Privacy Policy
Last updated: October 21, 2026
RepU (“we”, “us”) is a students-only app where college students rank up by playing games for their school. This policy explains what we collect, why, and what we will never do with it.
The short version
- We do not sell your personal information. We never have and never will. We also do not “share” it for cross-context behavioral advertising, as California law (CCPA/CPRA) defines those words.
- No ads. No ad trackers. No analytics tools that build a profile of you.
- Other players see your handle, school and game results. They never see your email.
- Delete your account in the app and your data is erased right away.
What we collect and why
| Information | Why we need it | Who can see it |
|---|---|---|
| School email address | Sign in, and prove you’re a student at that school | Only you |
| Password | Sign in | No one. Only a one-way bcrypt hash is stored |
| Handle, profile look, motto | Your public player card | Signed-in players |
| School (from your email domain) | Rank you for your school | Signed-in players |
| Games, scores, ratings, shot stats | The rankings | Signed-in players |
| Proof photos you choose to add | Verify a result | Signed-in players |
| Chat and direct messages | School, club, global chat and messages with friends | The people in that chat |
| Friends, blocks, votes, reactions | App features | You (and the friend or vote total) |
| Feedback you send | Fixing the app | Only RepU admins |
| Push notification token | Game alerts, if you allow them | No one else |
We do not collect your contacts, precise location, browsing history, advertising ID, or anything from other apps.
How we protect it
- All traffic is encrypted in transit (HTTPS/TLS), and the database and photo storage are encrypted at rest (AES-256).
- Database rules on every table let each player read only what they’re allowed to. Private fields like your email are blocked from other players.
- Passwords are hashed with bcrypt. We can’t see them.
- Sign-ups without a school email are refused by the server.
If we ever learn of a breach that affects your information, we’ll tell affected players and the authorities as the law requires.
Who helps us run RepU
These companies process data only to provide their service to us. They are service providers, not buyers: Supabase (database, sign-in, photo storage), Resend (sign-in and password emails), Expo (push notifications), and Apple and Google (app delivery). We only disclose information if the law requires it.
Deleting your account
Me → Account → Delete account immediately erases your email, password and sign-in history; your profile, ratings, stats, titles, friends and blocks; your chat messages, direct messages, reactions and votes; your proof photos; and feedback and game ideas you sent. Finished games stay on your opponents’ records as “Deleted player”, with nothing that links back to you. Encrypted backups held by our hosting provider roll off within 30 days.
Your rights
Wherever you live, you can ask to see, get a copy of, correct or delete your data. Email [email protected]. We answer within 30 days and never treat you differently for asking.
Age
RepU is for college students who are 18 or older. We don’t knowingly collect information from anyone under 18, and we delete any account we find that belongs to someone under 18.
Changes
If we change this policy, we’ll update the date above and tell you in the app first. We will never change it to allow selling your information.
Contact
RepU, created by Parker George White · [email protected] · playrepu.com