LincYou Privacy Policy

Effective date: September 1, 2026 · Version 2.1

Your privacy is important to us. We are committed to protecting and ensuring the confidentiality of any Personal Information you provide to us.

LincYou is a student network. It connects students at participating universities so they can find, and speak to, people a little further along than they are. This Policy explains how LincYou Technologies Inc. ("LincYou", "we", "us" or "our") collects, uses, discloses, protects and retains Personal Information when you use the LincYou mobile application and related services (together, the "Services").

In this Policy, "Personal Information" means information about an identifiable individual, as that term is understood under the Canadian privacy legislation that applies to us.

Most of our members are students, and some are sixteen or seventeen, so this Policy is written to be read rather than filed. If you do not agree with it, please do not use the Services.

Highlights

A plain-language summary. It does not replace the full Policy below, and where the two differ, the full Policy governs.

We collect — your email address, name and handle; your date of birth; the education details you enter, being your university, program, campus, start year and optionally your courses, interests, experience and expertise; what you post, comment, message and upload; a small amount of usage and crash data; and basic session security information when you sign in.

We use it — to run the application, to confirm you meet our age requirement, to keep the community safe, to answer you when you contact us, and to fix things when they break.

We share it — with other members, according to where you posted. With a small named set of service providers who process information on our behalf and may not use it for their own purposes. Where the law requires it or someone's safety demands it. We do not sell your Personal Information, we show no advertising, and there are no advertising identifiers anywhere in the application.

What we never do — we do not store, log, or send to analytics anything you type into search. We do not ask for your location, your contacts, your calendar or your microphone, and the application cannot record audio. We collect no payment information, because there is nothing to buy. Your date of birth is never shown to anyone, including our own moderation staff, who see only whether an account belongs to a member under eighteen.

We do not train AI on you — we do not use your Personal Information, your content or your messages to train or fine-tune artificial intelligence or machine learning models. Two features use AI models — search, and Linc, our in-app assistant — both running on Google Vertex AI in Montreal, and Google is contractually prohibited from using that information to train its models. What you type into Linc is processed to answer you and is not stored.

People review reports, not algorithms — a narrow automated filter blocks a small class of content at the point of posting, such as severe slurs and explicit threats; it reads text only and does not scan images or links. Beyond that, nothing scans your posts or your messages, every report is reviewed by a person on our own staff, and no member content is sent to any outside company for moderation.

We do not report you to your university — we do not disclose individual-level information about you to your university, to an employer or to a recruiter. See Section 8.4.

1. Who we are and how to reach us

The Services are operated by LincYou Technologies Inc., a corporation incorporated under the Canada Business Corporations Act, with its registered office at 1500 Royal Centre, 1055 West Georgia Street, Vancouver, British Columbia V6E 4N7, Canada.

We have designated a Privacy Officer who is responsible for our compliance with this Policy and with applicable privacy legislation. You can reach the Privacy Officer at support@lincyou.com, or by mail at the address above.

1.1 Where the Services are offered

LincYou is currently offered in Canada, except Quebec, to people affiliated with a university we support. We plan to add more countries — the United States is next — and this Policy will be updated when we do. We do not offer the Services in Quebec.

Membership works through your university: creating a profile requires choosing a university from the list we support, and we add universities deliberately, one at a time. If your university is not on LincYou yet, you can join the waiting list at www.lincyou.com.

If you travel or go home for a term after you have registered, your account continues to work. Eligibility is assessed when you register, and being temporarily outside Canada does not close your account.

1.2 Which laws apply to us

We are subject to the Personal Information Protection and Electronic Documents Act (Canada) and, where they apply, the substantially similar provincial private-sector privacy acts, including British Columbia's and Alberta's Personal Information Protection Acts.

Separately, Canada's Anti-Spam Legislation governs the invitation emails described at Section 10.3, which are the only emails we send to people who are not members.

2. Changes to this Policy

We may update this Policy to reflect changes to the Services, to our practices, or to the law.

When a change is material, the application asks you to review and accept the new version before you post again, and we record the version you accepted. Every version carries an effective date and a version number, and earlier versions are available from us on request.

3. Other services

The Services link to the app stores through which you obtain the application, and to our own website. This Policy does not apply to services we do not operate. Their handling of your information is governed by their own policies.

4. Information we gather

4.1 Account information

Your email address. Signing in uses a one-time code sent to your email. There are no passwords, so there is no password for us to store or for anyone to steal.

Your name and handle, which you choose.

Your date of birth. We collect it once. We use it to enforce our sixteen-and-over requirement and to apply the additional protections at Section 11. It is never displayed to anyone. Other members do not see it, it does not appear on your profile, and our own moderation staff see only whether an account belongs to a member under eighteen.

4.2 University verification

You can create an account with any email address. Your account is unverified until you confirm that you control an official university email address, which you do by entering a one-time code we send to it. Verification tells other members that your affiliation with the university is genuine.

An unverified account can use the Services fully, including posting — verification changes what others can rely on about you, not what you can do.

We record the fact of verification, the university confirmed and the date. We do not ask for or collect admission letters, offer letters, transcripts, student cards or any other document, and we do not use a third-party verification service.

4.3 Profile information

You may add your university, program, campus, start year, and optionally your courses, interests, experience, expertise and timeline entries. All of it is information about you that you choose to enter. We do not verify it, other than the university email confirmation described above, and Section 7.1 explains which parts of it other members can see.

4.4 Content you create

Posts, comments, messages, photographs, videos, documents shared in chat, and club and event content.

Content you create may contain Personal Information about other people. Section 10 explains how we handle that.

4.5 Messages

We hold the messages you send and receive, and the information needed to deliver them.

We do not use the content of your messages for advertising, we do not use it to train AI models, and no automated system scans it. We access message content only where it is necessary to operate the messaging feature, to act on a report, to answer a support request, or where the law requires it.

4.6 What you ask Linc

Linc is the in-app assistant described at Section 9.1. What you type into Linc is processed to answer you and is not stored — we keep no transcript of your conversations with it. What Linc's matching keeps is a numerical representation of parts of your profile (Section 9.1); it contains no sentences.

4.7 uCoin

uCoin is a recognition balance that reflects your contribution to the community. It has no monetary value, it cannot be bought, and it cannot be exchanged for cash or for anything else. We hold the balance and the record of the activity that produced it.

4.8 Usage and diagnostic information

We collect structured events describing which features are used, for example that a post was created. These events never contain what you wrote. They are pseudonymous: they carry an account identifier, never your name, your email address or your content.

Your search queries are never stored, never logged, and never sent to analytics.

We collect crash and diagnostic data, being the application version, device type and operating system version, so we can fix faults.

4.9 Security information

When you sign in, the session records an IP address and a browser or device identifier. This is ordinary session security.

If you turn on push notifications we hold a device token, which you can revoke by signing out or in Settings.

4.10 Support and communications

If you contact us we hold your message, our reply, and the record of what we did. We also hold your notification preferences and the record of which version of this Policy and of the Terms you accepted, and when.

4.11 What we do not collect

We do not collect your location. The application never asks for it.

We do not collect your contacts, your device calendar, or audio. The application cannot record audio.

We collect no payment card or bank information, because there is nothing to buy.

There are no advertising identifiers anywhere in the application.

We do not collect government-issued identification numbers.

We do not ask you for information revealing racial or ethnic origin, religious or philosophical belief, political opinion, health or medical information, genetic or biometric data, sexual orientation, immigration or citizenship status, or criminal history. Some of it may nevertheless appear in something you or another member chooses to write. We do not use it to rank, profile or target you, and we could not target you with it in any event, because we sell nothing and show no advertising.

5. Consent

We collect, use and disclose Personal Information with your knowledge and consent, except where the law permits or requires us to act without it.

Express consent. You give it when you create an account and accept this Policy, and again when a material change is published, because the application requires you to accept the new version before you post.

Implied consent. We rely on it where the purpose is obvious from the circumstances, such as using your email address to send you a sign-in code.

Without consent. We may act without consent only in the limited situations applicable law permits, including to investigate a breach of an agreement or a contravention of law, to prevent or detect fraud, to respond to an emergency threatening someone's life, health or security, to comply with a subpoena, warrant or court order, and for the purposes of a business transaction as described at Section 8.6.

Withdrawing consent. You may withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice. Some purposes are essential to providing the Services, and withdrawing consent to those means we can no longer provide them to you. Withdrawal does not affect anything we did before you withdrew.

6. How we use your information

To run the application. Accounts, sign-in, profiles, walls, feeds, posting, messaging, search, Linc, notifications and the uCoin balance.

To confirm eligibility. Your age under Section 11.

To keep the community safe. Automated filtering of a narrow class of content at the point of posting, human review of reports, blocking, rate limiting, and enforcement under our Terms.

To support you. Answering your questions, investigating problems, and keeping a record of what we did.

To keep the application working. Understanding feature usage in aggregate and fixing crashes.

To send you the things the product has to say. Sign-in codes, and notices such as a scheduled account deletion or a change to these documents.

To meet our legal obligations, including our reporting and preservation duties in child-safety matters.

We send no marketing email. The only messages we send to people who are not members are the invitations you choose to send, described at Section 10.3.

7. Who can see what

7.1 Your wall

Your wall is the public part of your profile. It is visible to every signed-in LincYou member, including members at other universities as they join.

Your wall shows your name, your year, your major, and, where you have entered them, the courses you have taken, your experience and your areas of expertise. It shows whether your university affiliation is verified.

Your date of birth and your contact details are never shown on your wall or anywhere else.

7.2 The rest of your profile

Everything else you enter is visible only to you.

7.3 Where your posts go

When you write a post you choose where it goes:

The destination you choose travels with the post wherever it appears.

7.4 Plaza grows over time

Plaza reaches every university on LincYou, and we expect to add universities. A post you make to Plaza today reaches members at the universities on LincYou today, and will reach members at universities that join later, without you doing anything. If you would rather your post stayed within your own university, post it to Campus.

7.5 Messages

You choose who receives a message: an individual, or a group of people you name. Nobody else sees it, and neither Plaza nor Campus has any bearing on it.

7.6 Posting anonymously

You can post without your name being shown. Anonymity is from the community, never from us. The staff who review reports can always see who posted, and we may act on your account for something you posted anonymously exactly as we would for anything else.

7.7 Blocking

You can block another member at any time. You do not need to report them first and you do not need to explain. Blocking takes effect immediately and we do not tell the person you blocked.

7.8 What you cannot take back

Once other people can see something, you cannot unsee it for them. If you delete a post we remove it from the Services, but other members may already have read it, replied to it, screenshotted it or repeated it elsewhere. Where your content has been replied to, we may keep the minimum necessary to keep the reply intelligible.

8. How we disclose your information

8.1 To other members

According to Section 7, and according to whether your university affiliation is verified.

8.2 To service providers

We engage service providers to perform functions on our behalf. They may access Personal Information only to the extent necessary to perform those functions, only on our instructions, and under a written contract requiring them to protect it, to use it for no other purpose, and to return or destroy it when the engagement ends. None of them may use your information for their own purposes.

We never send your data to anyone else, and no third party may use it for advertising or its own products. We will update this table before adding a provider that processes Personal Information in a materially different way or in a new country.

8.3 For legal, safety and compliance reasons

We may disclose Personal Information where we reasonably believe it is necessary to comply with applicable law, a subpoena, a warrant, a court order or another lawful demand; to enforce our Terms or investigate a suspected breach of them; to detect, prevent or address fraud, security incidents or abuse; to protect the rights, property or safety of a member, of LincYou, or of the public, including in an emergency involving a risk to a person's life, health or security; or to establish, exercise or defend a legal claim.

We also disclose and preserve information where child-safety law requires it, as described at Section 12.4.

Where we receive a demand for your information and we are legally permitted to tell you, we will, unless doing so would create a risk to someone's safety or compromise an investigation.

8.4 What we do not disclose to universities and employers

We do not disclose individual-level Personal Information about you to your university, to an employer or to a recruiter.

Your profile, your posts, your messages, your reports and the moderation record of your account are not made available to your institution or to any employer.

The only exceptions are where you have expressly directed us to share specific information with a named recipient, or where a disclosure falls under Section 8.3.

No institution, employer or recruiter feature exists today, and none is authorized by this Policy. If we build one, we will publish an updated Policy, tell you, and ask for your express consent before anything about you individually becomes visible.

8.5 Aggregated and de-identified information

We may create and use information that cannot reasonably be used to identify you, for analytics, reporting and describing the Services. We do not try to re-identify it and we require our providers not to.

8.6 Business transactions

If we are involved in a merger, acquisition, financing, reorganization, insolvency or sale of assets, Personal Information may be reviewed by and transferred to the parties to that transaction. We will use only what the transaction requires, will require the recipient to protect it and to use it only for that purpose, and will tell you if your information becomes subject to a materially different privacy policy.

8.7 We do not sell your information

We do not sell Personal Information and we do not disclose it for monetary or other valuable consideration. We show no advertising. We do not permit any third party to collect information through the Services for its own purposes.

9. Search, AI and automated processing

9.1 The two places we use AI models

Search. Google Vertex AI turns the text of posts and comments into search embeddings, which is what makes searching the application work.

Linc. Linc is the in-app assistant: you tell it what you need, and it finds the people and posts on LincYou most likely to help, or shows your profile to members whose questions you could help with. Linc sends what you type to an AI model on Google Vertex AI to compose its answer. Your conversation is not stored — Linc keeps no transcript. What it keeps is a numerical representation (an "embedding") of parts of your profile — your program, courses, the help topics you declared and your public milestones — so it can match people; that representation contains no sentences, and it never includes what you said you need, your private messages, your grades or your date of birth.

Both run in Montreal, on the same provider that hosts everything else, so using search or Linc does not send your information to any company that does not already hold it. Your search queries themselves are never stored, never logged and never sent to analytics.

One more thing Linc does, for your safety: if what you type suggests you may be in danger, Linc answers with crisis resources first. The text that triggered that is not logged.

9.2 We do not train AI on you

We do not use your Personal Information, your content or your messages to train, fine-tune or otherwise develop artificial intelligence or machine learning models. Google is contractually prohibited from using the text sent to Vertex AI to train or improve its models, and we use only regional endpoints, so this processing stays in Canada.

If we ever want to change this, we will not do it quietly. We will tell you in advance, publish a new version of this Policy, and ask for your express consent first.

9.3 Automated filtering when you post

A narrow automated filter runs when content is posted publicly and blocks a small class of material, such as severe slurs and explicit threats. It reads text only — it does not scan images or links.

That is the only automated system that looks at content. Nothing else scans your posts, and nothing scans your messages.

9.4 Human review

Every report is reviewed by a person on our own staff. No member content is sent to any outside company for moderation.

9.5 Decisions about your account

We do not make decisions that materially affect your access to the Services based solely on automated processing. Warnings, restrictions, suspensions, bans and the removal of verified status are made or confirmed by a person, and you can appeal them under our Terms.

If a decision has been made about you and you want to know what information it was based on, write to support@lincyou.com. You can give us your side of it and ask a person to look again.

10. Information about other people

10.1 Content you write about others

What you post may contain Personal Information about other people, including instructors, classmates and employers. When you write about a named person you are responsible for what you write, and our Terms require you to write about your own direct experience, to express opinion as opinion, and to leave a person's private life out of it.

10.2 If you are written about

Anyone who is the subject of content on LincYou, whether or not they are a member, may write to support@lincyou.com to ask for access to the Personal Information about them that we hold, to ask us to correct inaccurate factual information about them, to report content they believe is inaccurate, defamatory or in breach of our rules, or to ask us to remove content that discloses information about their private life.

We acknowledge such a request promptly and respond within thirty days. We assess it against our rules and applicable law, and we may remove the content, ask for it to be edited, or decline with reasons. We tell the author when we remove their content and give them a way to respond.

We do not remove content merely because its subject dislikes it.

10.3 Invitations

You can invite people to LincYou by entering up to twenty email addresses at a time. We send each of them a separate email, which names you in the subject line and in the body, and which carries an unsubscribe link.

We use an address you enter only to send that invitation. We do not build a profile of the person invited, and we do not use their address for anything else. They can unsubscribe from the email itself, or write to us and ask us to delete the address, and we do not email an address that has opted out.

11. Members aged sixteen and seventeen

You must be at least sixteen to hold a LincYou account. The application rejects a date of birth under sixteen at signup. We do not knowingly collect Personal Information from anyone under sixteen, and if we learn that we have, we delete it and close the account, keeping only what we are required to keep for legal or safety reasons.

If you believe someone under sixteen has given us Personal Information, write to support@lincyou.com and we will act promptly.

For members we know to be under eighteen:

• Your date of birth is never displayed, and our moderation staff see only that your account belongs to a member under eighteen, never the date itself.
• Reports involving you are reviewed first.
• No advertising is directed at you, because there is no advertising anywhere in the application.
• We collect only what the application needs.

Age is self-declared. We do not operate an age-verification or age-estimation mechanism.

12. Protecting and managing your information

12.1 Security

Everything travels encrypted using current TLS, and data is encrypted at rest. Sign-in has no password to steal. Access to production systems is restricted, role-based and logged. Production data is separated from development and test environments. Staff and contractors are under confidentiality obligations, every provider that handles Personal Information is under a written contract, and we maintain an incident response plan.

No method of transmission or storage is completely secure and we cannot guarantee absolute security. Tell us immediately at support@lincyou.com if you believe your account has been accessed without your authorization.

12.2 Breach notification

If a breach of security safeguards involving your Personal Information creates a real risk of significant harm to you, we will report it to the Privacy Commissioner of Canada and notify you as soon as feasible, and tell you what happened, what was involved, what we are doing and what you can do. We keep a record of every breach.

12.3 Where your information lives

Our servers and database run in Montreal, Canada. The AI processing described at Section 9 also runs in Montreal.

Some of the providers named at Section 8.2 process specific information in the United States or the European Union, as that table sets out. Some of the people who build and support LincYou work outside Canada, in the United Kingdom and Spain, and may access our systems remotely under the confidentiality obligations described at Section 12.1.

While Personal Information is outside Canada it is subject to the laws of the country where it is located, and courts, law enforcement and national security authorities in that country may be able to obtain access to it under those laws. That is true whatever contractual protections we put in place, and we say so plainly because Canadian privacy law requires us to.

Write to the Privacy Officer if you want to know more about any particular transfer.

12.4 Retention

We keep Personal Information only as long as we need it for the purposes described here, or as long as the law requires.

When a period ends we securely delete the information or irreversibly de-identify it.

We may keep information longer where we must, to comply with a legal obligation, to establish or defend a legal claim, to investigate an incident, or to protect someone's safety, and only for as long as that lasts.

13. Deleting your account

You can delete your account yourself, in the application, at any time.

Deletion takes effect after a thirty-day cancellation window, during which you can change your mind. After that your profile and your content are erased permanently.

A short list of things outlives an account: safety records with your identity removed, blocks you set, the other side of your conversations, and anything we are required to keep under Section 12.4. The full description is at www.lincyou.com/legal/delete-account, which forms part of this Policy.

14. Your rights

Access. You may ask us to confirm whether we hold Personal Information about you, and to give you a copy, with an account of how we have used it and who we have disclosed it to.

Correction. You may ask us to correct information that is inaccurate, incomplete or out of date. Most of it you can correct yourself in the application. Where we disagree, we record your disagreement alongside the information and tell you why.

Deletion. You may delete your account and your content as described at Section 13, and you may ask us to delete Personal Information we hold elsewhere.

Portability. You may ask us for the information you have given us in a structured, commonly used format.

Withdrawal of consent. As described at Section 5.

Human review. As described at Section 9.5.

Complaint. To us, and to a regulator.

14.1 How to exercise a right

Write to support@lincyou.com from your registered address. Tell us what you want and give us enough to find your record.

We acknowledge promptly and respond within thirty days. If we need longer we will tell you before the thirty days are up, why, and when to expect our answer. We may need to verify your identity first, and we will ask only for what that requires.

There is no charge. If a request is manifestly unfounded or excessive, or if answering it generates a real cost, we may charge a reasonable fee, and we will tell you the amount first so you can withdraw or narrow the request.

If we refuse a request in whole or in part we will tell you in writing, explain why, and tell you how to challenge it.

14.2 Complaining to a regulator

• Office of the Privacy Commissioner of Canada — priv.gc.ca, 1-800-282-1376
• Or the privacy regulator of your province, where a provincial private-sector privacy act applies (in British Columbia, the Office of the Information and Privacy Commissioner for British Columbia, oipc.bc.ca)

15. Contact us

Privacy Officer, LincYou — LincYou Technologies Inc.

1500 Royal Centre, 1055 West Georgia Street, Vancouver, British Columbia V6E 4N7, Canada

General, privacy and security questions: support@lincyou.com

Content reports: the reporting function in the application

We take complaints seriously. We will acknowledge yours, look into it, tell you the outcome, and tell you what we changed as a result.