OxQuad Privacy Policy

Effective date: 8 October 2026

OxQuad ("the app", "we", "us") is a social app that helps university students in the UK find friends, join squads and go to meetups. It is operated by EXPOTIMES Co., Ltd., Seoul, Republic of Korea, which is the data controller. Contact: expotimes@expotimes.io.

1. Who can use OxQuad

OxQuad is for people aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has an account, email us and we will delete it.

2. Information we collect

• Account: email address and a password (stored only as a salted hash), plus the invite code used to sign up.
• Profile: name, date of birth (used to show age), gender, subject/course, college, year of entry, interests and tastes (for example films, music, languages), a short bio, what you are looking for (friends, study buddy, societies), and the art style you choose for your character.
• Generated character: a cartoon character image and personality description created from your profile. You do not upload a photo of yourself to create it.
• Messages: chat messages you send in one-to-one and squad chats, with timestamps and an emotion label for each message.
• Squads, meetups and check-ins: squads you create or join, meetups you host or say you are going to, and your check-in time and method (QR code, door code or Bluetooth proximity).
• Images you upload: cover pictures for squads and meetups, if you choose to add one.
• Meetup ticket records: if a meetup has a price, a record of your booking (amount and status). The current version does not process real card payments.
• Blocks and reports: who you block and reports you file or that are filed about you.
• AI usage and style notes: counts of AI requests, and a short summary of your writing style (tone, emoji use, topics) derived from your recent messages, used to tailor suggested replies. You can delete this summary in the app.
• Device and log information: IP address, app version, device type and server logs needed to keep the service secure and working.

3. Device permissions

• Camera: to scan a meetup QR code at check-in. Images from the camera are not stored by us.
• Bluetooth (scan, advertise, connect): to confirm that people checking in to the same meetup are physically near each other. Only a short meetup-specific beacon number is exchanged.
• Location: Android requires location permission to scan for nearby Bluetooth devices. OxQuad does not read or send your GPS coordinates to our servers and does not track where you go.
• Internet and network state: to talk to our servers.

4. How we use information

To create and run your account; to build your profile and character; to suggest people, squads and meetups; to deliver chats; to run meetups and check-ins; to provide AI helper features; to keep the community safe (blocks, reports, abuse prevention); to maintain and secure the service. Our legal bases under UK GDPR are performance of a contract (providing the app), legitimate interests (security, safety, improving the service) and, where required, consent (for example device permissions).

We do not sell your personal data and we do not show advertising.

5. Other people can see

Other OxQuad users can see your name, age, college, course, interests, bio, character and what you are looking for, plus anything you post in chats, squads and meetups. Your email address and date of birth are not shown to other users.

6. Service providers (processors)

• OpenAI (United States) draws your character. It receives a text description derived from your profile choices and an AI-generated reference image of the character. It does not receive your name, email or any photo of you.
• Google (Gemini API) powers the AI helper and character descriptions. It receives text such as the content of chat messages for emotion labelling, reply suggestions and conversation tips, up to your 40 most recent messages when summarising your writing style, your look-up questions, and profile details used to describe your character. It also receives the AI-generated character image to locate the face area. Searches may use Google Search grounding.
• Firebase App Distribution (Google) delivers test builds to invited testers. It processes the tester's email address.
• Hosting: our servers are operated by EXPOTIMES Co., Ltd. and its hosting provider.

These providers process data on our instructions. Data may be transferred outside the UK, including to the United States and the Republic of Korea, under appropriate safeguards such as standard contractual clauses or UK adequacy arrangements.

7. Retention and deletion

We keep your data while your account is active. You can delete your account in the app (Me tab, Delete account) or by emailing expotimes@expotimes.io from your registered address. Deleting your account removes your profile, character, style notes, uploads, messages you sent, squad and meetup memberships and check-ins from our systems. Server logs are kept for a short period for security (normally no more than 90 days). Blocks and reports involving you are deleted with your account.

8. Your rights (UK GDPR)

You have the right to access, correct, delete, restrict or object to our use of your data, to data portability, and to withdraw consent at any time. Email expotimes@expotimes.io; we will reply within one month. You may also complain to the UK Information Commissioner's Office (ico.org.uk).

9. Security

Data is sent over HTTPS. Passwords are hashed. Access to our servers is restricted. No system is perfectly secure, so please choose a strong password.

10. Changes

If we change this policy we will update the date above and, for material changes, tell you in the app.

11. Contact

EXPOTIMES Co., Ltd., Seoul, Republic of Korea
expotimes@expotimes.io