Trust & Security

Dormgrab uses email/password and Google OAuth for authentication. Every account is tied to a verified identity so listers and reservers know who they are dealing with.

• Row Level Security (RLS) is enforced on every database table.
• Authenticated users can only read and modify data they own or are explicitly allowed to access.
• Anonymous visitors can browse public listings but cannot see sensitive fields such as reservation details or contact information.

We do not support anonymous sign-ups. All accounts require a valid email or Google identity.

Your profile (display name and university affiliation) is visible to other authenticated users so they can coordinate pickups. Your email address is never shared publicly.

Pickup notes and chat messages are scoped to the participants of a specific reservation. Only the item owner and the confirmed reserver can read the chat thread.

We use encrypted connections (HTTPS/TLS) for all browser-to-server traffic.

Item reservations follow a strict state machine to prevent race conditions and unauthorized changes. Instead of allowing direct updates to item status, the app uses secured database procedures.

These procedures run with definer rights so the state machine rules are enforced server-side, regardless of what any client sends:

• reserve_item — transitions an available item to 'reserved' by the calling user, provided the deadline has not passed and the caller is not the owner.
• confirm_reservation — allows the item owner to approve a reservation and open the pickup chat.
• cancel_reservation — lets either the owner or the reserver cancel a pending or confirmed reservation and return the item to 'available'.
• complete_pickup — lets the owner mark a confirmed reservation as picked up, finalizing the handover.

Each procedure verifies the caller's identity and the item's current state before making any change. This design prevents tampering such as skipping the confirmation step or marking someone else's item as completed.

Chat is only available after a reservation has been confirmed by the item owner. This ensures both parties are committed to the handover before sharing pickup details.

Messages are stored in the database and subject to the same RLS policies as reservations.

Items past their deadline are automatically hidden from browse and search views. We retain them briefly for reference in active reservations, then they can be removed by the owner or by periodic cleanup.

You can delete your own items and your account data at any time from your profile page.

If you discover a security issue or have a vulnerability to report, please reach out to the Dormgrab maintainers directly.

We aim to acknowledge reports within 48 hours and will keep you informed as we investigate.