Privacy Policy

What we collect. Your email (to sign you in, and to check a miami.edu address for the student badge). What you choose to put on your profile: name, photo, class year, bio, and an Instagram handle if you add one. Your listings, with their photos, walkthrough videos, address and map point. Documents you send for review: listers send proof they may rent the place out, and listers who are not UM students also send a legal or company name and a photo ID; anyone may send a guarantor letter, a past landlord's reference, or, without a miami.edu email, a document that shows they are part of UM (such as an admission letter, an I-20 or a UM ID card), which is also what lets someone without a miami.edu email post a place. Documents you share with a match. And what you do in the app: saves, passes, requests (with the short note you can add to one), messages, reports and blocks.

If you leave your email on one of our sign-up forms before making an account, we keep it with what you told us you are looking for, so we can write to you when something fits.

What others see. Anyone, signed in or not, can see live listings: their photos, videos and description, an approximate area (a map point moved up to about 100 meters from the real one), the distance to campus rounded to 100 meters, the lister's first name and the checks we have done. Signed-in members can see your profile name, photo, class year, bio, the badges you have earned, your Instagram handle if you added one, and any Roomies card you publish. Roomies photos are stored as public links. Your email is never shown. A listing's exact address is visible only to the lister and the renters they have matched with.

Who helps us run it. Supabase stores the database and files and handles sign-in, on servers in the United States. Vercel hosts the website, and its web analytics counts page views without cookies: the page, the site you came from, your country, and your type of device and browser, with no way to follow you to other sites. Resend delivers our emails. If you sign in with Google, Google tells us your name and email. Maps load from OpenFreeMap, which sees your internet address the way any website does.

AI. When you describe a search in your own words, that text goes to an AI service (through OpenRouter) that turns it into filters. On the website, when someone sends you a chat message our word list does not recognise, that one message can get a second look for payment red flags, with emails, phone numbers, handles and long numbers removed first. Messages you are still typing never leave your device. We only allow AI providers that do not store or train on this text, and nothing we send names you or your match.

What we don't do. We don't sell your data or show ads, and we share it with no one beyond the services above, unless the law requires it.

Emails we send. Sign-in codes, the result of a review, a reminder before your listing's end date, and notices about your listing. When someone sends you a request, accepts yours, or messages you, we email you too, unless you turn that off on your profile. Those emails never contain the message itself, a request note, or an address. If you left your email on a sign-up form, we may write when a place fits what you asked for. Ask us to stop any time at hello@crashmia.com.

How long we keep it. Review documents are deleted when the review is decided. Everything else stays until you delete it or your account, except as described below. Crash is for people 18 and over, and we do not knowingly collect information from anyone younger.

Keeping it safe. Everything travels over encrypted connections, and rules inside the database decide who can read what. Review documents are seen only by you and the two Crash reviewers, and are deleted when the review is decided. An exact address is seen by the lister, the renters they accept, and the reviewers. A note on a request is seen only by you and the person you send it to. Files you share in a match can be opened only by the two of you, while the match is open; nobody at Crash opens or reviews them. A chat is seen only by the two people in it, unless one of them reports a message to us. No system is perfect. If someone ever gets at your personal information without permission, we will tell you promptly, and no later than 30 days after we find out.

Counting visits. We count how many times each kind of page gets opened, and the city your internet connection reports. Never your exact location, and never coordinates. It's kept as a daily total per city, so there's no record of one person moving from page to page, and nothing links a visit to your account. This happens whether or not you're signed in.

Delete your account anytime from your profile, on the website or in the app; your profile, listings, swipes, matches, and messages go with it. Deletion happens when you confirm it, after the app removes your uploaded listing photos, Roomies photos, walkthrough videos, review files, and shared match documents. Review files are removed as part of the review process; shared match documents remain available to their uploader until the uploader removes them or deletes their account. Reports you filed or that were filed about your content may remain as anonymous moderation records: your account link is removed, but the report reason, details, and moderation text needed to act on it may remain.

Your choices. Wherever you live, you can ask what we hold about you, have it corrected, get a copy, or have it deleted. You can change most of it yourself on your profile, and the delete button removes your account in one step. To ask us directly, email hello@crashmia.com from the address you signed up with, and we will answer within 45 days. We won't charge you or treat you differently for asking.

Reporting a listing. Every listing page has a Report link. If a place is a scam, already gone, or the ad discriminates against you, tell us there; it goes straight to a person. Housing discrimination is illegal under the federal Fair Housing Act, and you can also report it to HUD.

Taking a listing down. If someone listed a property you own or manage without your say-so, or a listing uses your photos, email hello@crashmia.com with a link to the listing and how you're connected to the property. We'll take it down while we look into it, no lawyer needed to ask.

Questions: hello@crashmia.com