Eat With Me

Privacy Policy

Eat With Me™

Last updated: 2026-10-20 · Effective: 2026-10-04 · A pre-launch revision: nobody outside the class has used the app under an earlier version.


The short version

The rest of this document is the detail.


1. Who we are

Eat With Me is a student project at the University of Southern California. Contact us at jmlin+privacy@usc.edu for anything in this policy.

2. Who can use the app

You must be 18 or older and have an email address at a school we support. Today that is USC only, and you sign in with your USC Google account. Personal Google accounts are refused, and no account is created for them. Do not use Eat With Me if you are under 18. If we learn we have collected information from someone under 18, we delete it.

3. What we collect

You give us:

We collect automatically:

Our hosting provider and our sign-in provider receive your IP address and browser details with each request, as any website's do, and may keep them in their own logs. The app's own tables never store your IP address. Rate limits use a scrambled one-way code made from it instead (section 8).

We receive from others:

We do not collect: your contacts, your camera roll, your calendar, your microphone, your browsing outside this app, or advertising identifiers. If you scan a friend's code to follow them, your camera reads the code on your device. No image leaves your phone.

Sensitive information. Allergies and dietary restrictions can reveal health or religious information. We collect them only because a bad match on this dimension is genuinely unsafe. We use them only to filter matches and restaurants, and to show on your profile if you choose. After a meal we may ask whether the restaurant suited your restriction. Those answers are counted per restaurant, and nobody sees who gave them. We never use your dietary information for advertising, profiling, or inference of any kind. You can remove it at any time, at the cost of less accurate matching.

4. Location, specifically

This deserves its own section because it's the most sensitive thing we touch.

5. Why we use it

Email, school domain, Google sign-in
WhyCreate and secure your account, confirm you're a student
Legal basis (GDPR)Contract
Name, username, photo, profile details
WhyShow you to the people you meet and follow
Legal basis (GDPR)Contract
Preferences, interests, searches, ratings
WhyMatch you with people and places
Legal basis (GDPR)Contract
Interests, counted across students
WhySuggest interests to others, from counts that need at least five students and never name anyone
Legal basis (GDPR)Legitimate interests
Allergies, dietary restrictions
WhyPrevent unsafe matches, and show on your profile if you choose
Legal basis (GDPR)Explicit consent
Rough location
WhyFind nearby restaurants and nearby people
Legal basis (GDPR)Consent
Precise position at check-in
WhyConfirm you're at the restaurant, then discarded
Legal basis (GDPR)Consent
Messages
WhyLet you coordinate a meal
Legal basis (GDPR)Contract
Feedback survey answers
WhyImprove the app. Your answers are read by our staff without your name attached and are optional
Legal basis (GDPR)Legitimate interests
Hosted tables: note, name, requests to join, and your first name shown to mutual friends
WhyLet students find, join and run a table
Legal basis (GDPR)Contract
Push subscriptions: an address per device you turn notifications on for
WhyDeliver a notification through your browser's push service
Legal basis (GDPR)Consent
Meal history, check-ins, attendance
WhyKeep ratings honest and matching fair
Legal basis (GDPR)Legitimate interests
Reports, blocks, ratings, username history
WhyKeep people safe and keep ratings honest
Legal basis (GDPR)Legitimate interests
Moderation audit log, rate-limit counters
WhyDetect abuse, investigate incidents
Legal basis (GDPR)Legal obligation, legitimate interests
Error reports
WhyFind and fix what breaks
Legal basis (GDPR)Legitimate interests

We do not use your information to train machine learning models on your messages.

6. Messages, and what we can see

Be clear-eyed about this. Today, messages are encrypted in transit and encrypted at rest on our servers, and access is restricted by database-level policies so only conversation participants can read them through the app. They are not end-to-end encrypted, which means our systems technically could access message content, and we would disclose it if legally compelled to.

We access message content only to investigate a report or a safety incident, or where the law requires it. We do not read messages for analytics, advertising, or product development.

When someone reports a conversation, the moderator reviewing it sees the messages the reporter chose to include, taken from our servers exactly as they were sent — not as the reporter retyped them, and not from the reporter's device. If one of the other person's messages had been unsent when the report was filed, the moderator sees its held copy, marked as unsent by the sender; the person who reported it does not.

Messages you send to Eat With Me support are stored, read by our admins and moderators, and kept as long as your account exists; they are deleted with it, on the same schedule as the rest of your account (section 9).

Messages you send through our contact form are also stored and read by our admins and moderators to answer you.

End-to-end encryption is planned but not built. If it ships, we will not be able to read your messages at all, and we will update this policy and notify you before the change takes effect.

If you turn notifications on, we store a push address for each device — one row per device, deleted the moment you turn notifications off on it or remove it in Settings. Notifications are delivered through your browser maker's push service (Apple, Google, Mozilla or Microsoft). The contents are encrypted so that service cannot read them, but it sees when a notification is sent, and how big it is. A message notification shows the sender and the start of the message on your device, including on a lock screen. A message notification waits about 30 seconds before it is sent, so unsending a message within that time means it is never shown in a notification. If you unsend it later, a notification may already have shown it. The notifications list itself is kept for 30 days. You can turn each kind off, or all of them, in Settings → Notifications.

7. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We share with service providers who process data on our behalf, under contract, only to run the service:

Supabase
What they handleDatabase, sign-in, file storage, and realtime messaging. Stores what Google sends when you sign in (section 3). When email sign-in is on, it also sends sign-in codes. If Google's map can't load, it also serves the map tiles, fonts and icons your browser draws instead, which tells it your IP address and the part of the map you're viewing, never your location
Vercel
What they handleApplication hosting. Receives your IP address and browser details with each request
Google, for sign-in
What they handleWhen you continue with Google, Google learns that you signed in to Eat With Me. Governed by Google's own privacy policy
Google Maps Platform
What they handleMost of the time, the map in your browser loads from Google, which receives your IP address, browser details, and the part of the map you're viewing. If Google's map fails to load, we switch to our own map data, served from Supabase, and your browser stops loading Google's map for a while (until Google's daily reset, if Google's daily usage limit ran out). Google sees the attempt that failed, not the map views after it. Our server asks Google for restaurant listings around campus; those requests carry campus locations, never yours. Governed by Google's own privacy policy
Cloudflare Turnstile
What they handleWhen this check is turned on (it starts off), checks that the waitlist form and the email sign-in forms (not the Google button) are used by people, not bots; Cloudflare receives your IP address and browser signals for that check

Other students see:

They do not see your email, your location, your Elo number, the list of who you follow or who follows you, who you've blocked, your other meals (except that your mutual friends see the tables you host; see Hosted tables below), or your ratings of anyone.

We may disclose information if legally required, to protect someone's safety, or in connection with a merger or acquisition, in which case we'll tell you before your information moves.

Hosted tables

A student can host a table for three or more people, or join one someone else is hosting. Every table is listed on the Tables tab for students who can use matching: the restaurant, the time, how many seats are open, and the table's note. They never see a guest's name unless they're seated with you. If you're the host, your mutual friends (people you follow who follow you back) see your first name and can join instantly while a seat is open; everyone else asks to join, and you approve or decline. Nobody outside a table can see who else is seated there, and a guest's name is never shown to the host's friends, only to the people actually seated.

When you ask to join a table, the host sees your profile card (your photo and username always, and your name, bio and more if your profile is public or the host can already see your full profile — an approved follower, or someone you have a meal with coming up or in the past week) along with the note you send with your request, if you send one. Nothing else changes until the host answers: no chat opens, and nobody but the host learns you asked.

If, when you ask, you or someone already seated (the host included) has a block in place with the other, your request is quietly set aside: you'll still see "You asked to join," and the host is never shown it. The same happens if the table later passes to a new host while such a block stands. Otherwise, if a block comes to stand between you and someone at the table after you asked (a new block, or someone you have a block with sitting down), your request closes: straight away if it's between you and the host, or, if it's with someone else at the table, when the host tries to approve you, and the host is told only that we couldn't seat you. Either way you read "The host couldn't fit you in", the same message you'd see if the host simply declined.

Once you're seated:

Blocks, requests, and the reasons a table opens or closes never leave the app: no push notifications, no emails, and nothing goes to anyone beyond the service providers listed above that run the app.

8. How long we keep it

Account and profile
RetentionUntil you delete your account. You then have 7 days to restore it; within about an hour after that, it is deleted permanently
Profile photo files
RetentionReplacing or removing your photo deletes the old file within about an hour, through an automatic cleanup we retry hourly until it succeeds; the same happens if a new photo fails to save. A photo a moderator removed is kept, as a record of the removal, until your account is deleted — you can't delete, replace, or restore it yourself before then. When your account is deleted, every photo you ever uploaded is deleted the same way. Until a file is deleted, our cleanup queue holds its file name, which includes your account ID
Name, picture link and Google account ID from Google sign-in
RetentionUntil your account is deleted permanently
Rough location on a search
RetentionUntil the search ends. A search that runs out is cleared within 5 minutes of its end time
Other search details: when, budget, mood, distance, campus
RetentionUntil you delete your account
Precise position at check-in
RetentionNot kept. Compared once, then discarded
Meal history: restaurant, time, who you ate with, check-ins, attendance
RetentionUntil you delete your account. After that, your account ID is removed and the record is kept. See section 9
Messages
RetentionUntil you delete your account, except messages included in a report, which are kept with the report (see Reports). Deleting a message or a chat removes it from your view only; the other person keeps their copy
Unsent messages
RetentionA copy is held for 30 days so the recipient can report it; it is read only if reported, and deleted after the 30 days. If it is reported, the copy attached to the report stays with the report (see Reports)
Reports, including any messages or table text attached to them
RetentionUntil 1 year after a moderator closes the report. After that we clear the details and anything attached to it, and keep who made the report, about whom, the reason chosen, and its outcome. Reports still open are kept until a moderator closes them. If either person deletes their account, their account ID is removed from the report
Ratings you give and receive
RetentionPrivate. The Elo, points and reliability changes they cause are kept with no end date. When you delete your account, your account ID is removed from them and they are kept. See section 9
Feedback survey answers
RetentionKept until you delete your account. When you do, your account ID and the written comments are removed straight away and the 0-10 score and multiple-choice answers are kept as anonymous counts, with their dates reduced to the day
Whether to ask you for feedback (later / don't ask again)
RetentionUntil your account is deleted permanently
Username history
RetentionUntil you delete your account. Never shown to other students
Hosted tables: a table, its note and name, and requests to join
RetentionUntil you delete your account. When deletion becomes permanent, your account ID is removed from any table you hosted and the table is kept as part of the meal's record (see Meal history). A note or name you wrote is erased, and your requests are deleted. A table's custom name is also cleared if it reopens
Rate-limit counters
RetentionDeleted within two days. They hold a scrambled one-way code made from your IP address or email address (never the address itself), your account ID, or your school's domain
Sign-in attempts from schools we don't support yet
RetentionThe school's domain and a scrambled one-way code made from the email address, to count interest. Kept until we remove them; contact us to have yours removed.
Moderation audit log
RetentionKept indefinitely. It records which moderator did what, to which account, report, memo, appeal, staff role, site setting, or site-wide notice, and when, with the moderator's own note about the action — written without copying message text or your name — and a keyed hash of the moderator's IP address. Before/after details are ids and scalar values only; message text is never stored here
Sign-in codes
RetentionOnly when email sign-in is on. Kept by Supabase, our sign-in provider. Each code works once, stops working when it expires, and is deleted when you use it or ask for a new one
Messages to Eat With Me support
RetentionUntil you delete your account, on the same schedule as the rest of your account (section 9)
Contact form messages
RetentionUntil we've handled them, then 90 days (an admin can change this); ones you send while signed in are also deleted with your account, on the same schedule as the rest of your account (section 9)
Record of an address our staff let in to sign up early
RetentionKept, as the record of who did it, when and why. If the address is never used to sign up, the record keeps the address as it was written. If it is used and you later delete the account it created, the address in that record is replaced with a one-way hash
Error reports
Retention30 days
When you were last active
RetentionOne time per account, replaced each time you use the app. Deleted when your account is deleted permanently
Counts of students online and signing in
RetentionKept indefinitely. They are totals per few minutes or per day, with no account attached

9. Your rights

Everything below is available in Settings, without emailing anyone.

What survives deletion, and why. Your ratings of other people permanently affected their standing on the app. Deleting those records would corrupt other users' scores through no fault of theirs. So when your account is deleted permanently, we remove your account ID from those records, and from the ratings others gave you. What remains cannot be traced to you through your name, email, or account ID: the scores, the meal they belong to (restaurant and time), whether each person came, the Elo, points and reliability changes the meal caused, and any answers about whether a restaurant suited a dietary need. Those Elo, points and reliability changes are kept with no end date. Your feedback survey answers are handled the same way: the 0-10 score and multiple-choice answers are kept as anonymous counts, but the written comments are deleted.

A hosted table works a little differently again. When you delete your account, you give up your seat at any table you're at that hasn't started yet, and your pending requests to join are withdrawn. When the deletion becomes permanent, any note or name you wrote on a table is erased and every request you made to join a table is deleted. The table itself stays, like the meal it belongs to, without your account ID. The table carries on for the others as it would if you had left it (section 7).

Everything else — profile, photo, messages you sent (including ones to Eat With Me support), preferences, interests, memos, searches, follows, blocks, appeals, and username history — is deleted, with three exceptions. Messages, a table's name or note, or a note you sent with a request to join, included in a report are kept with the report until 1 year after it is closed. If a moderator ever acted on your account, the moderation audit log keeps your bare account ID and the moderator's note about the action, which we write without copying message text or your name. And if our staff ever let your address in to sign up early, that record is kept: if the address is never used to sign up, the record keeps it as written; if it is used and you later delete the account it became, the address itself is replaced by a one-way hash — we still know who did it, when, and why, but not the address.

If you're in California (CCPA/CPRA): you have the rights above plus the right to know categories collected, disclosed, and sold. We sell nothing and share nothing for advertising. We will not discriminate against you for exercising any right.

If you're in the EEA, UK, or Switzerland (GDPR): you have the rights above plus the right to lodge a complaint with your supervisory authority. Our legal bases are in section 5. Data is processed in the United States under Standard Contractual Clauses where required. We know a meaningful share of our users are international students, and we intend this to be accurate for them, not just for domestic users.

We respond to requests within 30 days, or 45 where the law allows an extension.

10. Security

We use TLS in transit, encryption at rest, row-level database policies that restrict access to the specific people entitled to it, rate limits on sign-in, profile views and messages, and role-restricted internal access with every administrative action logged to an append-only audit trail. Our team does not have routine access to your messages.

No system is perfectly secure. If a breach affects your information, we will notify you and the relevant authorities as required by law.

11. Cookies

We use cookies and local storage only for sign-in, session management, remembering your theme choice, remembering on your device when you last skipped the setup questions before a search, remembering which site-wide notices you've dismissed, and — if Google's map fails to load in your browser — remembering that, so we don't keep retrying it. No advertising cookies. No third-party trackers. The map is loaded from Google, or from our own storage if Google is unavailable (section 7). There is nothing to opt out of, because we didn't put anything there.

12. Changes

We will post the new version here with an updated date. For material changes — particularly anything that changes what we collect or who sees it — we will notify you in the app before the change takes effect.

13. If you joined the launch waitlist

Before the app opens, you can leave your school email address on the homepage — open to students at any school, not just USC, so we can see which campuses want it next — or, with an address at a school we already support, by entering it on the sign-in page while signups are closed and email sign-in is on. Both are the same list. Joining it does not create an account, and it is kept separately from everything else in this policy.

What we store, and why. Your email address and its school's domain — nothing else — so we can send you one email when we open at your school.

Who can see it. Nobody. Your address is never shown to another student, and nothing in the app — no screen, no search, no profile, no admin tool a moderator uses day to day — can read this list. It is reached only directly, by us, outside the app.

We keep the row after we email you. Sending the launch email does not delete your row. The timestamp we record when we send it is the only thing that stops us emailing you a second time, so removing it would destroy the one record that prevents a duplicate. It is not used for anything else.

You can ask us to remove it. Contact us and we will delete your row from the list.

14. Contact

Send us a message with the contact form at /contact, or email us at the address below.

jmlin+privacy@usc.edu · Eat With Me, a student project at the University of Southern California