Privacy Policy
Last updated November 3, 2026
DormUniversity is built to need very little about you. This page explains what we collect, where it goes and how long it stays. We don’t sell your data, we don’t show ads, and we don’t use tracking cookies.
Accounts and the one cookie we set
Accounts are for students with a school (.edu) email. When you log in, we set one cookie that keeps you signed in for 30 days. It can’t be read by scripts on the page, and logging out deletes it. Guests get no cookie. You can try every free feature as a guest; reading items with AI, 3D models, room pictures and group texts cost us money, so they need an account.
What stays on your device
Your room designs, budgets and air settings are saved in your browser’s local storage, not on our servers. Clearing your browser’s site data deletes them. A “share” link holds the design itself in the link, so whoever you send it to can see that design.
What we collect and where it goes
| What | Why | Sent to | Kept |
|---|---|---|---|
| Photos and descriptions you add to “Can I bring this?” | To read the item’s type and size | Google (Gemini API) | Not stored by us. Repeat text questions (not photos) are cached as the item’s description for up to 30 days, without anything that identifies you. |
| A photo you choose to turn into a 3D model | To cut out the item and build the model | Runware (background removal and SAM 3D) | The photo isn’t stored by us. The finished 3D model is kept at an unlisted link in Vercel Blob so it can show in your room. |
| A snapshot of your room when you ask for a picture | To draw the picture | Google (Gemini image API) | Not stored by us. |
| A room summary you send to a group chat | To post it to the chat | Twinly (iMessage) | Kept in that chat, like any message. |
| Your IP address, as a one-way hash | Rate limits, so nobody can run up the AI bill | Upstash (Redis) | Up to 24 hours. |
| Server and error logs, plus anonymous usage events like “room opened” | To fix crashes and see which features help | Vercel (hosting) | Up to 30 days. No cookies, no profile of you. |
| Account details: school email, username, school, year, and a salted hash of your password (never the password itself) | To sign you in and keep the paid features for students | Upstash (Redis) | Until you delete your account. |
| When you signed up, confirmed your email and logged in, and how many times | So we can see how many students use DormUniversity, and spot misuse | Upstash (Redis) | Your last log-in and count until you delete your account; the list of recent log-ins keeps the latest 500. Daily totals have no names. |
| Your school email, to send the confirmation link | To prove the address is yours | Resend (email delivery) | Resend keeps delivery logs under its own terms. We don’t send marketing email. |
AI providers process what we send under their API terms. We use their paid or developer APIs, not consumer apps.
Photos
- Before you send a photo, we ask for your OK and say which service will see it.
- Your browser redraws the photo before it leaves your device. This removes its hidden data (EXIF), such as GPS location, camera model and the time it was taken.
- Photograph the item, not people. If someone ends up in the picture, crop them out first.
Your choices
- You can use every free planning feature without an account and without sending a photo. You can type an item’s details in by hand instead.
- To delete a 3D model or anything else we hold, or to ask what we have, contact us. We answer within 30 days.
- To delete your account or get a copy of what it holds, contact us from your school email. A button for this in your account is coming.
Children
The site is not meant for children under 13, and we don’t knowingly collect their information.
Security
Traffic is encrypted (HTTPS). API keys stay on our servers. Passwords are stored only as salted scrypt hashes, sign-in links work once and expire in a day, and log-in attempts are rate limited. No system is perfectly secure, so if you think something is wrong, tell us.
Changes
If this policy changes, we’ll update the date at the top. If you have an account, we’ll email you about significant changes.