← Back to home

SLIMZ · LEGAL & ACCOUNT INFORMATION

Privacy policy

Datenschutzhinweise · App and website · Updated 30 September 2026

1. Who is responsible?

Vishant Bimbra operates Slimz and is responsible for the app's account and listing data. Postal address: 21, Orchid Petals, Sector 49, Gurugram 122018, India. For privacy questions or requests, contact founder@slimz.app. Full operator contact information is also in the Impressum.

If Slimz is operated without an establishment in the EU while offering the app to people in the EU, an EU representative may need to be designated under Article 27 GDPR. This assessment and any required representative details must be completed before launch.

2. Information and purposes

  • Account access: email address, authentication credentials and account identifier are processed through Firebase Authentication to register, sign in and reset passwords.
  • Listings: university, room locality/name, availability dates, description, photographs, account ownership and listing revisions are used to publish and manage rooms.
  • Contacts and saved listings: the listing email/WhatsApp number and contact-reveal records allow contact access, saved listings and enforcement of the three-contact limit.
  • Optional location: if you choose and confirm it, device coordinates are attached to your room listing. Manual locality entry remains available. The app does not request background location.
  • Support and safety: email correspondence, report details and necessary evidence are used to answer questions, investigate concerns and handle account or rights requests.
  • Technical delivery: service providers process connection information such as IP address, browser/device information, request times and security logs to deliver and protect the app or website.
  • App advertising: the Android app includes a labelled Google AdMob banner on its dashboard. Google's Mobile Ads SDK may collect and share your IP address (which can indicate general location), app and ad interactions, diagnostic information, and device or account identifiers including the Android advertising ID and app set ID, for ad delivery, measurement and fraud prevention. Google's User Messaging Platform (UMP) handles applicable advertising privacy choices.

3. Advertising and your choices

The dashboard may display a Google AdMob banner. The app requests an update of your consent status and shows Google's consent form when required before it initializes the ads SDK or requests an ad. Depending on your location, choices and Google's available ad modes, you may see personalised, non-personalised or limited ads, or no ad. Declining personalised advertising does not necessarily remove all ads. The app does not send your room photos, listing contact details or precise listing coordinates to AdMob as ad-targeting parameters.

Where required, we seek your consent under Article 6(1)(a) GDPR for ad personalisation and non-essential access to information on your device. You can change or withdraw applicable choices in the app under Privacy and safety → Ad privacy choices when that option is shown, and you can reset or delete your Android advertising ID in device settings. Necessary ad delivery and fraud-prevention processing may rely on Article 6(1)(f) GDPR where lawful, subject to your right to object; Google's consent form explains the purposes and participating vendors for your region. Withdrawing consent does not affect processing already completed.

Advertising data is sent to Google and any vendors identified in the consent form, which may process it outside the EU/EEA under applicable transfer arrangements. Google's privacy policy explains its data use and retention. We do not set Google's own retention periods; the final AdMob account configuration and any additional ad partners must be reflected here before live ads are enabled.

4. Legal bases

Processing necessary to provide requested account, listing and contact-access functions is based on Article 6(1)(b) GDPR. Security, fraud prevention and proportionate abuse investigations rely on Article 6(1)(f), with the legitimate interests of protecting the service and its users weighed against your rights. Compliance with applicable legal duties relies on Article 6(1)(c). Optional processing that requires consent, including optional location where applicable, relies on Article 6(1)(a); consent can be withdrawn for future processing. A device permission is not blanket consent to unrelated uses.

Information necessary for an account or listing must be provided to use that feature. Optional permissions can be declined. You can revoke permissions in Android settings; removing an already published location also requires editing or deleting the listing.

5. Who can see listing information?

Room descriptions, photographs, availability, university and any attached coordinates are shared with app users through listings. Listing contact details are made available through the reveal mechanism. Administrators and contracted infrastructure providers may access information where necessary for operation, support, security or a legal obligation.

Do not treat listing photos as confidential: another user can view or copy them, and a shared photo download link may remain usable until access is revoked or the file is deleted. Do not upload faces, identity documents or sensitive personal details.

6. Photos: cloud and device storage

Uploaded room photos are stored in Firebase Cloud Storage. They are resized and converted to JPEG on the device before upload. Cloud storage is storage on a service provider's systems; it does not mean that the images are not stored anywhere.

The current Android app also uses local device storage. Photos taken in the app are first written into its private photo folder, and an automatic cleanup after a successful upload is not currently implemented. Photos selected from a gallery remain with their original provider. Image loading, app data and the operating system may use device caches. Clearing app data or uninstalling can remove app-managed local copies, but does not delete cloud data or originals in your gallery. We do not claim that photos are never stored locally.

7. Providers and international processing

The app uses Google Firebase Authentication, Cloud Firestore and Cloud Storage. For the account and listing data that Slimz collects through these services, Slimz determines the purposes of processing; Google generally acts as a processor providing Firebase infrastructure. Using Firebase does not make Google the operator of Slimz or transfer our responsibility for user privacy requests to Google. Google's Firebase privacy information explains that Authentication is operated in US data centres; other services depend on the configured region and infrastructure. The actual Firestore/Storage regions, contracting entities and applicable transfer safeguards must be confirmed before launch. We do not claim that all app data stays in Germany or the EU.

The website is currently hosted using OpenAI Sites and Cloudflare infrastructure. Its design also requests fonts from Google Fonts and an illustrative photograph from Unsplash; those requests disclose your IP address and ordinary request metadata to the respective provider. Opening an external link, your email app or WhatsApp involves that provider's own processing. The final processor list, processing agreements and any international-transfer safeguards remain to be confirmed.

8. Cookies and device access

The website's own code contains no advertising trackers or analytics scripts and does not set its own cookies or local-storage preferences. The Android app's Google advertising SDK and consent platform are described above and may access device identifiers or storage subject to your choices and applicable law. Hosting and sign-in services may use necessary security/session technologies. Device access or storage that is not strictly necessary for a service you request requires consent where § 25 TDDDG applies. Hosting behaviour and external-resource processing must be reviewed before the public launch; this notice is not a claim that third-party services never use cookies.

9. Retention and deletion

Account and listing records are used for the lifetime of the relevant feature and must be deleted when no longer needed, subject to applicable obligations and necessary legal-claim retention. A final schedule for support correspondence, reports, security logs, provider backups and any retained records is still being established. There is no blanket permission to retain personal data indefinitely.

Deleting a listing removes its database listing and contact record and attempts to remove its linked cloud photos. Photo cleanup can fail, and earlier replaced or interrupted uploads may require separate cleanup. A full account-deletion request must also cover authentication, remaining listings/photos and saved-contact/reveal records. The operator must verify completion rather than treating sign-out or account-login removal alone as erasure.

Google currently documents that Firebase Authentication data is removed from its live and backup systems within 180 days after the customer initiates deletion; this is a provider-specific period, not a general retention period for all Slimz data. Legally retained information must be limited to the necessary data, purpose and period and explained in the response.

10. Your rights

Subject to the applicable conditions, you may request access, correction, erasure, restriction and portability of your personal data. You may withdraw consent at any time without affecting earlier lawful processing. You may object to processing based on legitimate interests for reasons relating to your situation; any direct-marketing processing may be opposed at any time.

Send requests to founder@slimz.app. We may ask for proportionate information to confirm identity, but do not send passwords or identity documents with your initial request. GDPR requests must generally be answered within one month; where the law permits an extension for complexity or number of requests, you must be informed within that month, with reasons.

You may complain to a competent supervisory authority, particularly where you live or work or where the alleged infringement occurred. German authorities are listed by the Federal Commissioner for Data Protection. The operator's lead authority depends on its confirmed establishment.

11. Automated decisions and updates

The inspected app sorts listings by availability and applies a fixed contact-reveal limit. It contains no automated assessment of tenant eligibility or housing allocation. Any future materially different processing will require an updated notice and, where necessary, a new lawful basis or consent.