Privacy Policy

1. Eligibility

IVY is a United States service intended only for individuals who are at least 18 years old and reside in the United States.

The Platform is not directed to children under 18, and IVY does not knowingly collect personal information from individuals under 18.

If we learn that an account was created in violation of this policy, we may suspend or delete the account and associated information.

2. Information We Collect

We may collect the following categories of information.

A. Account and Verification Information

When you create an account, we may collect:

• your institutional email address;
• your name and profile information;
• your date of birth and age-eligibility information;
• institutional affiliation information;
• authentication credentials;
• account preferences and settings;
• and other information you voluntarily provide.

We may use institutional email domains or other verification methods to confirm eligibility and campus affiliation.

B. User Content

We collect information and content you submit to the Platform, including:

• posts;
• comments;
• listings;
• reviews;
• event submissions;
• polls;
• messages;
• photos and other uploaded media;
• reports;
• housing-related submissions;
• lost & found content;
• and content submitted through anonymous or pseudonymous features.

Content you submit may be visible to other users depending on the feature and your settings.

C. Communications and Reports

We may collect information when you:

• communicate with IVY;
• submit reports or appeals;
• contact support;
• participate in surveys;
• or communicate with other users through the Platform.

D. Usage, Device, and Log Information

We and our service providers may automatically collect certain technical and usage information, including:

• IP address;
• device identifiers;
• browser type;
• operating system;
• app version;
• session activity;
• timestamps;
• referring URLs;
• crash reports;
• interaction data;
• information stored through browser local storage or similar device storage, such as message drafts, theme preferences, and a recently selected map location;
• and general diagnostic or analytics information.

This information may be collected through logs, cookies, SDKs, local storage, or similar technologies.

E. Location Information

We may obtain location information from:

• IP addresses;
• institutional affiliation;
• device-level regional information; or
• precise device location when you choose to grant location permission for a location-based feature.

IVY does not continuously track precise location and does not require continuous precise geolocation access for core Platform functionality. If you use the map's “use my location” feature, your browser or device provides the location after you grant permission. The selected coordinates may be stored locally on that device for up to 30 days so the map can reopen near that location.

F. Meet and Connection Information

If you use Meet, we may collect:

• whether you opt in and complete Meet onboarding;
• date of birth, gender, dating preferences, selected interests, and enabled connection intents;
• swipes, matches, connection status, and related activity;
• and consent and policy-version records associated with Meet.

Gender, dating preferences, date of birth, and one-sided swipes are not displayed publicly. We use this information to determine eligibility, apply mutual-preference and campus filters, recommend potential connections, create matches, support safety, and operate the feature.

G. Payments, Advertising, and Transaction Information

When you or an organization use a payment or advertising feature, IVY may receive or maintain:

• transaction identifiers, amount, currency, status, and timestamps;
• the applicable Club, organization, advertiser, or campaign;
• limited payment-account status and compliance information supplied by Stripe;
• and records of terms acceptance for payment features.

Stripe processes card details, bank-account information, and identity-verification information. IVY does not store full card numbers or full bank-account credentials. Club owners and admins may see member dues status, payment date, and amount for the current term.

3. Campus Isolation and Identity

IVY is designed as a campus-specific platform.

We may use institutional affiliation information to:

• organize content;
• restrict interactions;
• enforce campus segmentation;
• and maintain Platform integrity.

Certain Platform activity may be associated with your verified profile information or institutional identity.

IVY does not guarantee that content, interactions, or communications will remain anonymous, pseudonymous, or inaccessible to IVY.

4. Anonymous Features and The Vault

IVY may provide anonymous or pseudonymous posting features, including The Vault.

Content submitted through anonymous features may not display your identity to other users. However:

• IVY may retain account association and related metadata;
• anonymous activity may be reviewed internally;
• and information relating to anonymous activity may be accessed, preserved, used, or disclosed where reasonably necessary.

IVY may review or disclose information relating to anonymous activity to:

• enforce our Terms or policies;
• investigate misconduct or safety concerns;
• respond to user reports;
• comply with legal obligations or lawful requests;
• protect the rights, safety, or security of users or third parties;
• detect fraud, abuse, spam, or platform manipulation;
• or prevent imminent harm.

IVY reserves the right to restrict, suspend, or remove access to anonymous features at any time.

5. Direct Messages and Communications

IVY stores messages and related metadata transmitted through the Platform.

IVY does not routinely monitor private communications for content purposes. However, IVY and its service providers may access, review, preserve, or disclose message content or metadata where reasonably necessary to:

• investigate reports or violations;
• detect spam, fraud, abuse, or security threats;
• enforce our Terms and policies;
• comply with legal obligations;
• respond to emergencies;
• or protect users, IVY, or third parties.

Users should not expect absolute privacy or security with respect to information transmitted through the Platform.

6. Automated and Human Content Moderation

IVY uses automated systems, including large language models (“LLMs”) provided by OpenAI and Google, to help screen and moderate certain text submitted to the Platform. Depending on the feature, text you submit may be sent to one of these providers for classification. IVY may also retain moderation logs containing the submitted text, the moderation result, the model used, timestamps, and an association with the submitting account or campus.

IVY uses automated results to help detect potentially harmful, unlawful, abusive, fraudulent, or policy-violating content, enforce rules, and improve moderation operations. Automated moderation can be incomplete or incorrect. IVY personnel may review content, reports, and moderation records when reasonably necessary for safety, appeals, enforcement, legal compliance, or system evaluation.

IVY does not routinely send direct-message text to LLM providers for content moderation. Messages and related metadata may still be accessed when reported or when reasonably necessary for the purposes described below. Uploaded images may be screened by an automated image classifier running in your browser or device; under the current implementation, that image classifier does not send the image itself to OpenAI or Google.

7. How We Use Information

We may use information for purposes including:

• providing, operating, and maintaining the Platform;
• verifying eligibility and institutional affiliation;
• enabling campus-specific functionality;
• authenticating users;
• personalizing user experience;
• facilitating communication and interaction;
• moderating content and enforcing policies;
• detecting fraud, abuse, harassment, spam, or unauthorized activity;
• improving Platform functionality, safety, and performance;
• conducting analytics and diagnostics;
• communicating with users;
• complying with legal obligations;
• enforcing legal rights;
• and protecting the safety, integrity, and security of the Platform and its users.

We may aggregate or de-identify information and use it for lawful business purposes.

8. How We Share Information

IVY does not sell personal information and does not share personal information for cross-context behavioral advertising, as “sell” and “share” are defined by applicable United States state privacy laws. IVY advertising is selected by campus rather than by cross-site browsing activity.

We may disclose information:

• to service providers, contractors, and infrastructure vendors supporting the Platform;
• to vendors providing hosting, authentication, moderation, analytics, communications, storage, security, or operational services;
• to affiliates or entities involved in a merger, acquisition, financing, restructuring, or sale of assets;
• where required by law, regulation, subpoena, court order, or legal process;
• to investigate or address suspected fraud, abuse, harassment, threats, or unlawful conduct;
• to protect the rights, safety, property, or security of IVY, users, or third parties;
• or with your consent or direction.

Infrastructure and operational providers may include services such as:

• Supabase for database, authentication, and file storage;
• Vercel for application hosting and delivery;
• Stripe for advertising payments, Club payment processing, identity verification, payouts, refunds, and disputes;
• OpenAI and Google for text moderation assisted by large language models;
• email and push-notification providers;
• mapping and weather-data providers; and
• security, diagnostics, and operational vendors.

These providers may process information on our behalf or, for certain payment and linked-service functions, under their own terms and privacy policies. Their processing and retention practices may differ from IVY's.

9. Data Retention and Account Deletion

IVY retains information for as long as reasonably necessary for purposes including:

• operating the Platform;
• maintaining security and integrity;
• complying with legal obligations;
• resolving disputes;
• investigating misconduct;
• enforcing agreements;
• preventing fraud or abuse;
• and maintaining operational or backup records.

Retention periods may vary depending on the type of information and applicable legal, operational, or safety considerations.

You may delete your account from Settings → Delete account. You may also request deletion or assistance by contacting:

team@getivy.app

Deletion requests may require identity verification.

The self-service deletion process removes your IVY authentication account, profile, personal posts and comments, messages sent by you, Meet profile and activity, uploaded media owned by your account, and other account-linked content covered by the deletion process. If you are the current owner of an active organization, you must first transfer ownership or delete the organization so the organization is not left without an owner. An organization you created but later transferred to another owner will remain; its historical creator link is removed.

IVY may retain or de-identify limited information following deletion where reasonably necessary for:

• complete and de-identified transaction, accounting, tax, payment, and terms-acceptance records;
• safety reports, legal requests, copyright notices, security records, and audit logs where retention is reasonably necessary;
• records required to prevent fraud, abuse, or repeated violations;
• information subject to a legal hold or needed to establish, exercise, or defend legal claims;
• limited residual copies in disaster-recovery backups until they are overwritten under ordinary retention cycles; and
• information that applicable law permits or requires us to retain.

Retained payment records are disconnected from the deleted IVY profile where feasible. Stripe and other providers may retain records under their own legal obligations and policies. Deletion from IVY does not remove copies another person saved outside the Platform. Residual copies may persist temporarily in backups, logs, caches, or archival systems and are not returned to the live Platform except when needed for disaster recovery, legal compliance, or security.

10. Security

IVY uses administrative, technical, organizational, and physical safeguards designed to protect information from unauthorized access, disclosure, alteration, misuse, or destruction.

However:

• no system can be guaranteed completely secure;
• no method of transmission or storage is entirely risk-free;
• and IVY cannot guarantee absolute security, availability, or confidentiality.

Users are responsible for maintaining the security of their account credentials and devices.

11. Your Rights and Choices

Depending on your jurisdiction and applicable law, you may have rights to:

• access certain information;
• request correction of inaccurate information;
• request deletion of certain information;
• object to or restrict certain processing activities;
• or manage certain communication preferences.

IVY may request additional information to verify identity before responding to requests.

Certain rights may be limited by law, legitimate business needs, security concerns, or the rights of other users.

IVY will respond within the period required by applicable law. For a verified United States state privacy request, this is generally within 45 days, subject to any lawful extension. You may appeal a denied privacy request by replying to our decision or emailing the address below with “Privacy Appeal” in the subject line.

Privacy-related requests may be submitted to:

team@getivy.app

12. Third-Party Services and Links

The Platform may contain links to third-party websites, integrations, or services.

IVY is not responsible for the privacy, security, content, or practices of third parties.

Your interactions with third-party services are governed by their own terms and policies.

13. United States Service

IVY is based in Arizona and is offered only in the United States. Information may be stored or processed in the United States and in other jurisdictions where our service providers operate, subject to applicable law and provider safeguards.

14. Changes to This Privacy Policy

IVY may modify this Privacy Policy at any time.

Material changes may be communicated through the Platform, email, or other reasonable methods.

We will post the effective date of an updated policy. If a change requires additional notice or consent under applicable law, we will provide it before the change applies.

15. Contact

Questions, concerns, or privacy-related requests may be directed to IVY MANAGEMENT GROUP LLC at:

team@getivy.app