Privacy Policy

OverYarn is a campus social network operated by the OverYarn team. We are the data controller for the personal data described in this policy.

OverYarn is free to use. We do not sell subscriptions, take payments, or process any card details.

Account Information: Your username, email address, date of birth, university name, and course — collected when you register. You may optionally add a real first and last name.

Login Credentials: Your password is never stored. We store only a salted, irreversible hash of it, and a hashed session token that keeps you logged in.

Profile Data: Avatar photo, bio, favourite drink, relationship status, society memberships, featured societies, and any optional social links you choose to add.

Posts & Public Content: Feed posts, comments, votes, reposts, stories, voice notes, photos and videos you publish, and society updates, polls and events you create.

Messages: Private messages between students and society channel messages, including attachments and reactions. Message content is stored so it can be delivered and shown in your chats.

Academic Data: Modules, assignments, grades, notes, timetable entries, and any course files or timetable PDFs you upload. This is private to your account and never shown to other students.

Student ID Card Data: If you choose to build a virtual student card, the photo, name, card number and issue date you enter. This is optional and visible only to you.

Stickers & Connections: Friendships, friend requests, blocks, sticker collections and any joint selfies taken during a sticker handshake.

Usage Data: App visit dates and post view counts, used to calculate streaks and to rank the feed. We do not build advertising profiles.

Notification Data: If you enable push notifications, the browser push subscription for your device.

All data is used strictly to run the app. We do not sell or rent your personal data.

Specific uses include: authenticating you, delivering and ranking the feed, delivering messages and notifications, showing your profile to other students, running society channels, events and polls, tracking your academic deadlines, and keeping the platform safe.

We use your email to send verification codes, password reset codes and account deletion confirmations. We do not send marketing emails.

Legal bases (UK GDPR): performance of a contract (running your account), legitimate interests (safety, moderation, preventing abuse), and consent (push notifications, optional profile details).

OverYarn is a social platform, so some data is visible to others by design. Your username, avatar, bio, university, course, member number, profile details, posts, comments, stories and society activity are visible to other signed-in students, and to guests browsing the public preview feed.

Anonymous posts hide your username from other students, but we still store the author internally so we can act on reports and abuse. Anonymity is not a shield against moderation or a lawful request.

Private messages are visible only to you and the people in that conversation. Society channel messages are visible to members of that society, and channels may be restricted to certain roles.

Anything you post can be screenshotted or saved by others. Please do not share information you would not want circulated on campus.

You can report posts and users, and block other students, from within the app. Reports include your username, the reported username, a reason and any details you add, and are reviewed by our moderation team.

Where necessary to investigate a report or protect users, moderators may review reported content, including the author of an anonymous post and messages that are reported to us.

We may remove content, restrict features, or suspend or delete accounts that breach our rules or UK law.

Some optional features use AI services to process content you submit: generating study guides from your course materials and extracting your timetable from a PDF you upload.

When you use these features, the relevant file or text is sent to our AI processing provider to produce the result. This happens only when you trigger the feature, the output is stored against your own account, and this content is not used to train third-party models.

Media you upload (profile pictures, post images and videos, story photos, voice notes, sticker selfies, chat attachments and course files) is stored on secure cloud storage. Stories expire after 24 hours. You can delete your own posts, messages and media at any time in the app.

We do not sell your personal data. We share it only with:

• Infrastructure providers that host the app, its database, file storage, email delivery and push notifications, under data processing agreements.

• AI processing providers, only for the optional features described in section 6.

• Law enforcement or authorities where required by law, or where necessary to protect the safety of our users.

Some providers process data outside the UK. Where they do, transfers are protected by appropriate safeguards such as UK International Data Transfer Agreements or Standard Contractual Clauses.

Your account data is kept for as long as your account is active. Verification and password reset codes expire within minutes, and login sessions expire automatically.

You can delete your account at any time from Settings, or via our Account Deletion page. For security, deletion is confirmed with a code sent to your email address.

Deletion removes your profile, posts, comments, messages, academic data and uploaded media. Copies may remain in encrypted backups for up to 30 days, and we may retain a minimal record of moderation actions where we have a legal obligation or safeguarding reason to do so.

You have the right to access your data, correct inaccurate data, request deletion, restrict or object to processing, withdraw consent, and receive a copy of your data in a portable format.

To exercise any of these rights, use the Account Deletion page or email overyarn.team@gmail.com. We aim to respond within one month.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

OverYarn uses browser storage to keep you signed in and to remember preferences such as your theme, active tab and cached feed content, and to hold messages you have written while offline. We do not use third-party advertising or tracking cookies.

OverYarn is intended for university students aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe an underage account exists, contact us and we will remove it.

All traffic is encrypted over HTTPS. Passwords are stored only as salted, irreversible hashes, and login sessions are stored as hashed tokens with an expiry. Sensitive data such as messages, notifications and reports is only accessible through authenticated server-side checks scoped to your own account, and repeated failed login attempts are rate limited.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at overyarn.team@gmail.com.

We may update this policy from time to time. We will notify users of material changes in the app. Continued use after changes constitutes acceptance.

OverYarn — overyarn.team@gmail.com

For data requests: Account Deletion Form