Privacy Policy

1. Who we are

Darwin is a campus marketplace that lets students buy and sell within their university community. It is operated by Vesper Works. In this policy, "we", "us", and "our" refer to Vesper Works. If you have any questions about this policy or your personal information, you can reach us at the address in the "Contact us" section below.

2. Information we collect

We collect the following categories of personal information.

Information you provide

• Account and profile details — when you create an account or complete onboarding: your first and last name, email address, password (stored only in hashed form), university or school, level of study, program, and interests. You may also have a username and profile picture.
• Listings — when you post an item: the title, description, price, category, condition, campus, and any photos you upload.
• Waitlist — if you join our waitlist, your email address.
• Founding membership purchases — if you buy a founding tier, your payment is processed by Stripe. We receive confirmation of the purchase and the tier you bought, but we do not collect or store your full card details.

Information we collect automatically

• Usage and device data — we use Vercel Analytics, which collects aggregated information such as page views, the pages that referred you, approximate location, and device and browser type.
• Cookies — we use essential cookies to keep you signed in and to secure your session. See the "Cookies" section for details.

3. How we use your information

We use the personal information we collect to:

• provide, operate, and maintain the marketplace and your account;
• authenticate you and keep your session secure;
• display your listings and profile to other users;
• send you transactional and service emails — for example, waitlist confirmations — through our email provider, Resend;
• process founding membership payments through Stripe;
• detect, prevent, and address fraud, abuse, and security issues; and
• understand how Darwin is used so that we can improve it.

We rely on your consent, the performance of our agreement with you, and our legitimate interest in operating the service as the basis for these uses.

4. Information visible to others

Darwin is a marketplace, so some information is shared with other users by design. Your listings — including their photos, title, description, price, and the campus you select — are visible to other users. Your display name and school may also be shown alongside your listings.

Please note that photos you upload to a listing are stored in publicly accessible storage, which means anyone with the image link can view the image. Do not include sensitive or personal information in listing photos or descriptions.

5. How we share your information

We do not sell your personal information. We share it only with the service providers that help us run Darwin, and where we are required to by law:

• Supabase — database, authentication, and file storage.
• Stripe — payment processing for founding memberships.
• Resend — sending transactional and service emails.
• Vercel — website hosting and usage analytics.

Each of these providers handles your information under its own privacy and security commitments. We may also disclose information if we are required to do so by law, or where necessary to protect the rights, safety, and property of Darwin, our users, or others.

6. Cookies

We use a small number of essential cookies, set by our authentication provider (Supabase), to keep you signed in and to secure your session. These cookies are necessary for the site to function. We also use Vercel Analytics, which may set or read limited identifiers to measure aggregate usage. We do not use advertising or third-party tracking cookies.

7. Where your data is stored and international transfers

Darwin is intended for students at Canadian universities, but our service providers store and process data on servers located in the United States — for example, our database is hosted in a US region. As a result, your personal information may be transferred to, stored in, and processed in the United States and other countries, which may have data-protection laws different from those in your province. We take steps to ensure your information continues to be protected in accordance with this policy.

8. Data retention

We keep your personal information for as long as your account is active or as needed to provide the service. Waitlist entries are kept until we launch or until you ask us to remove them. You can ask us to delete your account and associated personal information at any time by contacting us; we will delete or anonymize it unless we are required to keep it for legal reasons.

9. Your rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, you have the right to:

• access the personal information we hold about you;
• request that we correct inaccurate or incomplete information;
• request deletion of your personal information;
• withdraw your consent to our processing, subject to legal or contractual limits.

To exercise any of these rights, email us using the address in the "Contact us" section. We will respond within a reasonable time. If you are not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner of Canada.

10. Data security

We take reasonable measures to protect your personal information. Data is encrypted in transit, passwords are stored only in hashed form, and access to data is restricted using database row-level security. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children's privacy

Darwin is intended for post-secondary students and is not directed at children. We do not knowingly collect personal information from children under the age of majority in their province. If you believe a child has provided us with personal information, please contact us so that we can remove it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you. Your continued use of Darwin after the changes take effect means you accept the updated policy.

13. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us at:

info@vesperworks.ca