Privacy information
This page explains how BuurUnion uses personal data in the current service and how access to that data is controlled.
Personal data we process
Account data: email address and authentication information. Passwords are managed by Supabase Auth.
Profile data: display name, city or town, and optionally a profile photo and unit/apartment number (the unit is only shown to neighbours if you switch this on).
Building membership: which building you belong to, how your access was verified and its status.
Community content: activities you create or join, messages, and reports you submit.
Records of your Terms acceptance (version and time), access requests and account deletion requests.
Why we process it
To create and secure your account, verify that you live in the building, and let neighbours organise and join activities.
To keep the community safe through moderation, reports and protection against misuse.
Who can see your data
Neighbours in your own building see your display name, city, optional photo and, only if you allow it, your unit. Your email is never shown to other residents.
Building Administrators can view membership and access-request information for their assigned buildings. Administrator access is controlled by database permissions.
Service providers
Supabase provides our database, authentication and file storage.
Cookies and browser storage
BuurUnion uses browser storage for your sign-in session and a last-activity timestamp used to sign you out after 24 hours of inactivity.
Create Activity drafts are saved in your browser so unfinished fields can be restored when you return. The saved draft is cleared after a successful submission.
Your profile
You can update your profile details on your Profile page and choose whether your unit/apartment number is visible to neighbours.
Account deletion
You can submit an account deletion request under Profile, Account & personal data. BuurUnion records the request; submitting it does not immediately delete your account.
Security
Access to data is restricted per building and per role at database level, passwords are handled by our authentication provider, registration codes are stored only in protected (hashed) form, and inactive sessions end after 24 hours.