Legal
How SOXO handles your data
The short version: your account is tied to your school email, you control who sees what through the app itself (rooms, DMs, and listings are only visible to who they’re meant for), and you can export your data or request deletion at any time from your profile.
Where it’s stored
[Confirm and state the actual Supabase project region before publishing — Supabase doesn’t currently offer an Africa region, so data for this launch is very likely hosted outside Nigeria. Say exactly where, honestly, rather than implying local storage the way Hestia can for Canada.]
| Service | What it does | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in | [project region — confirm before publishing] |
| [Hosting provider] | Runs the website and app | [confirm — not yet decided in this build] |
| Anthropic | Reads your trip-planning details (destination, dates, budget) to suggest an itinerary | United States |
| Twilio | Sends the SMS code when you verify your phone number | United States |
| Stripe | Payments — not yet active for this launch; listed here for when it is | United States |
What we store
Your account
Name, school email, program, graduation year, profile photo, and date of birth. Your date of birth is never shown to anyone else — it only controls age-related rules, like not matching minors with adults in messages and pings.
Backup contact (optional)
A personal email or phone number, if you choose to add one, so you can still reach your account if you lose access to your school email. Never used to match or identify you to other users. A verified phone number is confirmed through Twilio — we don’t see or store the code itself, only whether it checked out.
Location (optional)
Only if you use “who’s free near me” or turn on being discoverable to others’ pings — and only while the app is open and visible on your screen, never in the background. Not kept as a history, just overwritten each time.
Messages & content
Room chat, direct messages, marketplace listings and photos, and event listings and photos. Direct messages are only ever visible to the people in that conversation.
Schedule (optional)
If you upload a class schedule, we extract your class times to power availability features. The file itself isn’t kept after that.
Reports & moderation
If something you posted is reported, or you report something, we keep the report, the content involved, and the outcome — for as long as needed to handle it and any appeal.
We don’t sell your data and we don’t use it for advertising.
Who can see it
- Rooms, events, and marketplace listings are visible to your school community by default — never to a different school, unless an event is shared with a link.
- Direct messages are only ever visible to the people in that conversation.
- Door staff for a paid event can see whether a ticket is valid and the buyer’s name — nothing else about that person’s account.
- Moderators and admins can see reported content and the account behind it, only when handling a report.
Export or delete
- Export: your profile page has an “Export my data” button — downloads everything you’ve posted or own: messages you sent, listings, event tickets, and your account details.
- Delete:requesting deletion from your profile immediately clears your name, photo, and any backup contact details from your account. Removing the account itself, along with things like order and moderation history, is handled by our team afterward rather than instantly — some of those records need to be kept a little longer for fraud prevention and accounting, even once you’ve left.
Questions about your data: [support email]