Privacy notice
What RevRooms collects, how we collect it, why, who sees it, how long we keep it, and what you can do about it.
Who we are
RevRooms ("we", "us") runs RevRooms Campus, the RevRooms driver app, RevTools for garages, and the RevRooms website. We decide why and how your personal data is used, which makes us the controller under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL).
Campus is an open pilot across the UAE for people aged 18 or over. A university email or university affiliation is not required. It is run by RevRooms, which is not affiliated with any university.
Questions, requests and complaints: help@revrooms.ae.
What we collect in Campus, and how
Some of this you type or upload. Some is created when you use the app. We say which.
| What | How we get it | Why |
|---|---|---|
| Email address and password (optional) | You type your email to sign in and we send a six digit code. You can also add a password when you join. We keep it only in a scrambled form that we cannot read. | To sign you in and keep your account separate from everyone else's. |
| Google sign-in (optional) | If you tap Continue with Google, Google sends us your email address, your name and a link to your Google profile picture. We never see your Google password. If you already have an account with that email, it is the same account. | To sign you in. We use your name only to fill in the join form, where you can change it. We never show or use the picture link, but our sign-in provider keeps it with your account. |
| Name (2 to 40 letters) and username | You type them when you join. The username has 3 to 20 letters, numbers, dots or underscores. | To show who you are in groups and, only if you choose, on a leaderboard. |
| Date of birth | You enter it before you join. | To check you are 18 or over. We store it, never show it to anyone and use it for nothing else. If it shows you are under 18, we do not keep the date. We mark that account so it cannot try another date, and add one to an anonymous daily count. |
| Campus and university choice | You join with a confirmed email and tell us your university if you choose one. A university choice is self-declared unless a configured email domain verifies it. | To run the shared UAE community and show your chosen university where you ask us to. |
| Your car: make, model, year, body type, tags and a caption | You type or pick them. | To show your car card to other members. |
| Car photos | You upload or take them. Our server removes location and camera details and resizes them before saving. | To show your car card. A moderator checks each photo before it goes live. |
| Number plate | You type it once to link your car. We do not store it. | We turn it into a one-way code so the same car cannot be added twice. The code cannot be turned back into a plate. |
| Live check photo | You take it in the app, showing your car and a code written on paper. | To show you have access to the car. Only moderators can see it. See "How long we keep it". |
| Ratings, duel votes and saved cars | When you tap. | To rank cars. Your votes are never shown to the owner. Saved cars are private. |
| Group messages, replies, photos, meetups, RSVPs and reactions | You write or upload them in a group. | To run groups. Members of that group see them. Messages are text only. |
| Profile photo and display name on car cards (optional) | You upload a profile photo and choose whether to show it on your car cards. | To show your chosen identity to people at your university when you opt in. |
| Your social links (optional) | You add them in your RevConnect profile. | To show them to other members, as you choose. |
| Reports and blocks | When you report something or block a car. | To keep Campus safe. A block is never shown to the person you blocked. |
| Research answers (optional) | When you answer a short question. | To learn what people want from a car community. Results are shown only in groups of people, never as your answer. |
| Alert settings and your phone's alert address | When you turn alerts on in Account. | To send alerts you asked for. The address is a technical code from your phone's browser. We also keep a short note of the browser type. |
What is collected automatically
- Sign-in session: a cookie that keeps you signed in. Without it the app cannot work.
- Your IP address: used for a moment to slow down abuse. We store it only as a scrambled code made with a secret key, never as the address itself.
- Error reports (Sentry): if something breaks, a report with technical details such as the page, browser and error. It does not include your messages or photos. There is no screen recording.
- Server logs: our hosting provider keeps ordinary request logs for a short time under its own settings.
- Analytics (PostHog), only if you press Accept: which screens and features are used, tied to an internal account ID that is not your name, phone, email or plate. If you press Decline, none of this is sent.
- Anonymous counts: for example how many people used a feature in a day, without who.
The driver app, RevTools and the website
If you also use other parts of RevRooms we collect what each needs:
- Driver app: your name, phone number, emirate, language, your cars, saved addresses, and the requests you send to garages (service, preferred time, notes, how you want to be contacted). A request is shared only with the garage you send it to.
- Reviews: your score, comments and the name you choose to show. A review of a garage can be shown publicly.
- Website forms: email, and if you give them a name, phone number or garage name, with the date you agreed and which wording you agreed to. You can unsubscribe from any email.
- Garages and their staff (RevTools): business details, staff names and roles, and the work they do in the software.
Marketing messages need their own, separate yes. Sending a request to a garage is not a yes to marketing.
What we do not collect
- Your number plate as text, or your VIN.
- Your exact location. Photos are stripped of location details before we keep them.
- Your contacts, your photo library (only the photos you pick), your microphone or your screen.
- Anything from your Google account beyond your email, name and profile picture link. We never see your Google password, Gmail, Drive, contacts or calendar.
- Payment details. Campus is free and we take no payment in it.
- Anything about you from other websites. We use no advertising trackers.
Why we use it, and our right to
| Reason | What it covers | Our basis |
|---|---|---|
| Run your account and Campus | Sign-in, your cars, ratings, duels, groups, alerts you turned on. | You asked for the service (contract), and your consent where you tap to turn something on. |
| Keep Campus 18+ and safe | Date of birth, the car check, reports, blocks, moderation, suspending accounts. | Our legitimate interest in a safe community, and our duty to keep children out. |
| Stop abuse | Rate limits, scrambled IP codes, security logs. | Legitimate interest. |
| Improve the product | Analytics and error reports. | Your consent for analytics. Legitimate interest for error reports. |
| Research | Optional answers, shown only grouped. | Your consent, given by answering. |
| Obey the law | Answering lawful requests from UAE authorities. | Legal obligation. |
Where we rely on your consent you can take it back at any time. Taking it back does not affect what we did before.
Who can see it
- Other Campus members see your published car card (photos, rating, duel record, rank and university if shown). If you opt in, people at your chosen university can also see your display name and profile photo on the back of your car card. They do not see your email, date of birth, plate or private activity.
- Members of a group see your display name and what you post in that group.
- RevRooms moderators see reports, check photos, and the group content they need to review. They are people we have chosen, and they may use it only to keep Campus safe.
- The universities see nothing about you personally. Anything we share with them is grouped and anonymous.
- We never sell your data and never show you adverts.
Who helps us run it, and where your data goes
These companies handle data for us, only to provide their service, under their terms with us:
| Company | What for | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | Mumbai, India |
| Vercel | Hosting the app and website | Mumbai, India |
| Resend | Sending your sign-in email | The Resend email network |
| PostHog | Analytics, only if you press Accept | Where PostHog hosts our project |
| Sentry | Error reports | Where Sentry hosts our project |
| Your phone's alert service (Apple, Google, Mozilla or Microsoft) | Delivering alerts you turned on. The text is encrypted for your device. | Their own networks |
This means your data is stored and handled outside the UAE. We pick providers with strong security, we send them only what they need, and we do not allow them to use it for their own purposes. By accepting this notice you agree to these transfers.
If you choose Continue with Google, Google confirms who you are and sends us your email, name and profile picture link. Google handles your Google account under its own privacy policy and knows that you used it to sign in to RevRooms. You can remove RevRooms from the third-party connections in your Google account at any time. That stops Google sign-in but does not delete your RevRooms account.
How long we keep it
| Data | How long |
|---|---|
| Live check photo | Deleted as soon as a moderator decides. If nobody decides, the check expires and the photo is deleted after 14 days at most. |
| Alerts waiting to be sent | Deleted if not sent within 12 hours. Sent alerts are deleted after 7 days. An alert never holds your messages. |
| Abuse counters (scrambled IP codes) | They expire with their time window, never more than a day. |
| Your account, cars, photos, group messages, ratings, saves, votes, blocks, alert settings and the reports you made | Until you delete your account. Then they are deleted straight away. |
| Your Google name and profile picture link (only if you used Google) | Kept by our sign-in provider with your account until you delete it. Then they are deleted straight away. |
| Group messages after you leave a group | They stay in that group until you delete your account, an admin or moderator removes them, or the group is deleted. We will set a fixed limit for old messages and tell you before it starts. |
| Reports about you and moderation decisions | Kept only as long as needed to keep Campus safe, and removed with your account where they identify you. |
| Analytics events | Kept in PostHog under our settings. They carry an internal ID only, so once your account is deleted they no longer lead to you. |
| Error reports and server logs | Short periods set by Sentry and Vercel. |
| Requests and reviews on the driver app | A garage keeps a record of work it did. When you delete your account we replace your name and contact details on those records with "Deleted driver". |
How we protect it
- Everything travels over HTTPS.
- The database enforces who can read each row. A student cannot read another student's private data even if the app were changed.
- Check photos and group photos are in private storage. Moderators open them through links that expire in minutes.
- Photos are re-saved on our server, which removes hidden details such as location.
- We limit how fast anyone can try things, to stop abuse.
- Only the people who need to see data to do their job can.
No system is perfectly safe. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
Your choices and rights
Under the PDPL you can ask to see your data, correct it, have it deleted, limit or object to how we use it, take back consent, and receive a copy you can move. You can also complain to the UAE Data Office.
- Delete your account: Account, then Delete account. It is immediate and cannot be undone.
- Analytics: Decline or change your choice in the banner at any time. Clear your browser data to see it again.
- Alerts: turn them off in Account, Alerts.
- Google sign-in: remove RevRooms from the third-party connections in your Google account. Your RevRooms account stays until you delete it here.
- Hide or block cars, and report anything, from any car card.
- Anything else, including a copy of your data: email help@revrooms.ae from the address on your account. We reply within 30 days.
Cookies and what we keep on your device
We use no advertising or cross-site tracking cookies. We use:
- A sign-in cookie, which the app cannot work without.
- Settings saved on your device: light or dark mode, that you have seen the welcome and the card guide, how many times you have visited, when you chose Not now on a card, hidden cars, and your analytics choice. They never leave your phone.
- If you open an invite link and then choose Google, the invite code waits in that browser tab while you are at Google. It is removed once you have joined, or when you close the tab.
- A small service worker so Campus can be added to your Home Screen and show alerts. It does not store pages.
Age
Campus is only for people aged 18 or over. If we learn that someone under 18 has an account, we remove it and its data.
Changes to this notice
This is version 2026-10-18, dated 18 October 2026. When we change what we collect or why, we update this page, raise the version and ask you to accept again before you continue.