Privacy Policy

The Rock is a noticeboard built by students, for people at Roanoke College. It is not run by the college. This page says, in plain words, what we keep about you, who can see it, how long it stays, and how to make it go away.

What we keep

• Your account. Your @mail.roanoke.edu or @roanoke.edu address and your name. If you set a password, we keep only a scrambled version of it (a scrypt hash) — nobody, including us, can read it back.
• Your profile. Whatever you choose to fill in: student or staff, class year, major or department, residence hall, job title, pronouns, hometown, a short bio and a profile photo. All of it is typed in by you.
• What you post. Marketplace listings and their photos, rides and ride requests, events, course reviews, Spotted posts and replies, and dish ratings.
• What you do in the app. Dishes you favourite, listings you save, events you RSVP to, meals you log, how busy you say a dining hall is, courses you add, and posts you heart.
• A little technical detail. A cookie that keeps you signed in; a description of each browser you're signed in on, so Settings can show your devices; your IP address when you ask for a sign-in email, to stop anyone flooding inboxes; and, if you turn on notifications, the address your browser gives us to deliver them.

What we don't

• Nothing from the registrar or any other college system. Courses are whatever you tell us.
• No payment details — no money ever moves through The Rock.
• No location tracking.
• No advertising, no analytics services, no tracking cookies.

Dining menus and nutrition facts are read from the college's public menu pages. They are about food, not about you.

Who can see what

• Everyone signed in — which means people with a confirmed Roanoke address — can see your profile in the directory, including your email address, anything you post under your name, and which events you've said you're going to.
• Your courses are shown to classmates only for the courses where you leave sharing on. You can turn it off per course.
• Anonymous Spotted posts don't show your name to anyone on the board. Moderators can still see who wrote them, so that abuse can be dealt with. Replies always show your name.
• Only you see your meal log, your saved listings and your list of favourite dishes. Others see only counts — how many dishes you've favourited, how many people saved a listing — never who or which. Busy-ness reports are only ever shown combined with everyone else's.
• Moderators and admins can read and remove content. Every removal is logged: who removed it, whose it was, and the first line or so, so the decision can be explained later.
• Nobody else. We don't sell or rent your information, and we don't share it with advertisers or with the college. Signed-out visitors and search engines see only the public pages — the landing page, the story of the name, sign-in, and these two documents.

What we're not responsible for

The Rock is a noticeboard. It helps members find each other, and that's where its part ends.

• Rides. We don't provide, arrange, check or insure rides, and we don't vet drivers, passengers, licences, insurance or cars. A ride is an arrangement between the people in the car, and they are responsible for it.
• Things bought and sold. We aren't a party to any sale and never handle payment. We don't check who's selling, or whether an item is as described, safe, legal or theirs to sell. Every sale is between the buyer and the seller.
• What happens away from The Rock. Once you email, text or meet someone you found here, what's said and done — and what they do with your number, address or anything else you give them — is outside our control and outside this policy.
• What other members post. Listings, reviews and posts are written by members, not by us. We don't check them for accuracy and don't endorse them.

You use the marketplace and ride board at your own risk. The Terms of Use set this out in full, including the limits on our liability, and agreeing to them is part of having an account.

Services we rely on

A few companies run the machinery for us. They handle your data only to provide that service:

• Vercel hosts the site and stores uploaded photos.
• Neon hosts the database.
• Resend delivers sign-in and confirmation emails, so it sees your email address.
• GitHub holds a nightly backup of the database in a private repository.
• Your browser's push service (Apple, Google or Mozilla) delivers notifications, if you turn them on. The contents are encrypted so the push service can't read them.

These services are based in the United States, and so is your data.

How long it stays

• Your account and what you post stay until you delete them or ask us to delete your account.
• Sign-in links and codes expire after 15 minutes and are deleted once used or expired. Each sign-in lasts up to 30 days.
• Records used to stop repeated sign-in attempts are deleted after a day; the record of which notifications we sent, after 30 days.
• Backups are kept for 90 days, so something deleted today is gone from every copy within 90 days.

Your choices

• Edit your profile, change or remove your photo, turn notifications off, and sign out other devices — all from Settings.
• Delete listings, events, reviews, ratings and meal-log entries you've posted, and cancel rides, from wherever they appear.
• Delete your account by emailing privacy@therockroanoke.tech from your Roanoke address. We'll remove the account and everything attached to it within 30 days. Anonymous Spotted posts are kept with no link to you, unless you ask for those removed too.
• Ask what we hold about you, or have something corrected, at the same address.

Keeping it safe

The site is only served over HTTPS. Passwords are hashed with scrypt. Sign-in links, codes and session cookies are stored only in hashed form, so a copy of the database would not let anyone sign in as you. Sign-in attempts are rate limited, and codes stop working after six wrong tries. No system is perfect — if you find a problem, please tell us at privacy@therockroanoke.tech, and if your data is ever exposed, we'll tell you.

If the law asks

We would only hand over information about you if the law requires it, or if it's needed to protect someone from serious harm.

When this changes

If we change this policy in a way that matters, the date at the top changes and you'll be asked to agree again before you carry on using The Rock.

Questions

Write to privacy@therockroanoke.tech. A person reads it.