Privacy notice

This notice describes the intended handling of personal data on UCDngl. It must be checked against the live deployment, database, server logs, analytics, moderation systems and provider contracts before publication. The operator named in the Legal Centre is the data controller unless the actual arrangement says otherwise.

1. Who is responsible?

The controller is the individual who personally operates UCDngl. The service is independent of University College Dublin (UCD); UCD is not the controller and is not responsible for this site. The service is free to use and is intended for UCD students, but unless access is verified through UCD authentication, the operator cannot confirm every visitor is a student.

2. Data we may process

• Posts, post titles, replies, likes, reports, moderation decisions and timestamps you submit or interact with.
• Random session display names and technical identifiers used to support a session, prevent abuse or associate actions with a device/session.
• Technical data such as IP address, user-agent, request logs, security events and error information, where collected by the app or its hosting providers.
• Information you include in a report or privacy request.
• Operational data returned by service providers. Do not submit sensitive personal information or details that identify another person.

The operator must verify exactly which identifiers and logs are collected by the application, Vercel, Neon, Groq and any other configured service. Do not describe a field as anonymous if it can reasonably be linked to a person.

3. Purposes and legal bases

The purposes are expected to include displaying and operating the board, storing and expiring posts, providing likes/replies, processing reports, enforcing the rules, preventing spam and abuse, securing the service, troubleshooting faults and responding to legal requests. The operator must document a valid GDPR Article 6 legal basis for each purpose. Legitimate interests may be appropriate for proportionate service operation, moderation and security only after assessing necessity and balancing users’ rights; legal obligations may apply to certain disclosures or records. Do not assume contract is the correct basis merely because someone visits a free site. Consent must be used where required, including for non-essential cookies or similar technologies. The operator must complete and retain this assessment before launch.

4. Who receives data?

Data may be processed by the database and hosting providers configured for the service, and by Groq if content is sent to its AI service for moderation or text generation. The operator must confirm the actual data flows, providers, purposes, retention settings, subprocessors, locations and applicable transfer safeguards, and link to current provider privacy information where appropriate. Data may also be disclosed where legally required or necessary to establish, exercise or defend legal claims.

5. International transfers

If personal data is accessed or processed outside the European Economic Area, the controller must identify the destination and ensure a valid transfer mechanism and safeguards where required. The controller must verify this with each provider and update this notice accordingly.

6. Retention and deletion

Timed posts are intended to disappear from the public board when their timer expires. This does not necessarily mean all copies are immediately erased from database backups, security logs, provider logs or moderation records. The operator must set and publish specific retention periods or criteria for posts, replies, reports, session/security logs, backups and support correspondence; configure deletion accordingly; and disclose any legally required retention exceptions.

7. Your rights

Subject to the conditions and exceptions in law, you may have rights to access, rectify, erase, restrict or object to processing, data portability where applicable, and to withdraw consent where processing relies on consent. You may complain to the Irish Data Protection Commission or your relevant EU supervisory authority. Contact the controller to make a request; reasonable identity verification may be needed, and the controller must respond within the applicable legal time limit.

8. Children

The service is intended for UCD students and is not intended for children under 17. Do not use it if you are under 17. This is not a claim that the site verifies age or UCD enrolment. The operator must decide whether any age or eligibility checks are needed and assess child-safety obligations, particularly because some university students may be under 18.

9. Security and incidents

The operator uses technical and organisational measures appropriate to the risk, but no internet service can promise absolute security. The operator will assess personal-data breaches and notify the supervisory authority and affected people where required by law.

10. Free service and UCD relationship

The operator does not charge users to access UCDngl and the current service has no paid features. The service is an independent personal project, not an official UCD service, and must not be used to imply UCD endorsement. This statement must be updated if the service is monetised or its relationship with UCD changes.

11. Changes

This notice may be updated when processing changes. Material changes will be communicated where required. The effective notice and date should be maintained by the operator.