your consent, which you give when you sign up, and because it is necessary to provide the App you asked for. You can withdraw consent at any time by deleting your account. Some features cannot work without certain data (for example, we cannot verify you without your university email).
5. Who we share data with
We do not sell or rent your data. We only share it with service providers that help us run the App, under data processing agreements, and only what they need:
| Provider | What they process | Where |
|---|---|---|
| Supabase (on Amazon Web Services) | All stored data (database and files) | Singapore |
| Resend | Your email address and the sign-in code | Sent from Japan; company in the United States |
| Expo (push notifications, through Apple and Google) | Push token and notification text. Message previews are off by default; if you turn them on, the preview text passes through these services | United States |
| RevenueCat | Your random billing ID, purchase records (store, product, dates) and basic device information. Not your email or name | United States |
| Apple / Google | App distribution, subscription purchase and payment | Their own policies apply |
Some of these providers are outside Malaysia. We only use providers that protect personal data to a standard comparable to Malaysian law. We may disclose data if Malaysian law requires it, or to protect someone's safety.
6. Moderation
When a user, message or flag is reported, our moderators can see the reported content and the saved conversation (for a group chat, only the part the reporter could see). To investigate impersonation, they can see the reported person's university email. Every time a moderator views this information, it is logged. If your account is suspended or banned, we send the reason to your university email. Moderator logs are kept for 2 years.
7. Deleting your account
In Settings → Delete account:
- Immediately: you disappear from other students' screens, you are signed out on all devices, and your friendships end.
- Within a day (at the latest 30 days): your profile, photos, social accounts, labels, stickers, flags, messages, files and email address are deleted, and your billing record is deleted from RevenueCat.
- We keep only: the email hashes described in section 3, and reported conversations until their 90 days end.
Backups made by our database provider may keep deleted data for up to 7 days until they are overwritten.
Your store subscription is not cancelled automatically. Cancel it in your App Store or Google Play settings.
8. Your rights
Under Malaysian law you can:
- access the personal data we hold about you and get a copy, including in a machine-readable format (JSON);
- correct it — you can edit your profile in the App at any time; to correct your date of birth, contact us;
- withdraw consent and delete your data by deleting your account;
- ask us to stop or limit processing that causes you damage or distress.
To make a request, email privacy@flag-unimatch.com from your university email. We will reply within 21 days.
9. Security
- Data is encrypted in transit and stored on servers in Singapore.
- Other students can only access data of the same university; this is enforced on our servers, not only in the App.
- Your sign-in session is stored encrypted on your phone.
- Moderators must sign in with a password and an authenticator app.
- Logs do not contain email addresses, message text, social accounts or dates of birth.
If a data breach is likely to cause you significant harm, we will notify the Personal Data Protection Commissioner within 72 hours and tell you within 7 days, as required by law.
10. Age
The App is only for people aged 18 or older. If we learn that a user is under 18, we delete the account and keep a hash of the email until that person turns 18.
11. Changes to this policy
If we make important changes, we will show the new version in the App and ask you to agree again. The version you agreed to is recorded.
12. Contact and complaints
Shotaro Denda — privacy@flag-unimatch.com If you are not satisfied with our answer, you can complain to the Personal Data Protection Commissioner of Malaysia (https://www.pdp.gov.my).