Privacy Policy
Last updated: October 31, 2026
UniBooks (the "Platform") respects your privacy. This policy explains what data we collect, why, how we use and protect it, and the rights you have. It is written in accordance with Taiwan's Personal Data Protection Act ("PDPA") and related regulations.
By using the Platform you acknowledge that you have read this policy. If you do not agree, please stop using the Platform.
1. Who We Are
The Platform is operated by the CycleUni team. For any question or request about your personal data, write to services@unibooks.app.
2. What We Collect
2.1 Data you provide
| Category | Details | When |
|---|---|---|
| Account | Email, name or nickname, avatar, language preferences | Sign-up, profile edits |
| Sign-in | Password (stored only as a one-way hash); if you use Google sign-in, the Google account identifier, email, name and avatar Google shares with us | Sign-up, sign-in |
| Passkeys | If you add a passkey: its public key, credential ID, a name you give it, device type and whether it is synced or backed up, the authenticator model ID (AAGUID), a sign-in counter, and creation and last-use times. Your fingerprint, face or screen-lock data is checked only on your device, never leaves it, and is never received by us | Adding a passkey, signing in with one |
| Student verification | School, .edu.tw school email, verification time, expiry date and re-verification records; for manual review, the supporting information and request notes you submit | Verification |
| Listings | Title, ISBN, price, condition grade and description, condition photos | Creating a listing |
| Transactions | Orders, order status, cancellations, completion confirmations | Ordering, meetups |
| Communications | In-app chat messages and timestamps | Messaging other users |
| Restock alerts | Books you add to alerts or your wishlist | Using restock alerts |
| Reports & appeals | Reported party, reason, attachments and handling records | Filing a report |
| Support | Content of emails you send us | Contacting us |
2.2 Data collected automatically
- Device and connection data: IP address, browser and operating system, screen and language settings, referrer and pages visited, visit times.
- Sign-in state: to keep you signed in and prevent account takeover we store sign-in credentials (refresh tokens) and their expiry.
- Bot protection: when you sign in, sign up or ask for a password-reset link, we use Cloudflare Turnstile to tell people from automated scripts. For this, Cloudflare may process your IP address and signals from your browser and device, and sends us the result of the check; we receive no additional personal data from it. See Cloudflare's privacy policy and Turnstile Privacy Addendum.
- Cookies and similar technologies: see Section 7.
- Usage statistics: anonymous statistics (page views, feature-usage trends) via Google Analytics 4.
- Session replays and heatmaps: we use Microsoft Clarity to record how you use our pages (clicks, scrolling, mouse movement and page layout) to produce session replays and heatmaps that show where the site is hard to use or breaks. Everything you type is masked; chat, checkout, orders, account settings and the admin console are masked entirely; visits opened from an emailed link carrying a one-time token (such as a password reset) are not recorded. A replay is labelled with your region, whether you are signed in, whether you have completed student verification, and the names of actions you took (such as searching or placing an order); if you are signed in it also carries your user ID, hashed in your browser before it is sent. Replays do not include your email or name, or any Google user data.
- Error and performance monitoring: when something breaks, we record the error message, the page it happened on, browser and device type, and a little page-performance data, using Sentry. If you are signed in, the report carries your user ID so we can tell how many people a problem affects; it does not include your email, name or chat content. Sessions that hit an error (and a small share of other sessions) keep a replay of the page, in which all text and input is masked and images are not recorded.
2.3 Data from third parties
- Google sign-in: if you choose it, we receive basic account information from Google.
- Book metadata: ISBN metadata comes from public sources such as Google Books and contains no user data.
We do not ask for or store credit-card, bank or other financial data. The Platform never handles payments between buyers and sellers.
2A. Google User Data
UniBooks offers "Sign in with Google" (Google Identity Services). This section explains how we access, use, share, protect, retain and delete Google user data. If you do not use Google sign-in, we receive no Google user data.
What Google data we access
We request only the basic sign-in scopes openid, email and profile. After you consent, Google gives us a sign-in credential (ID token), from which we receive and store:
| Data | Purpose |
|---|---|
Google account ID (sub) | Links your Google account to your UniBooks account so you can sign in with Google again |
Email address and whether Google has verified it (email, email_verified) | Creating and identifying your account; we accept only Google-verified addresses to prevent impersonation; sending account-related emails |
Given and family name (given_name, family_name) | Your default display name, which you can change in Account Settings |
Profile picture URL (picture) | Your default avatar; refreshed each time you sign in with Google |
Other basic ID-token claims (such as locale, Google Workspace domain hd, issue and expiry time) | Stored with the above as part of the account-link record only; not used for anything else |
We do not access your Gmail, Google Drive, contacts, calendar, YouTube or any other Google service, and we never receive your Google password.
How we use it
Google user data is used only for the sign-in and account purposes in the table above. We do not:
- use Google user data for advertising, including personalized or targeted ads (campus content we show by school is based on your
.edu.twstudent verification, not on Google data); - sell Google user data or give it to data brokers, ad platforms or information resellers;
- use it to build user profiles or determine credit-worthiness or lending eligibility;
- use it to develop, improve or train generalized AI or machine-learning models.
How we share it
We do not sell, rent or transfer Google user data. We share it only:
- with service providers that run cloud hosting, database hosting and email delivery for us, solely to operate the service and under contractual confidentiality;
- with other users, who see your display name and avatar on your profile and listings — your email address and Google account ID are never public;
- where required by law, or with your explicit consent.
Google user data is not sent to Google Analytics and is not given to any advertiser.
How we protect it
- HTTPS for all traffic;
- ID tokens are accepted only after the server verifies their signature against Google's public keys;
- stored in access-controlled databases with least-privilege access limited to authorized staff;
- see Section 6.
Retention and deletion
- Google user data is kept while your UniBooks account exists.
- Deleting your account: you can delete it directly in Account Settings. We immediately delete your Google account-link record (all Google data in the table above), clear the email, name and avatar on your account, and revoke all sign-in tokens.
- Revoking Google access only: you can remove UniBooks at your Google Account permissions page at any time. We can then no longer sign you in with Google and receive no further Google data from you. To also delete what we have stored, delete your account or email services@unibooks.app; we act within 15 days.
Limited Use disclosure
UniBooks' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not allow humans to read Google user data unless we have your explicit consent, it is necessary for security purposes (such as investigating abuse), it is required by law, or the data is aggregated and de-identified and used only for internal operations.
Changes in use
If we ever want to use Google user data in a way not described in this section, we will update this policy, notify you, and obtain your consent before doing so.
3. Why We Use Your Data
We use your data only for these specific purposes:
- Providing and operating the service: account creation and verification, student-status checks and re-verification every two years, book search and listings, matching and chat, order flow, restock alerts.
- Notifications: verification emails, password resets, order updates, restock alerts and, if enabled, new-message emails (you can turn these off in settings).
- Safety and anti-fraud: detecting impersonation, duplicate accounts, spam, abuse and violations of our Terms; handling reports and appeals.
- Improving the product: analyzing anonymized or aggregated usage data, and masked session replays and heatmaps, to improve search and usability.
- Legal compliance: responding to lawful requests from authorities and protecting the rights of the Platform and its users.
- Campus content and ad slots (if any): showing campus-life content based on your school or region, using your student verification data. We never give advertisers data that identifies you, and we never use Google user data for any advertising.
We will not use your data for other purposes; if a new purpose arises we will obtain your consent or notify you as required by law.
4. Retention
- Account and listing data: kept while your account exists.
- Account deletion: when you delete your account we immediately remove your listings, delete your Google account-link record, passkeys, student verification records and restock alerts, and clear the email, name and avatar on your account. To handle disputes, prevent abuse and comply with law, some transaction and report records are retained for as long as necessary in de-identified or access-restricted form, then deleted or anonymized.
- Chat messages: kept while the conversation exists; after account deletion, handled as above.
- Sign-in credentials: until they expire or you sign out.
- Server logs: kept only for a reasonable period needed for security and debugging.
- Error reports: kept for the retention period of our error-monitoring service (Sentry), then deleted automatically.
- Google Analytics data: kept per the Google Analytics retention setting and not linked to your account data.
- Session replays and heatmaps: kept for Microsoft Clarity's retention period, then deleted automatically.
5. Sharing and Disclosure
We do not sell or rent your personal data. We share it only in these cases:
- Other users: to complete transactions, your nickname, avatar, school, listings and condition photos are visible to other users. Chat content is visible only to the participants (and to administrators where needed to handle a report). Your email address is not shown publicly.
- Service providers (processors): we use providers to process data on our behalf and require them to use it only for the Platform and to protect it appropriately:
- Cloud and network services: website hosting, content delivery, file storage, real-time chat and bot protection (Cloudflare, including Cloudflare Turnstile), plus backend and database hosting.
- Email delivery services.
- Error monitoring (Sentry): receives the error reports above, used to find and fix bugs; its servers are in the United States.
- Microsoft Clarity: receives the session replay and heatmap data above, used to improve usability; its servers are in the United States. See Microsoft's privacy statement.
- Google: sign-in, Google Analytics (anonymous usage statistics only — no Google user data or account data), Google Books (catalog lookups, no user data).
- With your consent.
- Legal requirements: court orders, lawful requests from authorities, or where necessary to protect someone's life, body or property.
- De-identified statistics: aggregated data that cannot identify a person (never including Google user data).
International transfers
Our providers' servers may be located outside Taiwan (for example in the United States or elsewhere), so your data may be transferred and processed abroad. We choose providers with appropriate safeguards and follow the PDPA.
6. Security
We take reasonable technical and organizational measures, including:
- HTTPS enforced site-wide;
- passwords stored only as one-way hashes, so we cannot see your original password;
- passkeys store only a public key; the private key stays on your device or in your password manager, and we cannot obtain it;
- bot protection on sign-in, sign-up and password-reset requests;
- short-lived access tokens with rotating refresh tokens;
- least-privilege access to databases and the admin console, limited to authorized staff;
- uploaded images kept in managed object storage.
No internet transmission or electronic storage is completely secure. Please keep your password safe and do not share your account. If you suspect account takeover or a data leak, contact us immediately.
7. Cookies and Similar Technologies
| Type | Purpose | Can you disable it? |
|---|---|---|
| Essential storage | Keeping you signed in, language and theme preferences, security | Some features will not work without it |
| Analytics | Anonymous usage statistics via Google Analytics | Yes — via browser settings or Google's opt-out add-on |
| Session replay | Microsoft Clarity cookies that recognize the same visit and a returning browser; Microsoft may also set cookies on its own domains | Yes — via browser settings |
Bot protection (Cloudflare Turnstile) may store or read a small amount of data in your browser to tell whether you are a person; see Cloudflare's explanation.
You can delete or block cookies and local storage in your browser settings. We do not use cookies for cross-site tracking or personalized advertising.
8. Your Rights
Under the PDPA you may, regarding your own personal data:
- request access or review;
- request a copy;
- request supplementation or correction;
- request that we stop collecting, processing or using it;
- request deletion.
How to exercise them: most data can be viewed and edited in Account Settings, including notification preferences and account deletion. For other requests, email services@unibooks.app from your registered address so we can verify your identity. We respond within 15 days, and if we need more time we will tell you why.
We may decline part of a request where the law requires or business operation necessitates it (for example records needed to resolve a dispute), and will explain the reason. If you withhold required data or ask us to delete or stop using data we need, we may be unable to provide all or part of the service.
9. Minors
The Platform is for students and alumni of Taiwanese colleges and universities. We do not knowingly collect personal data from anyone under 18; if you are a minor, please use the Platform with your legal guardian's consent. If you believe we collected a minor's data without such consent, contact us and we will handle it promptly.
10. Third-Party Links
The Platform may link to third-party sites. They have their own privacy policies and we do not control their content or practices.
11. Changes to This Policy
We may revise this policy for legal, service or operational reasons. Changes are posted on this page with an updated "Last updated" date; for material changes we will notify you through an announcement or your registered email. Continuing to use the Platform after a change means you accept it.
12. Contact
Questions, comments or complaints about this policy: services@unibooks.app. See also our Terms of Service.
The Traditional Chinese version prevails if the two versions differ.