Privacy Policy

• Account info: name, university email (uoguelph.ca), program, year, profile photo, bio.
• Landlord info: name, email, phone, company name, government ID, and ownership documents (for verification). The ID is read automatically by Amazon Textract. We keep whether the name and phone number on it matched what you entered, not the text it read. See section 4.
• Listings: property address, photos, videos, rent, amenities, lease terms, viewing availability.
• Roommate quiz answers: lifestyle preferences used for compatibility matching.
• Messages: contents of conversations between students and landlords, marketplace buyers and sellers, and messages posted in a roommate group chat (including pinned messages and read state).
• Community content: posts and comments you write in The Bubble, and the votes you cast on them.
• Marketplace and auction activity: items you list, and for auctions your bid history, the maximum amount you set for a proxy bid, and any no-show strikes recorded against your account (see section 7a of our Terms).
• Usage data: pages viewed, searches performed, listing saves, IP address, browser type, and the interaction data described in section 5.

• To operate the platform: show listings, run the roommate match, deliver messages.
• To verify landlord identity before allowing them to publish listings.
• To send transactional emails (verification, password reset, viewing reminders).
• To detect abuse, fraud, and violations of our Terms.
• To understand how cribb is used and improve it. This is product analytics, it only runs if you accept it, and while you are logged in it is linked to your account rather than anonymous. Section 5 explains exactly what is collected.

We do not sell your personal information. We share data only with:

• Service providers used to run cribb: the companies listed under Third-party processors below. Each one gets only what it needs to do its job for us.
• Other users, only where you choose: landlords see your name and program when you message them; group members see your roommate quiz answers if you join a group.
• A landlord's property-management software: if the landlord you message has connected their property-management system to cribb, we send it a guest card with your full name, @uoguelph.ca email and message, any phone number, move-in date or bedroom count you add, and your roommate group's size, so they can reply from there. That system is run for the landlord, not for cribb, and keeps the card under the landlord's own policies.
• Authorities: only when legally required (court order, lawful warrant).

Third-party processors

These are the outside services that receive personal information when you use cribb: what each one is for, what it gets, and where it keeps it.

Because these providers process data outside Canada, by using cribb you consent to your data being transferred and processed outside Canada under contractual safeguards.

Landlord identity verification (Amazon Textract). When you register as a landlord you upload a government ID and a proof-of-ownership document. Both files are stored in Amazon S3, and the ID is then processed by Amazon Textract, an automated document-analysis service that reads the document and extracts its fields as text. We compare the extracted name and phone number against the details you typed into the registration form using an approximate text match. We store only the result of that comparison (match or mismatch for each, and how close the match was), never the text Textract read; older records that held that text have been reduced to the same result. The comparison never decides anything on its own: whatever it finds, your account starts unverified, and a person on the cribb team reviews your documents, uses the result only as a hint, and makes the decision. If you later change the legal name on your account, it goes back to unverified until a person has reviewed it again. You can ask for a decision to be looked at again by emailing the address in section 11. We do not use these documents, or the data extracted from them, for anything other than checking that you are who you say you are.

AI listing comparison (Anthropic). Our AI listing comparison feature uses Anthropic's Claude model. When you compare listings, the relevant listing data (rent, amenities, location, Cribb score, landlord verification status) is sent to Anthropic to generate the comparison. We do not send your name, email, or messages to Anthropic. Anthropic does not train its models on this data under their commercial terms.

The first time you visit, cribb asks whether you accept analytics, with Accept and Decline buttons that carry equal weight. Until you choose, and whenever you decline, analytics do not run at all: PostHog is not loaded, sets no cookies, stores nothing in your browser and receives nothing from you. If your browser sends a Global Privacy Control signal, we treat that as a decline and do not ask.

Essential cookies (always on)

These are needed for the site to work, so they do not wait for your choice.

• cribb_consent: remembers whether you accepted or declined analytics, for about 12 months. After that we ask again.
• Staying signed in: when you log in, our server sets two cookies: cribb_at, a short-lived access token, and cribb_rt, a refresh token that keeps you signed in for up to 30 days. Writer and admin sessions get their own pair (cribb_writer_at, cribb_writer_rt, cribb_admin_at and cribb_admin_rt). They are HttpOnly, so no script on the page can read them, not even ours, and Secure, so they are only sent over HTTPS. They belong to api.findyourcribb.com alone and are not sent to any other site, and the refresh cookie only goes to the part of our API that renews and ends sessions. Your session tokens are not kept in your browser's local storage. If you last signed in before this change, the site moves your session into these cookies on your next visit and deletes the old local storage copies.
• Security: cribb_csrf protects your requests against cross-site request forgery, and cribb_role is a hint that you are signed in, so the site can show the right pages before it has checked your session. The site has to read these two, so they are not HttpOnly, and neither of them can sign anyone in.

Clearing your cookies signs you out. Logging out revokes the refresh token on our side and deletes the session cookies.

What else we keep in your browser

cribb also uses your browser's local storage (and, for a few short-lived things, session storage) to remember things on your device. None of it is analytics, and none of it is shared with third parties:

• a copy of your profile, so pages can show your name before our server answers.
• the listings and marketplace items you saved, so the save buttons show the right state straight away.
• whether you have seen the welcome screen and the guided tips, so they are not shown twice.
• the cribb companion: the pet you chose while signed out, and where you placed it on the screen.
• your roommate search preferences on the roommates page, and banners you have dismissed.
• for landlords, private conversation notes (also saved on our server) and your progress through a listing claim link.
• a short-lived marker that stops two open tabs refreshing your session at the same moment, your place in the site's back button history, and a just-posted sublet while its confirmation shows.

Analytics (only if you accept)

Product analytics (PostHog). If you accept, we load PostHog so we can see which pages actually help students. It records page views and, through PostHog's autocapture, clicks and other interactions with elements on the page, along with the technical details your browser sends (IP address, browser and device type, referring site). PostHog keeps an identifier for your browser in a cookie and in local storage (both named with a ph_ prefix) so repeat visits count as one person. While you are logged in these events are tied to your account: we pass PostHog your role-qualified cribb account id and your role (student, landlord, writer, or admin). This is behavioural analytics linked to you, not anonymous analytics. Analytics requests are sent to a cribb address on our own domain (/ingest) which forwards them to PostHog. When you log out we reset the identity, so later activity in that browser is no longer linked to your account.

Session replay (PostHog). PostHog session recording is disabled, including when you accept analytics. We still count page visits and interactions, with text and element attributes masked. We do not send your email as an analytics identity; account identifiers include your role so different account types are kept separate.

Error monitoring (Sentry). When something breaks we send Sentry a report about the error, including technical context about your browser and the request, and account identifiers where we have them. Request bodies and contact details are excluded from backend reports. We treat this as essential: it is how we find and fix failures, and in your browser it sets no cookies and stores nothing. If you accept analytics, Sentry also records a session replay when an error happens, a masked reconstruction of the pages you were on and the actions you took in the moments leading up to the failure. To do that it keeps a replay id in your browser's session storage. If you decline, no replay is recorded.

Changing your choice

You can change your mind at any time, and withdrawing is as easy as accepting: use Cookie settings in the site footer, or the button below. If you decline after accepting, we switch PostHog and Sentry replay off straight away and delete the identifiers PostHog stored in your browser. Declining does not reach back to data already sent; to have that removed, email the address in section 11.

Other services that load on some pages

Pages with a map, and address search on listing forms, load Google Maps from Google. Account sign-up, writer applications and password reset run a Cloudflare Turnstile check to keep bots out. Those requests go to Google and Cloudflare under their own privacy policies, and we use them only for those features. Every outside service that receives your data is listed in Third-party processors in section 3.

We do not run third-party advertising, ad-tech pixels, or cross-site tracking on cribb.

Under PIPEDA, you have the right to:

• Access the personal information we hold about you. You can download a copy yourself at any time (Settings → Download my data; writer accounts, email us): your profile and settings, everything you have posted, your messages (except in group chats you have left), bookings, notifications and sign-in history, as one file. Other people appear in it only by the name cribb shows them under, never with their email address or phone number. For anything not in it, email the address in section 11.
• Request correction of inaccurate information.
• Withdraw consent and delete your account at any time (Settings → Delete Account).
• File a complaint with the Office of the Privacy Commissioner of Canada.

Account data is retained while your account is active. When you delete your account, or we delete it, we remove your profile, settings, listings, sublets, marketplace items, posts, the reviews you wrote, your roommate profile, your conversations and the messages you sent in group chats straight away, and ask the services that store your photos and videos (Cloudinary) and landlord documents (Amazon S3) to delete those files at the same time. Copies in our database provider's backups expire on that provider's own schedule. A guest card already sent to a landlord's property-management system (section 3) is kept by that system under the landlord's policies.

Two logs keep a record of what happened on an account after it is deleted: the security log (sign-ins, password and email changes) and the activity log (actions such as publishing a listing or starting a conversation). We remove the IP address, browser details and any other details from your entries in both, and keep the account number, what kind of event it was, what it concerned (for example, which listing), and when. Your sign-in sessions and any API keys are deleted.

Whether or not you delete your account, we automatically:

• remove the IP address and browser details from activity-log entries after 90 days;
• delete security-log entries after one year;
• delete our copy of a guest card 90 days after it was sent (or, if it could not be sent, 90 days after it was made; a card still waiting to be sent is kept until then);
• delete records of expired sign-in sessions 30 days after they expire.

Some records may be retained longer where required by law (e.g. fraud investigation).

Landlord ID and ownership documents. These are held separately from the rest of your account data and we treat them as the most sensitive thing we store. The files sit in Amazon S3, encrypted at rest, and the result of the comparison described in section 4 is stored as a record in our database. We keep both for as long as your landlord account exists, because a verification decision can be re-checked or disputed later. When your landlord account is deleted, whether by you in Settings or by us, both files and the record are deleted with it. We will also delete them on request while your account stays open, but your account will lose its verified status and you will not be able to publish listings until you verify again.

We use industry-standard practices including bcrypt password hashing, JWT authentication held in HttpOnly cookies with cross-site request forgery protection, HTTPS encryption in transit, and AWS S3 server-side encryption at rest. No system is perfectly secure, so please use a unique password and report suspicious activity.

cribb is restricted to verified students and landlords. We do not knowingly collect information from anyone under 17.

We may update this policy from time to time. Material changes will be announced via email and the "Last updated" date above.

Questions or requests: hello@findyourcribb.com

You can also reach the people behind cribb directly: Adeoluwa Ojulari (adeoluwaojulari@gmail.com) and David Amaefula (professionaldavid14@gmail.com).