Privacy Policy
Eat With Me™
Last updated: 2026-10-20 · Effective: 2026-10-04 · A pre-launch revision: nobody outside the class has used the app under an earlier version.
The short version
- We collect what we need to match you with someone to eat with. Nothing else.
- We do not sell your personal information. We do not share it for advertising.
- When you search, your phone rounds your location to an area about 500 meters across before sending it, and we clear it when the search ends. When you check in at a meal, your precise position is sent once, compared with the restaurant's, and thrown away.
- We never show anyone your live location.
- You can download your data, and you can delete your account, from Settings.
- There are no ads in this app.
The rest of this document is the detail.
1. Who we are
Eat With Me is a student project at the University of Southern California. Contact us at jmlin+privacy@usc.edu for anything in this policy.
2. Who can use the app
You must be 18 or older and have an email address at a school we support. Today that is USC only, and you sign in with your USC Google account. Personal Google accounts are refused, and no account is created for them. Do not use Eat With Me if you are under 18. If we learn we have collected information from someone under 18, we delete it.
3. What we collect
You give us:
- Your school email address, and the school domain it belongs to
- Display name, username, and optional profile photo
- Class year, bio, school and degree, if you add them
- That you confirmed you are 18 or older, and when
- Food preferences: cuisines, budget, how far you'll go, party size
- Dietary restrictions and allergies, which you tell us so we don't match you somewhere you can't eat
- Interests: major, languages, hobbies, music, and similar tags
- Which kind of meal you're looking for (matching mode)
- Your privacy choices: a private profile, whether to show your school and degree, whether to show your dietary information, read receipts, and whether to show when you're active
- Your searches: when you want to eat, your budget and mood for that meal, and where to look (see section 4)
- Messages you send to other users
- Who you follow, who you block, and follow requests you approve
- Ratings of the people you ate with and of the restaurant, whether the other person showed up, whether a restaurant suited your dietary needs, and memos you post
- Answers to the optional feedback survey: how likely you'd recommend the app, what you think of the restaurant picks, what would make it better, and anything you write in the optional comment boxes. We remember if you asked us to ask later or not to ask again
- Tables you host or ask to join: the place, time and seats, a note, a name for the table's chat, and any note sent with a request to join
- Reports and appeals you file
- Messages you send through the contact form at /contact: your email address, the category you pick (such as "Can't sign in" or "Report a safety concern"), a short description if you pick "Other issue", your message, a link to your account if you're signed in, and a one-way scrambled fingerprint of your network used only to stop spam (never your IP address itself). The form also uses Cloudflare Turnstile (the same human check as our sign-in and waitlist forms, described in section 7) to protect against bots
We collect automatically:
- Location, only if you choose to share it. See section 4.
- Your meals: who you were matched with, the restaurant, the time, whether you checked in and how, and whether each person came
- Your username history, so a name change can't be used to escape a report
- Timestamps: when you joined, when you were last active, and when each of the things above happened
- While the app is open and on screen, it tells us about once a minute that you're there. We keep only the latest time, overwriting the one before, never a history of when you were online. We also count how many students are online every few minutes and how many sign in each day. Those counts are numbers only, with nobody's account attached
- Badges: we compute which achievements you've earned from your activity in the app — meals, ratings, memos, check-ins, and who sent the first message in a chat — never from what a message says. Which table game types you've played, the first time only, is also stored to award game badges — never your scores or answers — and is deleted with your account
- Cookies and local storage. See section 11.
- Error reports: when a page or action fails, we record what failed and where (the page pattern and the error type), which version of the app, and for failures in your browser, your browser type and whether you're on a phone or tablet, or a computer. We keep no error message text from the failure itself, whether it happened on our servers or in your browser: only its type, a label we wrote naming the part of the app that failed, for a database failure the database's standard error code, and sometimes a one-word note we wrote naming the rule that was broken. We don't record who it happened to, your IP address, messages, what you typed, or your location. Error reports aren't linked to your account, so they can't appear in your data download or be deleted by deleting your account.
Our hosting provider and our sign-in provider receive your IP address and browser details with each request, as any website's do, and may keep them in their own logs. The app's own tables never store your IP address. Rate limits use a scrambled one-way code made from it instead (section 8).
We receive from others:
- From Google, when you sign in: your USC email address, your name, your profile picture link, and your Google account ID. Our sign-in provider stores these. We use the email address, and when you first sign up we copy your Google profile picture once to use as your profile photo; you can change or remove it any time in Settings, and after that it is handled like any photo you upload (section 8). We never show or use the name.
- Restaurant information (name, address, hours, price level) from the Google Places API. That's data about places, not about you.
We do not collect: your contacts, your camera roll, your calendar, your microphone, your browsing outside this app, or advertising identifiers. If you scan a friend's code to follow them, your camera reads the code on your device. No image leaves your phone.
Sensitive information. Allergies and dietary restrictions can reveal health or religious information. We collect them only because a bad match on this dimension is genuinely unsafe. We use them only to filter matches and restaurants, and to show on your profile if you choose. After a meal we may ask whether the restaurant suited your restriction. Those answers are counted per restaurant, and nobody sees who gave them. We never use your dietary information for advertising, profiling, or inference of any kind. You can remove it at any time, at the cost of less accurate matching.
4. Location, specifically
This deserves its own section because it's the most sensitive thing we touch.
- We ask for location in two places: when you search for a meal and choose "Use my location", and when you check in at a meal. You can skip both. Search near campus or pick an area from a list instead, and check in by swapping four-digit codes.
- Searching. Your phone's location service gives the app precise coordinates. The app rounds them on your phone to an area about 500 meters across before anything is sent. Only the rounded area reaches us.
- A search lasts for the time you chose: 90 minutes if you're hungry now, or until the end of the window you picked, which starts out no more than about 13 hours away. Tapping "Widen" to extend the time pushes the end further out, but a search can never run longer than about 14 hours from when you started it. The rough point or area on a search is removed when the search ends. A search that runs out is cleared within 5 minutes of its end time.
- Checking in. If you check in by location, your phone sends your precise position to our server once. We compare it with the restaurant's location and throw it away. We keep only that you checked in, how, and when.
- Your precise position is never written to our database and never appears in our logs.
- We never show your location, precise or rough, to another user. Matches include a restaurant, not a person's position.
- We do not track you in the background. Apart from your meals, which record the restaurant and the time, we keep no history of where you've been.
- If you host a table, your mutual friends (people you follow who follow you back) see which restaurant and when — the one case where hosting ties your name to a place and a time for people beyond who you're eating with. See Hosted tables in section 7.
- Revoke location permission at any time in your device settings. The app keeps working.
5. Why we use it
- Email, school domain, Google sign-in
- WhyCreate and secure your account, confirm you're a student
- Legal basis (GDPR)Contract
- Name, username, photo, profile details
- WhyShow you to the people you meet and follow
- Legal basis (GDPR)Contract
- Preferences, interests, searches, ratings
- WhyMatch you with people and places
- Legal basis (GDPR)Contract
- Interests, counted across students
- WhySuggest interests to others, from counts that need at least five students and never name anyone
- Legal basis (GDPR)Legitimate interests
- Allergies, dietary restrictions
- WhyPrevent unsafe matches, and show on your profile if you choose
- Legal basis (GDPR)Explicit consent
- Rough location
- WhyFind nearby restaurants and nearby people
- Legal basis (GDPR)Consent
- Precise position at check-in
- WhyConfirm you're at the restaurant, then discarded
- Legal basis (GDPR)Consent
- Messages
- WhyLet you coordinate a meal
- Legal basis (GDPR)Contract
- Feedback survey answers
- WhyImprove the app. Your answers are read by our staff without your name attached and are optional
- Legal basis (GDPR)Legitimate interests
- Hosted tables: note, name, requests to join, and your first name shown to mutual friends
- WhyLet students find, join and run a table
- Legal basis (GDPR)Contract
- Push subscriptions: an address per device you turn notifications on for
- WhyDeliver a notification through your browser's push service
- Legal basis (GDPR)Consent
- Meal history, check-ins, attendance
- WhyKeep ratings honest and matching fair
- Legal basis (GDPR)Legitimate interests
- Reports, blocks, ratings, username history
- WhyKeep people safe and keep ratings honest
- Legal basis (GDPR)Legitimate interests
- Moderation audit log, rate-limit counters
- WhyDetect abuse, investigate incidents
- Legal basis (GDPR)Legal obligation, legitimate interests
- Error reports
- WhyFind and fix what breaks
- Legal basis (GDPR)Legitimate interests
| What we use | Why | Legal basis (GDPR) |
|---|---|---|
| Email, school domain, Google sign-in | Create and secure your account, confirm you're a student | Contract |
| Name, username, photo, profile details | Show you to the people you meet and follow | Contract |
| Preferences, interests, searches, ratings | Match you with people and places | Contract |
| Interests, counted across students | Suggest interests to others, from counts that need at least five students and never name anyone | Legitimate interests |
| Allergies, dietary restrictions | Prevent unsafe matches, and show on your profile if you choose | Explicit consent |
| Rough location | Find nearby restaurants and nearby people | Consent |
| Precise position at check-in | Confirm you're at the restaurant, then discarded | Consent |
| Messages | Let you coordinate a meal | Contract |
| Feedback survey answers | Improve the app. Your answers are read by our staff without your name attached and are optional | Legitimate interests |
| Hosted tables: note, name, requests to join, and your first name shown to mutual friends | Let students find, join and run a table | Contract |
| Push subscriptions: an address per device you turn notifications on for | Deliver a notification through your browser's push service | Consent |
| Meal history, check-ins, attendance | Keep ratings honest and matching fair | Legitimate interests |
| Reports, blocks, ratings, username history | Keep people safe and keep ratings honest | Legitimate interests |
| Moderation audit log, rate-limit counters | Detect abuse, investigate incidents | Legal obligation, legitimate interests |
| Error reports | Find and fix what breaks | Legitimate interests |
We do not use your information to train machine learning models on your messages.
6. Messages, and what we can see
Be clear-eyed about this. Today, messages are encrypted in transit and encrypted at rest on our servers, and access is restricted by database-level policies so only conversation participants can read them through the app. They are not end-to-end encrypted, which means our systems technically could access message content, and we would disclose it if legally compelled to.
We access message content only to investigate a report or a safety incident, or where the law requires it. We do not read messages for analytics, advertising, or product development.
When someone reports a conversation, the moderator reviewing it sees the messages the reporter chose to include, taken from our servers exactly as they were sent — not as the reporter retyped them, and not from the reporter's device. If one of the other person's messages had been unsent when the report was filed, the moderator sees its held copy, marked as unsent by the sender; the person who reported it does not.
Messages you send to Eat With Me support are stored, read by our admins and moderators, and kept as long as your account exists; they are deleted with it, on the same schedule as the rest of your account (section 9).
Messages you send through our contact form are also stored and read by our admins and moderators to answer you.
End-to-end encryption is planned but not built. If it ships, we will not be able to read your messages at all, and we will update this policy and notify you before the change takes effect.
If you turn notifications on, we store a push address for each device — one row per device, deleted the moment you turn notifications off on it or remove it in Settings. Notifications are delivered through your browser maker's push service (Apple, Google, Mozilla or Microsoft). The contents are encrypted so that service cannot read them, but it sees when a notification is sent, and how big it is. A message notification shows the sender and the start of the message on your device, including on a lock screen. A message notification waits about 30 seconds before it is sent, so unsending a message within that time means it is never shown in a notification. If you unsend it later, a notification may already have shown it. The notifications list itself is kept for 30 days. You can turn each kind off, or all of them, in Settings → Notifications.
7. Who we share it with
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
We share with service providers who process data on our behalf, under contract, only to run the service:
- Supabase
- What they handleDatabase, sign-in, file storage, and realtime messaging. Stores what Google sends when you sign in (section 3). When email sign-in is on, it also sends sign-in codes. If Google's map can't load, it also serves the map tiles, fonts and icons your browser draws instead, which tells it your IP address and the part of the map you're viewing, never your location
- Vercel
- What they handleApplication hosting. Receives your IP address and browser details with each request
- Google, for sign-in
- What they handleWhen you continue with Google, Google learns that you signed in to Eat With Me. Governed by Google's own privacy policy
- Google Maps Platform
- What they handleMost of the time, the map in your browser loads from Google, which receives your IP address, browser details, and the part of the map you're viewing. If Google's map fails to load, we switch to our own map data, served from Supabase, and your browser stops loading Google's map for a while (until Google's daily reset, if Google's daily usage limit ran out). Google sees the attempt that failed, not the map views after it. Our server asks Google for restaurant listings around campus; those requests carry campus locations, never yours. Governed by Google's own privacy policy
- Cloudflare Turnstile
- What they handleWhen this check is turned on (it starts off), checks that the waitlist form and the email sign-in forms (not the Google button) are used by people, not bots; Cloudflare receives your IP address and browser signals for that check
| Provider | What they handle |
|---|---|
| Supabase | Database, sign-in, file storage, and realtime messaging. Stores what Google sends when you sign in (section 3). When email sign-in is on, it also sends sign-in codes. If Google's map can't load, it also serves the map tiles, fonts and icons your browser draws instead, which tells it your IP address and the part of the map you're viewing, never your location |
| Vercel | Application hosting. Receives your IP address and browser details with each request |
| Google, for sign-in | When you continue with Google, Google learns that you signed in to Eat With Me. Governed by Google's own privacy policy |
| Google Maps Platform | Most of the time, the map in your browser loads from Google, which receives your IP address, browser details, and the part of the map you're viewing. If Google's map fails to load, we switch to our own map data, served from Supabase, and your browser stops loading Google's map for a while (until Google's daily reset, if Google's daily usage limit ran out). Google sees the attempt that failed, not the map views after it. Our server asks Google for restaurant listings around campus; those requests carry campus locations, never yours. Governed by Google's own privacy policy |
| Cloudflare Turnstile | When this check is turned on (it starts off), checks that the waitlist form and the email sign-in forms (not the Google button) are used by people, not bots; Cloudflare receives your IP address and browser signals for that check |
Other students see:
- Your username and photo, always, even if your profile is private, and how many followers you have and how many people you follow.
- Unless your profile is private: your display name, class year, bio, cuisines, interests, whether you're verified as a student, when you joined, and your EatScore. Public profiles with points are listed on the school leaderboard by username and photo.
- A private profile shows all of that only to people whose follow request you approved, and to the people you're matched or seated with for a meal. People you approved also see your EatScore on their Friends board.
- Your school and degree, and your dietary restrictions and allergies, only if you turn them on, and only to people who can see your full profile.
- The person you're matched with sees a rough reliability band, such as "Good", and up to four interests or cuisines you share.
- Whether you're active: a green dot while you're on the app, or how long ago you last were ("Active 3h ago", then "Active 2d ago"), shown next to your name. Nothing is shown after 30 days away. It follows the same rules as your display name: hidden from anyone you've blocked or who blocked you, and on a private profile shown only to people who can see your full profile. You can turn it off in Settings, Privacy. Turning it off also hides other students' activity from you.
- Memos you post appear on the restaurant's page for every signed-in student, with your username and photo.
- Badges you've earned: up to three you've chosen to pin, and how many you have in total, shown wherever the rest of your full profile is — hidden on a private profile unless whoever's looking can see your full profile, and never shown to anyone you've blocked or who's blocked you.
- If you send them your friend invite link, they see your first name without signing in, and can add you as a friend. If you send them a public table link, they see the restaurant and time.
They do not see your email, your location, your Elo number, the list of who you follow or who follows you, who you've blocked, your other meals (except that your mutual friends see the tables you host; see Hosted tables below), or your ratings of anyone.
We may disclose information if legally required, to protect someone's safety, or in connection with a merger or acquisition, in which case we'll tell you before your information moves.
Hosted tables
A student can host a table for three or more people, or join one someone else is hosting. Every table is listed on the Tables tab for students who can use matching: the restaurant, the time, how many seats are open, and the table's note. They never see a guest's name unless they're seated with you. If you're the host, your mutual friends (people you follow who follow you back) see your first name and can join instantly while a seat is open; everyone else asks to join, and you approve or decline. Nobody outside a table can see who else is seated there, and a guest's name is never shown to the host's friends, only to the people actually seated.
When you ask to join a table, the host sees your profile card (your photo and username always, and your name, bio and more if your profile is public or the host can already see your full profile — an approved follower, or someone you have a meal with coming up or in the past week) along with the note you send with your request, if you send one. Nothing else changes until the host answers: no chat opens, and nobody but the host learns you asked.
If, when you ask, you or someone already seated (the host included) has a block in place with the other, your request is quietly set aside: you'll still see "You asked to join," and the host is never shown it. The same happens if the table later passes to a new host while such a block stands. Otherwise, if a block comes to stand between you and someone at the table after you asked (a new block, or someone you have a block with sitting down), your request closes: straight away if it's between you and the host, or, if it's with someone else at the table, when the host tries to approve you, and the host is told only that we couldn't seat you. Either way you read "The host couldn't fit you in", the same message you'd see if the host simply declined.
Once you're seated:
- Everyone at the table shares one chat, and everyone in it can read what you send there. Everyone seated with you can see your full profile, even if it's private, the way the person you're matched with can.
- You can report or block anyone at the table from the table's page. Any student who can see a table can report its note; people seated at it can report its name; the host can report a note sent with a request. We always read the reported text from what's actually posted, never from what the reporter typed. A copy attached to a report stays with the report (section 8).
- In a table's chat, read receipts show only how many people read a message, never who or when.
- You rate each person at the table separately. Ratings stay private, as they do after a meal for two.
- If you block someone at the table before it starts, you give up your seat and leave its chat; once it has started, you leave the chat only. Deleting your account gives up your seat at every table you're at that hasn't started yet. The table carries on for the others while at least two are still seated. Otherwise it's called off, or, if only the host is left and it's still well ahead, it reopens for them with a fresh chat.
Blocks, requests, and the reasons a table opens or closes never leave the app: no push notifications, no emails, and nothing goes to anyone beyond the service providers listed above that run the app.
8. How long we keep it
- Account and profile
- RetentionUntil you delete your account. You then have 7 days to restore it; within about an hour after that, it is deleted permanently
- Profile photo files
- RetentionReplacing or removing your photo deletes the old file within about an hour, through an automatic cleanup we retry hourly until it succeeds; the same happens if a new photo fails to save. A photo a moderator removed is kept, as a record of the removal, until your account is deleted — you can't delete, replace, or restore it yourself before then. When your account is deleted, every photo you ever uploaded is deleted the same way. Until a file is deleted, our cleanup queue holds its file name, which includes your account ID
- Name, picture link and Google account ID from Google sign-in
- RetentionUntil your account is deleted permanently
- Rough location on a search
- RetentionUntil the search ends. A search that runs out is cleared within 5 minutes of its end time
- Other search details: when, budget, mood, distance, campus
- RetentionUntil you delete your account
- Precise position at check-in
- RetentionNot kept. Compared once, then discarded
- Meal history: restaurant, time, who you ate with, check-ins, attendance
- RetentionUntil you delete your account. After that, your account ID is removed and the record is kept. See section 9
- Messages
- RetentionUntil you delete your account, except messages included in a report, which are kept with the report (see Reports). Deleting a message or a chat removes it from your view only; the other person keeps their copy
- Unsent messages
- RetentionA copy is held for 30 days so the recipient can report it; it is read only if reported, and deleted after the 30 days. If it is reported, the copy attached to the report stays with the report (see Reports)
- Reports, including any messages or table text attached to them
- RetentionUntil 1 year after a moderator closes the report. After that we clear the details and anything attached to it, and keep who made the report, about whom, the reason chosen, and its outcome. Reports still open are kept until a moderator closes them. If either person deletes their account, their account ID is removed from the report
- Ratings you give and receive
- RetentionPrivate. The Elo, points and reliability changes they cause are kept with no end date. When you delete your account, your account ID is removed from them and they are kept. See section 9
- Feedback survey answers
- RetentionKept until you delete your account. When you do, your account ID and the written comments are removed straight away and the 0-10 score and multiple-choice answers are kept as anonymous counts, with their dates reduced to the day
- Whether to ask you for feedback (later / don't ask again)
- RetentionUntil your account is deleted permanently
- Username history
- RetentionUntil you delete your account. Never shown to other students
- Hosted tables: a table, its note and name, and requests to join
- RetentionUntil you delete your account. When deletion becomes permanent, your account ID is removed from any table you hosted and the table is kept as part of the meal's record (see Meal history). A note or name you wrote is erased, and your requests are deleted. A table's custom name is also cleared if it reopens
- Rate-limit counters
- RetentionDeleted within two days. They hold a scrambled one-way code made from your IP address or email address (never the address itself), your account ID, or your school's domain
- Sign-in attempts from schools we don't support yet
- RetentionThe school's domain and a scrambled one-way code made from the email address, to count interest. Kept until we remove them; contact us to have yours removed.
- Moderation audit log
- RetentionKept indefinitely. It records which moderator did what, to which account, report, memo, appeal, staff role, site setting, or site-wide notice, and when, with the moderator's own note about the action — written without copying message text or your name — and a keyed hash of the moderator's IP address. Before/after details are ids and scalar values only; message text is never stored here
- Sign-in codes
- RetentionOnly when email sign-in is on. Kept by Supabase, our sign-in provider. Each code works once, stops working when it expires, and is deleted when you use it or ask for a new one
- Messages to Eat With Me support
- RetentionUntil you delete your account, on the same schedule as the rest of your account (section 9)
- Contact form messages
- RetentionUntil we've handled them, then 90 days (an admin can change this); ones you send while signed in are also deleted with your account, on the same schedule as the rest of your account (section 9)
- Record of an address our staff let in to sign up early
- RetentionKept, as the record of who did it, when and why. If the address is never used to sign up, the record keeps the address as it was written. If it is used and you later delete the account it created, the address in that record is replaced with a one-way hash
- Error reports
- Retention30 days
- When you were last active
- RetentionOne time per account, replaced each time you use the app. Deleted when your account is deleted permanently
- Counts of students online and signing in
- RetentionKept indefinitely. They are totals per few minutes or per day, with no account attached
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account. You then have 7 days to restore it; within about an hour after that, it is deleted permanently |
| Profile photo files | Replacing or removing your photo deletes the old file within about an hour, through an automatic cleanup we retry hourly until it succeeds; the same happens if a new photo fails to save. A photo a moderator removed is kept, as a record of the removal, until your account is deleted — you can't delete, replace, or restore it yourself before then. When your account is deleted, every photo you ever uploaded is deleted the same way. Until a file is deleted, our cleanup queue holds its file name, which includes your account ID |
| Name, picture link and Google account ID from Google sign-in | Until your account is deleted permanently |
| Rough location on a search | Until the search ends. A search that runs out is cleared within 5 minutes of its end time |
| Other search details: when, budget, mood, distance, campus | Until you delete your account |
| Precise position at check-in | Not kept. Compared once, then discarded |
| Meal history: restaurant, time, who you ate with, check-ins, attendance | Until you delete your account. After that, your account ID is removed and the record is kept. See section 9 |
| Messages | Until you delete your account, except messages included in a report, which are kept with the report (see Reports). Deleting a message or a chat removes it from your view only; the other person keeps their copy |
| Unsent messages | A copy is held for 30 days so the recipient can report it; it is read only if reported, and deleted after the 30 days. If it is reported, the copy attached to the report stays with the report (see Reports) |
| Reports, including any messages or table text attached to them | Until 1 year after a moderator closes the report. After that we clear the details and anything attached to it, and keep who made the report, about whom, the reason chosen, and its outcome. Reports still open are kept until a moderator closes them. If either person deletes their account, their account ID is removed from the report |
| Ratings you give and receive | Private. The Elo, points and reliability changes they cause are kept with no end date. When you delete your account, your account ID is removed from them and they are kept. See section 9 |
| Feedback survey answers | Kept until you delete your account. When you do, your account ID and the written comments are removed straight away and the 0-10 score and multiple-choice answers are kept as anonymous counts, with their dates reduced to the day |
| Whether to ask you for feedback (later / don't ask again) | Until your account is deleted permanently |
| Username history | Until you delete your account. Never shown to other students |
| Hosted tables: a table, its note and name, and requests to join | Until you delete your account. When deletion becomes permanent, your account ID is removed from any table you hosted and the table is kept as part of the meal's record (see Meal history). A note or name you wrote is erased, and your requests are deleted. A table's custom name is also cleared if it reopens |
| Rate-limit counters | Deleted within two days. They hold a scrambled one-way code made from your IP address or email address (never the address itself), your account ID, or your school's domain |
| Sign-in attempts from schools we don't support yet | The school's domain and a scrambled one-way code made from the email address, to count interest. Kept until we remove them; contact us to have yours removed. |
| Moderation audit log | Kept indefinitely. It records which moderator did what, to which account, report, memo, appeal, staff role, site setting, or site-wide notice, and when, with the moderator's own note about the action — written without copying message text or your name — and a keyed hash of the moderator's IP address. Before/after details are ids and scalar values only; message text is never stored here |
| Sign-in codes | Only when email sign-in is on. Kept by Supabase, our sign-in provider. Each code works once, stops working when it expires, and is deleted when you use it or ask for a new one |
| Messages to Eat With Me support | Until you delete your account, on the same schedule as the rest of your account (section 9) |
| Contact form messages | Until we've handled them, then 90 days (an admin can change this); ones you send while signed in are also deleted with your account, on the same schedule as the rest of your account (section 9) |
| Record of an address our staff let in to sign up early | Kept, as the record of who did it, when and why. If the address is never used to sign up, the record keeps the address as it was written. If it is used and you later delete the account it created, the address in that record is replaced with a one-way hash |
| Error reports | 30 days |
| When you were last active | One time per account, replaced each time you use the app. Deleted when your account is deleted permanently |
| Counts of students online and signing in | Kept indefinitely. They are totals per few minutes or per day, with no account attached |
9. Your rights
Everything below is available in Settings, without emailing anyone.
- See and download your data. Settings → Account → Export data. You get a JSON file with your account and profile details (including your privacy settings and your 18+ confirmation), preferences, interests, the people you've blocked, your conversations and the messages in them, plus every message you sent that we still hold — including ones you've hidden, and ones in chats you've left or cleared — your meals and check-ins, your match offers, restaurant suggestions you made, the tables you host and your requests to join other tables, the ratings you gave people and restaurants, your dietary answers about restaurants, your memos, the reports you filed and your appeals, who you follow and who follows you, including requests, your searches, which called-off notices you dismissed, your streaks with meal partners, your standing (EatScore, Elo, reliability, and the events behind them), your username history, your feedback survey answers, the details your sign-in provider holds for you — for Google, your name, profile picture link, and Google account ID — your notification preferences and inbox, your device labels for push notifications, a record of your past downloads, how long we keep each kind of data, and any of your own rows that are waiting to be erased permanently. Not included: what other students said or reported about you (reports, ratings, and the match and Elo scores worked out from them); moderation records such as held copies of messages you unsent and photos a moderator removed; other people's messages you've hidden, and in chats you've left or cleared; other people's requests to join a table you host; a table's note or name you wrote, unless you're still that table's host (so not for a table you called off or left, or a name you gave someone else's table); and your push notification keys (kept only to encrypt what your browser's push service can't read). If something else is missing, contact us.
- Correct it. Edit your profile, preferences, and interests any time.
- Delete your account. Settings → Account → Delete my account, confirmed by typing a phrase. You then have 7 days to change your mind: sign in again and you'll be asked whether to restore it. Restoring doesn't bring back meals that deleting cancelled, chats it ended, or your feedback survey answers, which deleting made anonymous. After the 7 days, deletion is permanent.
- Withdraw consent. Revoke location permission, remove your allergy information, hide your dietary information, school and degree, make your profile private, or turn off read receipts.
- Object or restrict. Contact us.
What survives deletion, and why. Your ratings of other people permanently affected their standing on the app. Deleting those records would corrupt other users' scores through no fault of theirs. So when your account is deleted permanently, we remove your account ID from those records, and from the ratings others gave you. What remains cannot be traced to you through your name, email, or account ID: the scores, the meal they belong to (restaurant and time), whether each person came, the Elo, points and reliability changes the meal caused, and any answers about whether a restaurant suited a dietary need. Those Elo, points and reliability changes are kept with no end date. Your feedback survey answers are handled the same way: the 0-10 score and multiple-choice answers are kept as anonymous counts, but the written comments are deleted.
A hosted table works a little differently again. When you delete your account, you give up your seat at any table you're at that hasn't started yet, and your pending requests to join are withdrawn. When the deletion becomes permanent, any note or name you wrote on a table is erased and every request you made to join a table is deleted. The table itself stays, like the meal it belongs to, without your account ID. The table carries on for the others as it would if you had left it (section 7).
Everything else — profile, photo, messages you sent (including ones to Eat With Me support), preferences, interests, memos, searches, follows, blocks, appeals, and username history — is deleted, with three exceptions. Messages, a table's name or note, or a note you sent with a request to join, included in a report are kept with the report until 1 year after it is closed. If a moderator ever acted on your account, the moderation audit log keeps your bare account ID and the moderator's note about the action, which we write without copying message text or your name. And if our staff ever let your address in to sign up early, that record is kept: if the address is never used to sign up, the record keeps it as written; if it is used and you later delete the account it became, the address itself is replaced by a one-way hash — we still know who did it, when, and why, but not the address.
If you're in California (CCPA/CPRA): you have the rights above plus the right to know categories collected, disclosed, and sold. We sell nothing and share nothing for advertising. We will not discriminate against you for exercising any right.
If you're in the EEA, UK, or Switzerland (GDPR): you have the rights above plus the right to lodge a complaint with your supervisory authority. Our legal bases are in section 5. Data is processed in the United States under Standard Contractual Clauses where required. We know a meaningful share of our users are international students, and we intend this to be accurate for them, not just for domestic users.
We respond to requests within 30 days, or 45 where the law allows an extension.
10. Security
We use TLS in transit, encryption at rest, row-level database policies that restrict access to the specific people entitled to it, rate limits on sign-in, profile views and messages, and role-restricted internal access with every administrative action logged to an append-only audit trail. Our team does not have routine access to your messages.
No system is perfectly secure. If a breach affects your information, we will notify you and the relevant authorities as required by law.
11. Cookies
We use cookies and local storage only for sign-in, session management, remembering your theme choice, remembering on your device when you last skipped the setup questions before a search, remembering which site-wide notices you've dismissed, and — if Google's map fails to load in your browser — remembering that, so we don't keep retrying it. No advertising cookies. No third-party trackers. The map is loaded from Google, or from our own storage if Google is unavailable (section 7). There is nothing to opt out of, because we didn't put anything there.
12. Changes
We will post the new version here with an updated date. For material changes — particularly anything that changes what we collect or who sees it — we will notify you in the app before the change takes effect.
13. If you joined the launch waitlist
Before the app opens, you can leave your school email address on the homepage — open to students at any school, not just USC, so we can see which campuses want it next — or, with an address at a school we already support, by entering it on the sign-in page while signups are closed and email sign-in is on. Both are the same list. Joining it does not create an account, and it is kept separately from everything else in this policy.
What we store, and why. Your email address and its school's domain — nothing else — so we can send you one email when we open at your school.
Who can see it. Nobody. Your address is never shown to another student, and nothing in the app — no screen, no search, no profile, no admin tool a moderator uses day to day — can read this list. It is reached only directly, by us, outside the app.
We keep the row after we email you. Sending the launch email does not delete your row. The timestamp we record when we send it is the only thing that stops us emailing you a second time, so removing it would destroy the one record that prevents a duplicate. It is not used for anything else.
You can ask us to remove it. Contact us and we will delete your row from the list.
14. Contact
Send us a message with the contact form at /contact, or email us at the address below.
jmlin+privacy@usc.edu · Eat With Me, a student project at the University of Southern California