Privacy Policy

• We collect what we need to run a food deals app: your school email and name to verify you, the deals you claim and redeem, and your friends on Pool.
• When you redeem a deal, we record your location at that moment to confirm you are at the restaurant. There is no background location tracking.
• If you choose to find friends from your contacts, your address book is matched on our server and immediately discarded. We never store it.
• Restaurants see that a valid deal is being redeemed and the name on your pass. They do not get your email, phone number, or a list of what else you have redeemed. What we tell a restaurant about who uses Pool is only ever a total.
• We do not sell your personal information, we do not show ads, and we do not track you across other companies' apps or websites.
• You can delete your account in the app at any time. See Delete your account.

We do not collect your date of birth, government ID, payment card numbers, health data, biometric data, or precise location outside the redemption moment. The only age information we hold is the optional age range you can pick in Profile. We never ask about ethnicity, religion, nationality, immigration status, sexual orientation, disability, or income. Face ID and Touch ID, if you use them to unlock your phone or autofill a password, never leave your device and are handled entirely by Apple or Google.

• Verify you are eligible. Only people with a University of Chicago or Chicago Booth email can join, so we check the email domain and send a verification code.
• Run the deals. Show you deals, let you claim, book, and redeem them, enforce each deal's limits (for example one redemption per deal per 30 days), and generate the pass that restaurant staff check.
• Prevent fraud. Location at redemption, device details, and claim history help us stop screenshots, shared accounts, and repeat redemptions that would hurt the restaurants.
• Friends and rewards. Power friend requests, activity you choose to share, referral tracking, streaks, points, leaderboards, and Pool Wrapped.
• Notifications. Send push notifications you have allowed, such as a deal you booked starting soon, a friend request, or a deal you looked at this week that is open now.
• Support and safety. Answer your messages, investigate reports of abuse, and enforce our Terms of Service.
• Improve the product. Understand which features are used and fix crashes, using PostHog and Sentry as described below.
• Legal. Comply with law, respond to valid legal requests, and protect the rights and safety of Pool, our users, and our partners.

We do not use your information for advertising, and we do not build profiles of you for anyone else.

The app asks for location permission ("while using the app") the first time you redeem a deal. At the moment you slide to redeem, we record your device's coordinates to confirm you are at the restaurant and to detect fraud. The Discover tab also uses your location, on your device only, to center the map. We never collect location in the background, and we never share your coordinates with restaurants or other students. If you decline location permission you can still browse and book, and you can redeem by showing the pass to staff.

Find friends from contacts is optional. If you turn it on, the app reads the email addresses and phone numbers in your address book and sends them, in a single request, to our server. The server compares them against Pool accounts, returns the matches, and discards your list. We do not store your contacts, we do not message anyone in your contacts, and we do not build a contact database. You can revoke the Contacts permission in your phone's settings at any time.

Other students on Pool. Your name and house are visible to people you connect with. Friends see the deals you redeem only if you keep the "Show my redemptions to friends" switch on in Profile. Leaderboards show your name, house, and points to other students. People who search for you by name can see your name and mutual friends. Nobody on Pool sees your email address, phone number, or location.

Restaurants. When you redeem, the restaurant sees that the pass is valid, what to give you, and the name shown on your pass. They do not receive your email, phone number, or your history at other restaurants. We share redemption counts with each restaurant as totals. We may also tell a restaurant, as totals only, who its Pool customers are, for example the share who are undergraduates or who eat vegetarian. We do not share a total for a group so small that it could point to one person, and we never share an individual answer.

Restaurants, for a catering request. A catering request only works if a restaurant sees it, so when you send one we pass your event details and a way to reach you to the restaurant you picked, so they can price it. That is what the consent box on the form is for, and without it we neither contact you nor send anything to a restaurant. We do not send them your Pool account history. You pay the restaurant directly and Pool handles none of that money.

Service providers. Companies that process data for us under contract and may only use it to provide their service to us:

Each provider is bound by its own privacy commitments and must protect your data at least as well as this policy requires.

Legal reasons. We may disclose information if we believe in good faith it is required by law, a court order, or a government request, or to protect the safety of a person, or the rights and property of Pool. If a report involves a serious safety incident we may share relevant information with law enforcement or the University.

Business transfer. If Pool is acquired or merges with another organization, your information may be transferred to the new owner, who must honor this policy. We will tell you in the app or by email before that happens.

We do not sell personal information, and we have not sold it in the last 12 months. We do not share personal information for cross-context behavioral advertising.

We use PostHog to record product events such as which screen you opened or which button you tapped, tied to your Pool account ID so we can understand how the app is used. In the app, PostHog also records a replay of the screens you move through, so we can see where people get stuck. Every piece of text and every image is blanked out on your phone before anything is sent, and redeem codes are hidden too, so a replay shows taps, scrolling and the layout of each screen, never what you typed, your name, your friends or your photos. Replays are deleted after 30 days. In the app, your who-are-you answers (affiliation, year, house, what you eat, and the three optional answers if you gave them) are attached to that analytics profile, so we can see, for example, whether first-years redeem more than fourth-years. Your name and email are not sent to PostHog. Deleting your account deletes the copy on our servers; to have the PostHog profile removed as well, email support@pooluchicago.org from your account email and we do it by hand. We use Sentry to receive crash reports; it is configured not to send personal data. Neither service is used for advertising, and we do not use the advertising identifier (IDFA or GAID). The app does not ask for App Tracking Transparency permission because it does not track you across other companies' apps and websites.

pooluchicago.org uses two analytics tools, neither of which is used for advertising. Vercel Web Analytics counts page views without cookies. PostHog tells us which pages get read, how long people stay, how far down a guide they scroll, and what they click, so we can write guides worth reading and fix the pages that lose people. It also records a replay of each visit, meaning the page, your scrolling and your taps, so we can see where people get stuck. Anything you type into a form is hidden before it leaves your browser, and replays are deleted after 30 days. No replay is recorded on the merchant portal, the admin console, or a page opened from a link that carries a pass or sign-in token.

What that does not include, by design: we never see what you type, we do not build a profile about you, and website analytics is never linked to your Pool account, name or email. The events are anonymous. We never collect anything on the merchant portal or the admin console. We set no tracking cookie: PostHog keeps an anonymous visitor ID in your own browser's local storage instead. The merchant portal and admin console set strictly necessary sign-in cookies so that staff stay logged in; these are not used for tracking. We do not use advertising cookies or third-party tracking pixels, and we do not track you across other websites.

If your browser sends a "Do Not Track" or Global Privacy Control signal, PostHog is switched off for your visit and no analytics events are sent at all. You can also block it with any content blocker.

Push notifications are only sent after you allow them in the app and on your phone. You can turn them off at any time in Profile or in your phone's settings. We send email for things you asked for: verification codes, friend or ride invitations you initiate, and replies to your support requests. We do not send marketing email today. If we ever start, we will ask first and every message will include a way to unsubscribe.

• Delete your account. Profile, then Delete account. This is immediate and permanent. If you no longer have the app, follow the steps on pooluchicago.org/delete-account.
• See or correct your data. Your profile and history are in the app. To receive a copy of the personal data we hold about you, or to correct something you cannot change in the app, email support@pooluchicago.org from your account email. We answer within 45 days.
• Location, contacts, notifications. Control each permission in your phone's settings. Nothing in Pool requires them except location at the moment of redemption, and staff can still check your pass without it.
• Friends visibility. The "Show my redemptions to friends" switch in Profile hides your redemptions from every friend-facing surface.
• Block and report. Block any user from their profile. Report abuse in the app or by email; we review reports promptly.
• Sign out of Google or Apple. Deleting your account removes the link between Pool and your Apple or Google account. You can also revoke Pool from your Apple ID or Google account settings.

California residents. You have the right to know what personal information we collect, use, and disclose, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information, so there is no sale to opt out of. Send requests to support@pooluchicago.org with the subject "California privacy request". We will verify the request against your account email and respond within 45 days. You may use an authorized agent if they provide your written permission.

Residents of other states. Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states give similar rights. We honor access, correction, and deletion requests from any U.S. resident in the same way.

Illinois. We do not collect biometric identifiers or biometric information, so the Illinois Biometric Information Privacy Act does not apply to our processing. If a data breach affects your personal information, we will notify you as required by the Illinois Personal Information Protection Act.

All traffic between the app, the website, and our servers is encrypted with TLS. Passwords are stored only as bcrypt hashes. Verification codes expire in ten minutes and are hashed. Access to production systems is limited to the people who operate Pool, protected by authentication, and logged. Pass QR codes rotate so a leaked screenshot stops working. No system is perfectly secure, so we also keep the data we hold to what the service needs and delete it on the schedule above. If we learn of a breach affecting your personal information we will tell you and the authorities as the law requires.

Pool is for adults. You must be at least 18 years old to create an account, and the app is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us personal information, email support@pooluchicago.org and we will delete it.

Pool began as a way for students to share rides, and those features still exist for people who reach them through an old link or notification. If you post a ride request, other students in the ride feed can see your first name and your pick-up and drop-off addresses so they can decide whether to join, and students you are matched with can see your phone number so you can coordinate. Ride requests and matches are kept until you delete them or your account. Campus events you RSVP to may be visible to friends depending on the visibility you choose.

Today you pay the restaurant directly and Pool handles no money. If we turn on prepaid deals in the future, payments will be processed by Stripe. Your card details would go straight to Stripe and never touch our servers; we would keep the amount, the date, and Stripe's transaction reference to handle refunds and disputes. We will update this policy before any such feature launches.

Pool is offered in the United States and our servers are in the United States. If you use Pool from outside the U.S., your information will be transferred to and processed in the U.S.

When we change this policy we update the effective date at the top. If a change materially affects how we use your personal information we will tell you in the app or by email before it takes effect. Continuing to use Pool after a change means you accept the updated policy; if you do not, delete your account.

Email support@pooluchicago.org, or write to:

Pool is operated by Victor Hardt. Accessibility concerns are handled the same way; see our accessibility statement.