How Subtoo keeps student housing safer and more focused.

Anyone can browse listings without an account. Posting a listing, posting a housing request, or messaging a lister requires creating an account and being approved.

• .edu emails from supported schools are auto-approved on email confirmation.
• Other accounts (interns, incoming grads, rotations) are reviewed manually.
• New listings and new requests stay in a pending state until reviewed.
• Database rules enforce that only approved accounts can create posts — this is checked on the server, not in the browser.

• We never take or process payments. Rent and deposits happen entirely off-platform.
• We never handle lease paperwork on your behalf.
• We keep the marketplace centered on students looking to find or fill housing.
• We do not sell your personal information.

Subtoo runs on Lovable Cloud (Supabase). Application data — profiles, listings, requests, messages — is stored in a managed Postgres database with row-level security enabled. Policies restrict access so that, for example, your email and contact details are only visible to you and platform admins, and direct messages are only visible to the two participants.

Photos are stored in a private storage bucket and served through short-lived signed URLs rather than public links.

Sign-in is handled by Supabase Auth. We support email + password and Google sign-in. Passwords are never stored by Subtoo — they are managed by the auth provider, with the standard hashing and session protections it provides. Sessions are scoped to your browser and can be ended at any time by signing out.

Transactional emails (account confirmation, message notifications, admin updates) are sent through our email provider. Every notification email includes an unsubscribe link that updates your notification preferences immediately.

If you find a security issue, see a listing that looks like it is from a landlord or agent, or want your account or data removed, please reach out from the How it works page contact options. We review reports and act on confirmed violations, including removing posts and revoking account approval where appropriate.