Privacy Policy

1. Information We Collect

We collect only the information reasonably necessary to operate a trusted, student-focused platform.

1.1 Information You Provide

This may include:

• Full name
• Email address (including .edu email confirmation)
• Phone number
• Date of birth (to confirm eligibility)
• Profile information (photos, bio, school affiliation, preferences)
• Listings, availability, and content you post
• Messages on Shacked are for communication between users. We don't monitor conversations, but we may review messages if they're reported, flagged for safety, or required by law. This helps keep the community safe and accountable.
• Communications with our support team
• Any other information you choose to provide

Certain information is required to access core features of the Services.

1.2 Payment Information

Shacked does not store full payment card details. Payments are processed by third-party providers such as Stripe, which collect and store payment information in accordance with their own privacy policies. Shacked receives limited transaction-related data (such as payment status and identifiers) for operational, accounting, and support purposes.

1.3 Information Collected Automatically

When you use the Services, we may automatically collect:

• IP address
• Device type, operating system, and browser
• Log data and usage activity
• Approximate location (based on IP address)
• Cookies and similar technologies

The Services operate on the following third-party infrastructure and may transmit the information above to these providers as a necessary part of delivering the Services. Each provider is bound by its own privacy policy:

• Base44: application backend, authentication, account and listing records, file storage, and product analytics (page views and feature usage tied to your account).
• Stripe: payment processing and fraud detection. Stripe's fraud-prevention tools may collect device and browsing data when you load a page that includes a Stripe element (such as our checkout pages).
• Supabase: image and file hosting. Image requests reveal your IP address to Supabase.

As of the “Last updated” date above, Shacked does not use third-party advertising or behavioral analytics tools such as Google Analytics, the Meta Pixel, Hotjar, Mixpanel, or similar trackers. If we add any such tool in the future, we will update this Section before deploying it.

2. How We Use Information

We use personal information to:

• Review eligibility and confirm student email
• Create and manage user accounts
• Enable listings, messaging, and transactions
• Facilitate payments and payouts
• Promote trust, safety, and accountability within the community
• Improve and personalize the Services
• Monitor usage, performance, and platform integrity
• Detect and prevent fraud, abuse, or misuse
• Communicate important updates or support responses
• Comply with legal obligations
• Enforce our Terms of Service and platform policies

3. How Information Is Shared

Shacked does not sell personal information.

We share information only as necessary in the following circumstances:

3.1 With Other Users

Certain profile details, listings, and content are visible to other users as part of the core functionality of the Services. You control what you choose to share, subject to platform requirements.

3.2 With Service Providers

We share information with trusted third-party providers that support the operation of the Services, including:

• Payment processors
• Cloud hosting and infrastructure providers
• Analytics and performance tools
• Identity or eligibility review services
• Customer support tools

These providers are contractually obligated to use personal information only for authorized purposes and to protect it appropriately.

3.3 Legal, Safety, and Compliance

We may disclose information if we reasonably believe it is necessary to:

• Comply with applicable laws or legal processes
• Respond to lawful requests from authorities
• Protect the rights, safety, or property of Shacked, users, or others
• Investigate or address suspected fraud, abuse, or policy violations

3.4 Business Transfers

If Shacked is involved in a merger, acquisition, financing, restructuring, or sale of assets, personal information may be transferred as part of that transaction.

4. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Enable essential platform functionality
• Remember user preferences
• Analyze usage and performance
• Improve the user experience

You may control cookie settings through your browser. Disabling cookies may limit certain features of the Services.

5. Data Retention

We retain personal information only for as long as reasonably necessary to:

• Provide the Services
• Maintain trust and safety records
• Comply with legal, tax, or regulatory requirements
• Resolve disputes
• Enforce agreements

When information is no longer needed, it is securely deleted or anonymized.

6. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. However, no system is completely secure, and we cannot guarantee absolute security.

7. Your California Privacy Rights

If you are a California resident, you have certain rights under California law, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA"), to the extent it applies to Shacked.

7.1 Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information, as defined by CCPA:

• Identifiers (name, email, phone, IP address, account ID)
• Customer records (payment-related identifiers from Stripe)
• Commercial information (booking history, transaction records)
• Internet/network activity (usage data, device data, log data)
• Geolocation data (approximate, IP-based)
• Inferences drawn from the above (preferences, interests)

We do not knowingly collect sensitive personal information beyond what is necessary to operate the Services.

7.2 Sources of Personal Information

We collect personal information directly from you, automatically from your use of the Services, and from third-party service providers such as Stripe and identity verification vendors.

7.3 Business Purposes

We use personal information for the business purposes listed in Section 2 of this Policy.

7.4 Categories of Third Parties

We share personal information with the categories of third parties described in Section 3 of this Policy.

7.5 Sale or Sharing of Personal Information

Shacked does not sell personal information for monetary consideration. To the extent that our use of third-party analytics or advertising cookies (such as Google Analytics or similar tools) constitutes "sharing" under CCPA, you may opt out via the "Do Not Sell or Share My Personal Information" link in our website footer or by configuring a Global Privacy Control (GPC) signal in your browser. We honor GPC signals as opt-out requests.

7.6 California Privacy Rights

California residents may request:

• The categories and specific pieces of personal information we have collected about them
• The categories of sources, purposes, and third parties with whom we share their information
• Correction of inaccurate personal information
• Deletion of their personal information, subject to legal exceptions
• To opt out of any sale or sharing of personal information
• To limit our use of sensitive personal information
• Not to be discriminated against for exercising these rights

To exercise these rights, email us at Shackedhq@gmail.com with “California Privacy Rights Request” in the subject line, and describe the right you wish to exercise (access, correction, deletion, opt-out of sale/sharing, or limit use of sensitive personal information). For opt-out of sale or sharing specifically, you may also use the Do Not Sell or Share My Personal Information page. You may designate an authorized agent to make requests on your behalf, subject to verification of the agent's authority and your identity.

7.7 Verification of Identity

We will verify your identity before responding to rights requests, typically by confirming you have access to the email address on file. For sensitive requests we may require additional verification.

7.8 Response Timeline

We aim to respond to rights requests within 45 days, with an extension of up to an additional 45 days where reasonably necessary. We will notify you of any extension.

8. Your Other Rights and Choices

Depending on your location, you may have the right to:

• Access personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your account and personal information
• Object to or restrict certain processing activities

Requests can be submitted by contacting us at Shackedhq@gmail.com.

9. Age Requirements

The Services are intended only for individuals 18 years of age or older. We do not knowingly collect personal information from minors.

10. International Users

Shacked is operated from the United States. If you access the Services from outside the U.S., you understand that your information may be transferred to and processed in the United States or other jurisdictions.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updates are effective when posted. Continued use of the Services after changes are posted constitutes acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, contact: