Last updated: 2 November 2026
Who this covers
UniGreen is a student-built app for tracking green commutes to UCL. This policy explains what data the app collects when you register, log a commute, connect Strava, or redeem a reward, and what happens to it.
What we collect
- Account details: your UCL email address and a username, when you register. Passwords are never stored or seen by us directly — they're handled entirely by our authentication provider, Supabase.
- Commute data: the mode of travel, distance, duration, and the GPS coordinates of where each logged route ends. The end-location is required to verify the route actually finishes on UCL campus — it is used only for that check and to calculate your stats.
- Strava data (only if you connect it): your Strava athlete ID and an access token, plus the name, type, distance, duration and end-location of activities you choose to import. To show an activity on a map, its route outline is passed to your device but never stored. Disconnecting Strava in the app deletes this immediately.
- Route maps: when you pick a GPX file or Strava activity, its route is drawn on a map on your device. A GPX route is never uploaded — only its end point is sent, to check it finishes on campus.
- Reward/voucher data: which vouchers you've earned and whether they've been redeemed.
- Basic technical logs: standard server request logs kept by our hosting provider (Render) for security and reliability — not used for tracking or advertising.
How we use it
Strictly to run the app: verifying you're a UCL student, calculating your CO₂ savings and points, confirming a commute genuinely ends on campus, and issuing/redeeming reward vouchers. We don't use your data for advertising, and we don't sell or rent it to anyone.
Who we share it with
Only the services that make the app work, each acting purely as a processor on our behalf:
- Supabase — hosts our database and handles account authentication.
- Strava — only if you choose to connect your account, to read the activities you authorize.
- Render — hosts the application server.
- OpenFreeMap — supplies the map data for route maps (© OpenMapTiles, data from OpenStreetMap). Your device downloads map data for the area being shown; your route itself isn't sent.
Café/restaurant staff redeeming a voucher only ever see the reward type and redemption status — never your name, email, or any commute data.
How long we keep it
For as long as your account is active. You can permanently delete your account and all associated data at any time from Profile → Delete Account in the app.
Your rights
You can delete your account yourself in the app, or ask us to access, correct, or delete your data at any time by contacting us. If you're in the UK/EU, this includes the rights available to you under UK GDPR.
Security
Passwords are hashed and managed by Supabase Auth, never handled or stored by us in plain text. Traffic to the app is encrypted (HTTPS). Access to the underlying database is restricted to the application server.
Changes to this policy
If this policy changes meaningfully, we'll update the date at the top of this page.