MKUConnect Privacy Policy

Effective date: March 6, 2025

1. Introduction

MKUConnect (“we”, “us”, “our”) is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights over that data. It applies to all users of the MKUConnect platform.

2. Data We Collect

Account Data

Your MKU institutional email address, collected at sign-up via Supabase Auth (magic link).

Profile Data

Nickname, campus, course, year of study, bio, connection intent, relationship intent, and profile photos you choose to upload.

Interaction Data

Likes you send, mutual matches, messages you exchange with other users, and profile views.

Usage Data

Standard server logs (IP address, browser type, pages visited, timestamps) collected automatically by our hosting provider.

Consent Records

The timestamp at which you accepted these Terms and this Privacy Policy.

3. How We Use Your Data

To authenticate you and maintain your account.
To display your profile to other verified MKU users.
To facilitate matches and real-time messaging between users.
To calculate and display platform statistics (e.g. match counts).
To investigate reports of abuse and enforce our Terms of Service.
To improve platform performance and user experience.

4. Data Sharing

We do not sell your personal data. We share data only in the following limited circumstances:

Supabase — our backend-as-a-service provider, which stores your data in secure, encrypted databases hosted in the EU (Frankfurt region by default).
Vercel — our hosting provider, which processes web traffic and may log request metadata.
Other users — your profile information (nickname, photos, campus, course, bio, intent) is visible to other verified MKU users on the platform. Your email address is never shown to other users.
Legal obligation — if required by Kenyan law or a valid court order.

5. Data Retention

We retain your data for as long as your account is active. If you delete your account, your profile and messages are removed from public view within 30 days. Anonymised aggregated statistics and legal compliance records may be retained longer.

6. Security

All data is transmitted over HTTPS. Your database records are protected by Supabase Row Level Security (RLS), which ensures that users can only access data they are authorised to see. Passwords are not stored — we use passwordless magic-link authentication only.

7. Your Rights

Under applicable Kenyan data protection law (Kenya Data Protection Act 2019), you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — correct inaccurate data by editing your profile.
Erasure — request deletion of your account and associated data.
Portability — request your data in a structured, machine-readable format.
Objection — object to processing of your data for certain purposes.

To exercise any of these rights, email us at support@mku-connect.app.

8. Cookies & Local Storage

MKUConnect uses browser local storage to maintain your authentication session (managed by Supabase Auth). We do not use third-party tracking cookies or advertising cookies.

9. Children

MKUConnect is not intended for anyone under 18 years of age. By registering, you confirm you are 18 or older. If we become aware that a user is under 18, we will deactivate their account immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the effective date above and, where the changes are significant, notify users in-app. Continued use of MKUConnect after changes constitutes acceptance of the revised Policy.

11. Contact

For privacy-related enquiries, contact us at support@mku-connect.app.