Privacy Policy

UAE law treats everyone under 18 as a child. You can use Coldge at 16 or 17, but please talk to a parent or guardian about it. Coldge does not have age checks, parental controls or separate settings for under-18 members yet. We are adding age checks and extra protections for members under 18, as UAE law requires. Until then, use these tools:

• Block someone so they can't message or call you, add you to ordinary groups or see your online status and personal posts.
• Report any message, person, group, post or other content.
• In Profile, set Phone Number Visibility to Messaged or No One, and turn off Online Status and Show Me in Most Active. All three start fully open.
• Share posts and events with your university only, and make your groups private.

• Account: personal email, username, full name, phone number (required, never verified) and password (stored only in scrambled, hashed form).
• Profile: bio and photo, and a history of changes to your name, username, bio and photo (for your phone number, only that it changed).
• What you create: messages, voice messages, photos, videos, files, reactions, poll votes, posts, comments, events (including places), Drive uploads, groups, saved items, reservations, follows and blocks.
• Reports and requests: reports and their reasons, problem reports (description, up to 3 screenshots and device details), and emails you send us.
• Settings: privacy, notification and chat backup choices.

When you sign in with your university's Microsoft account, Microsoft sends us your university email, name, account identifiers, Coldge role (student or faculty) and the groups your university assigned to Coldge (up to 200, used for badges). We keep an encrypted sign-in token so we can check with Microsoft, about once a day, that you are still a member. We don't read your university's directory.

If your university connects its student system (Banner), we receive, about members only, your major, college, program, academic level, campus, enrollment status and course sections. We never read grades, transcripts, fees, date of birth, addresses, phone numbers, photos, gender, religion or ID numbers. No university has connected Banner yet.

• Device: model, operating system, app version, device name, a device ID, push tokens and browser type.
• Sign-ins and sessions: when and how you sign in (QR code, password or Microsoft), your linked devices, and when app sessions start and end (the open app checks in every minute).
• Activity status: whether you are online, when you were last seen, when you are typing or recording, and when messages reach you and are read.
• Calls: a record of who called whom, when and for how long.
• IP address: our network providers see it and our sign-in system records it. For QR code sign-in we keep a scrambled version and the approximate country, shown on your phone so you can check the request.
• Legal documents: which version of our documents you accepted or saw, and when.
• Usage analytics and crash reports (see "Analytics").

Other members can mention you, add you to groups and report your content, which can copy your messages.

• We never ask for your device's location, contacts or calendar. If you add a place to an event, its address and map location are stored and shown to everyone who can see the event.
• Face ID and fingerprint checks stay on your device.
• Coldge does not remove details your camera adds to photos, such as where they were taken.

Most of what we do is needed to give you Coldge under our Terms of Service:

• running your account and profile, connecting it to your university through Microsoft and re-checking your membership;
• delivering messages, calls, posts, events, groups, Drive files and notifications;
• sending the emails the service needs, such as codes, sign-in alerts and account notices, to your personal email and often your university email too. You can't unsubscribe from them, and we send no marketing emails;
• keeping Coldge safe: limiting repeated requests, scanning uploads for malware, reviewing reports and moderating;
• understanding how Coldge is used and fixing problems, through analytics and crash reports.

We use and keep data when UAE law requires it, such as for lawful requests from UAE authorities.

We send push notifications only if you allow them on your device. Turn them off in your device settings at any time to withdraw that permission. Your device also asks before Coldge can use your camera, microphone or photos.

We record how Coldge is used, linked to your account: app sessions and time spent; posts, events and groups you see, open or interact with; messages that appear on your screen (which chat and when, never the text); links you open (the website's address only); and searches. Chat and message search run on your device, and for people search we record only the length of what you typed. Other searches are stored scrambled. Your university sees a search term, without names, only once at least 5 students have searched for it.

Your university's staff see totals, and an Administrator can open one student's activity summary (sessions, time spent, messages sent, groups joined and events), with each view recorded. Organization members see counts for their channel and who posted in it. There is no setting to turn analytics off today. Crash reports hold technical details only, never your name, email or messages.

People at Coldge or the university involved review reports. We keep a moderation record for each member (reports about them, mutes, suspensions and a score based on these) so staff can see history; it never triggers an action by itself. Our only automatic checks are the daily membership check with Microsoft (whose result follows your university's settings), limits on repeated actions and malware scanning.

In direct messages, private groups (not discoverable) and class chats (section and course chats):

• reporting shares a readable copy (see below);
• our servers always see who sent a message, in which chat, when, its size and type, and who was mentioned;
• making a group private encrypts only new messages, and earlier ones stay readable;
• some messages are written by our servers and are readable by Coldge: event follow-ups from organizations, messages your university sends to groups of students, and messages from Coldge.

These are stored in a form Coldge can read:

• Official channels: your university's channel, organization channels and the Coldge channel. Members see who reacted and voted.
• Discoverable groups. New groups are discoverable by default, with joining set to Anyone and the audience set to All Universities. You can change this when you create a group.
• Posts and comments. Posts go to All Universities by default, readable by verified members at every university.
• Events, with their exact place and who is interested. All Universities events can be seen by anyone signed in.
• Calls. The Coldge app has no call recording feature; calls run through a third-party video service.
• University Drive files, visible to members of your university.
• Profiles, and files sent in chats that are not encrypted.

Polls are not anonymous anywhere: members can see who voted for what.

• Any member at any university on Coldge can see your name, username, photo, bio, university and badges. Anyone with the link to your profile photo can view it, even signed out.
• Your phone number is visible to every member until you change Phone Number Visibility.
• Any verified member at any university can message or call you. There are no message requests.
• In groups where joining is set to Anyone, members can add you without asking. You can leave.
• The Most Active list covers all universities, and your activity score shows on your profile even if you leave the list.
• While Online Status is on, any signed-in member at any university who you haven't blocked can see whether you are online and when you were last seen, not only the people you chat with.

The reporter's app sends a readable copy of the message, plus up to 10 messages before it and 10 after it, from everyone in that part of the chat, with their photos, videos and files. This includes encrypted chats. A report about a person or group can also share the last 10 messages of that chat (ticked unless the reporter unticks it).

The copies go to Coldge's moderators and the Operators and Administrators of the university involved. The people whose messages are included are not told. Copies are kept with no time limit, even after accounts are deleted. Coldge records each time its moderators open them; university views are not recorded today. Reports of posts, comments and events keep a copy of the item.

Every Operator and Administrator at your university is a member of your private university chat and can read all of it, including messages from before they joined. What they type there is end-to-end encrypted, but Coldge's server approves their devices from their university role, not you, and you can't reply in this chat.

Coldge's staff use an Operations dashboard that shows your account details including your personal and university email addresses, memberships, devices and sessions (not IP addresses), moderation record, every report and reporter, reported copies (moderators only), posts, comments, events and problem reports. Their actions are recorded. It has no page for reading direct chats, groups or university channels outside reports.

• Read receipts can't be turned off. In direct messages and groups, senders see when each person received and read a message. Organization admins see this for their own channel messages, your university's Operators and Administrators for any message in its channels and private university chats, and Coldge in its own channel. These views are not recorded.
• Typing and recording indicators are shown to the people in the chat and can't be turned off.

Notification previews may show the sender, the chat name and the start of the text for chats that are not end-to-end encrypted, posts, comments and account notices, and they pass through Apple, Google and Expo. Notifications for end-to-end encrypted chats carry only encrypted content. Call notifications always show the caller's name and photo.

A preview can hold up to 120 characters of a message or 100 of a post or comment. You can hide previews in your phone's notification settings. In Coldge, Profile, then Notifications mutes each kind except new-device sign-ins.

Coldge decides how accounts, profiles, direct messages, student groups, security and our own analytics work. Your university decides who may join, runs its official channel and its private messages to students, chooses staff roles and membership rules, reviews reports about its members and content, uses analytics about its community, and decides whether to use class chats. For these, Coldge acts on your university's behalf, and your university's own privacy notice also applies.

Depending on their role (Analyst, Operator or Administrator), your university's staff can see:

• your university email, Microsoft link status, Coldge role and when it was last checked;
• your membership history (including staff notes), your badges (including hidden ones) and your moderation record from its own reports and mutes;
• your profile change history (old and new name, username, bio and photo), also after you leave;
• your activity summary (Administrators only, each view recorded);
• everything in your private university chat, its official channel and its organizations' channels, with read receipts;
• reports it owns, with their copies, and posts, comments, events and Drive files from its members;
• if a badge means your profile changes need approval, the changes you ask for, including a new phone number.

It can't see your personal email, your phone number (except in that case), devices or sign-in history. Its dashboard doesn't show direct messages, private groups, class chats or discoverable group messages, except reported copies, or other universities' content.

If you no longer have a Coldge role, or Microsoft asks you to sign in again and you don't within 14 days (we remind you on days 0, 7 and 13 at both emails), or no check succeeds for 30 days, your university's setting decides:

1. 1.your access ends, and you can rejoin by signing in with Microsoft if you are eligible again;
2. 2.your access ends and you can't rejoin until an Administrator removes the block; or
3. 3.you keep access and your university reviews your case by hand.

Your university can also end your access itself. When access ends, you lose its channel, your groups, your organization memberships there and your badges. You keep your account, username, posts, events and direct chats, but you can't send messages, react or upload until you join a university again. We tell you by notice and email.

Coldge can pause a university. While it is paused, its members can't use Coldge except to see the pause notice and sign out. Nothing is deleted.

If a university leaves, Coldge pauses it and starts a 30-day deletion, which it can cancel before day 30. On day 0, everyone's access ends (with an email and a notice) and group chats left empty are deleted. On day 30 we delete the university's data, including its channels, groups, posts, events, Drive files, analytics, Banner data and Microsoft links. We keep your Coldge account and profile, reports and their copies, records of staff and Coldge actions, and your membership history.

If your university turns this on, Coldge uses Banner to add you to section chats (instructors are admins) and course chats (students only), both end-to-end encrypted, and emails you when they open. Staff can message groups of 10 or more students chosen by details such as major. We delete Banner academic details 14 days after Banner last confirms them or when your membership ends, class lists 30 days after a chat closes, section details 12 months after the term ends, and Banner access records after 12 months.