Privacy Policy.
Last updated September 30, 2026
Here is what Baton collects, why, and who can see it. The short version: we collect what the app needs to work, we do not sell your data, and we do not run ad tracking.
1. What we collect
- Account: your .edu email, and your name and profile photo if you sign in with a school Google account.
- Date of birth: only to confirm you are 18 or older. It is never shown to other users.
- Profile: whatever you choose to add, such as a photo, a bio, roommate preferences, and social handles.
- Listings: the details and photos you post.
- Messages: what you send other students on Baton, plus any reports or blocks you make.
- Payments: if you buy an optional extra, Stripe processes the payment. Baton keeps a record of the purchase but never sees or stores your card number.
- Basic usage: anonymous page-view statistics that do not use advertising cookies or follow you around the web.
2. Who can see what
- Public: listings and their photos can be viewed by anyone, even without an account. Your profile name, photo, bio, and any social handles you add are visible to people who open your profile.
- Private: messages are visible to you and the student you are talking to. Your email address and date of birth are not shown to other users.
- Reports: if something is reported, we may review the reported listing or account to decide what to do.
3. How we use it
To run Baton: signing you in, showing listings, delivering messages, keeping under-18 accounts out, handling reports, and processing optional purchases. We do not sell your information and we do not use it for behavioral advertising.
4. Services that help us run Baton
We share information only with the services needed to operate the app: Supabase (database and photo storage), Vercel (hosting and anonymous analytics), Resend (login emails), Stripe (payments), and Google (only if you choose to sign in with Google). They handle the data on our behalf.
5. Cookies
Baton uses a cookie to keep you signed in. That is it. No advertising or cross-site tracking cookies.
6. Your choices
You can edit your profile any time, and social handles are always optional. To delete your account and everything tied to it, use "Delete my account" at the bottom of your Account page, or email us. If we learn an account belongs to someone under 18, we delete it.
7. Changes and contact
If this policy changes, we will update the date at the top. Questions? Email contact@drawnup.io. See also our Terms of Use.