StudiCouch
Last updated: 2026-10-26
Short version: we store what you type into your profile, show it to the people you've chosen, and nothing else happens with it. No ads, no tracking, no selling. The long version:
StudiCouch is a private, non-commercial project run by members of the Studienstiftung community. It is not an official service of the Studienstiftung des deutschen Volkes.
For anything about your data, write to contact@studicouch.com.
Account: your e-mail address, used only to send you login codes.
Profile: the display name you choose, your handle, photo, status (student, doctoral candidate, alumni, staff), the city you picked from the list with its country and map coordinates, your university or employer, and whether you can host.
Optional details: whatever you add — a few lines about you, subject, year you joined, hosting notes, languages, Instagram, LinkedIn, website.
Contact: your WhatsApp number, if you add one, together with your choice of who may see it.
Vouches: who vouched for whom, when, how they know each other and any note they wrote.
Notes: short references verified members leave about each other after hosting, staying or meeting — author, recipient, type and text.
Reports: if you report a page, we store your account, the reported page, your reason and when it was handled. Only admins see reports.
Contact look-ups: when a member opens someone's contact details, we record who looked at whom and when. That record is kept for 30 days, only admins can see it, and it exists so nobody can quietly collect the whole directory's numbers.
Login protection: when you request a code we keep a hashed, unreadable form of your e-mail address and IP address for ten minutes, so nobody can flood an address with codes.
Technical: Cloudflare, our hosting provider, keeps short-lived request logs (IP address, time, requested page) for security and operations.
Public, even without logging in: display name, photo, status, city and country, university, whether you can host, the verified mark and the list of vouches.
Verified members only: all other optional details and the notes others left about you.
On request only: your WhatsApp number and your socials are not printed on your page at all. A member has to click “Show contact details”, which is recorded (see above) and limited to a handful of people per hour. Your visibility setting decides who may ask in the first place, and only members who share a number of their own get to see yours. Instagram and LinkedIn work the same way: a member sees yours only if they've added their own.
You: always everything on your own page.
Admins: a few trusted members can edit or remove any page, for example after a report. They see what you see on your own page, plus the contact look-up record.
This is enforced in the database itself, not just on the website.
Running the directory and the map, logging you in, showing who vouched for whom. Nothing else. We don't build profiles of you, we don't show ads, we don't sell or share your data with anyone for their own purposes.
Your consent and the agreement you enter into when you create your page (Art. 6(1)(a) and (b) GDPR). You can withdraw at any time by deleting your page.
Request logs, the login throttle and the contact look-up record rest on our legitimate interest in running the site securely and keeping members' numbers from being harvested (Art. 6(1)(f) GDPR).
Supabase (database, login, photo storage) — hosted in the EU.
Cloudflare (hosting and content delivery) — a global network; Cloudflare is bound by the EU standard contractual clauses. Cloudflare also tells us which country your connection comes from; we use that once, on your first visit, to pick German or English.
Resend (sends the login code e-mails) — sees your e-mail address and the code; a US company bound by the EU standard contractual clauses.
Photon by komoot (city search) — while you type your city in the profile form, your browser sends the letters you type to photon.komoot.io to suggest places. Nothing else about you is sent. If that fails, our server asks OpenStreetMap's Nominatim once for “city, country”.
WhatsApp — when you click “Message on WhatsApp” you leave StudiCouch; WhatsApp's own terms and privacy policy apply from there.
Fonts are served from our own site, so no font provider sees your visits.
Only the ones the site cannot work without: a login session cookie, a language cookie (set on your first visit from your country, changed with the EN/DE toggle, kept for a year), a cookie that remembers whether you folded the intro on the start page (a year), for admins a cookie that remembers whether they're viewing the site as a member (a month), and a note in your browser that you've seen the cookie notice. No analytics, no tracking cookies, no third-party cookies.
As long as your page exists. You can delete it yourself at any time at the bottom of the edit page; that immediately removes your profile, photo, contact details, all vouches you gave or received, your contact look-up records and your login account. Login-throttle hashes expire after ten minutes; contact look-up records after 30 days.
You can ask us what we store about you, have it corrected or deleted, receive a copy, and object to processing. Just e-mail contact@studicouch.com. You also have the right to complain to a data protection supervisory authority.
If this page changes, the date at the top changes with it. For anything substantial we'll tell members on the site.