Privacy Policy

1 Who we are

Up-To is a campus app for Santa Clara University students. It shows what is happening on campus (events, clubs, dining, athletics and student-posted "Up-Tos") and lets you post things yourself.

Up-To is built by students. It is not affiliated with, operated by, or endorsed by Santa Clara University.

2 What we collect

Your account. Your name and the email address you sign up with (any address, not only an @scu.edu one). Other students see your name only as your first name and last initial, and only where "Posting anonymously, and who sees your name" below says; they never see your full name, your username or your email address. Our server gives each account a username made from your name when you sign up; other students do not receive it. We do not ask for a username or gender. Older accounts keep their username and gender; other students cannot see that gender. A new account has no gender stored. You sign up with Google or Apple, and we store the identifier they give us; from Apple we also store the contact address it shares, which may be one of Apple's relay addresses rather than your own. You have no password with us. Accounts made in earlier versions by emailing a six-digit code keep that address.

Connecting a second way in. If you sign in with Google or Apple and the address they confirm is already on an Up-To account, we may connect that sign-in to that account so both work, and we tell you when we have. We only do it when the provider is the one that issues that kind of address and the account has no password and no two-factor set up; otherwise we sign nobody in and tell you which way in that account already uses.

Whether you are a Santa Clara student. Having an account is not the same as being verified. To verify, you give us an scu.edu address and the year you graduate, and we email that address a six-digit code. If you sign in with Google or Apple using your scu.edu address, we email that code as you sign in, without you asking. We store only a hashed form of the code, it expires, and it is retired after a small number of wrong guesses; if a code is never used, we keep the address it was sent to along with that hash, and delete both after the code expires. Once you verify, we keep the address, the date you verified, the date the verification runs out, and the class year you gave. Verification runs to 30 September each year and ends for good after your class year, so you re-verify with a new code. Until you verify, you can use the campus half of Up-To (events, clubs, dining, athletics) and say you are going to things, but you cannot see or make students' posts or Drops, use Friends or open another student's profile, and what you say you are going to is not added to the public count. You can still chat, and if you say you are going to a campus event you can join its chat, where you are marked Not verified (see "Chat").

Your profile photo, if you add one. You can take or pick a photo for your profile. We store it privately with Supabase, linked to your account, shrunk to at most 512 pixels on its longest side and with its location and camera details removed, and the app shows it through links that stop working after an hour. You always see it. Other people see it only in chat, and only after you say yes when the app asks (see "Chat"). Removing the photo deletes it.

In the older screens (see "Up-To's older screens" below) any account can also pick a profile picture, and an account may have one from when it signed up with Google or Apple. That picture is never shown to anyone else. Accounts made in the older version of Up-To may also have a password, which we store only as a hash, a Sign in with Apple identifier, a phone number or two-factor authentication. The current app has no way to add any of those.

Your sign-ins. For each signed-in session we keep when it began and when it was last used, and for a Google sign-in, the name of the software that connected and a hashed form of your internet address. While the app is open and you are signed in, our server also notes that you are online and the time you were last seen. Nobody else is shown that time, only how recently you were around ("Chat" below says who sees what).

What you post. For each Up-To: its text, the category you picked, when it starts and when it stops being live, its place name and its pin (the latitude and longitude of your phone when you made it, or of the spot you chose instead, described under "Your location" below), and which account posted it, and when it was posted and last edited.

Repeating events. If you set an Up-To to repeat (every day, every week, every two weeks or every month, until a date you pick), each date is stored as its own Up-To, with everything above, and we also keep a record of the series: which account made it, the repeat rule and the date it ends. A series can have at most 60 dates and can run at most six months from its first date. Other students who can see the post see each date, the repeat rule and the list of dates. Editing or deleting one date can apply to that date alone or to it and every later one. Deleting dates does not delete the series record.

"Still here" and "It's over". When an Up-To that is happening now did not say when it ends, the app shows an end it assumes, and verified students who can see the post (not its host) can say "Still here" or "It's over". We keep each answer with the post, the account that gave it, which answer it was and when. "Still here" moves the post's end later; two "It's over" answers end the post early. Other students see how many said "Still here", and you see your own answer; nobody is shown who answered. When the assumed end arrives, the host gets a notification asking whether the post is still going, and can add an hour or end it; we keep the moved or early end with the post. Answers stay until the post is deleted.

Photos you post with an Up-To. If you started a post from a photo and post it, the photo (up to four) is stored with the Up-To, with its location and camera details removed, and shown to verified students who can see that post, with a note that the draft was made from the photo with AI. The post screen shows you each photo that will go up, and you can take any of them off before you post. It is deleted when the Up-To is deleted, when a moderator removes it, or when you delete your account. A photo you only use to read a draft, and do not post, is still not stored. Posted photos are kept in a private store at Supabase and reach the app only through links that stop working after an hour. While a post is hidden, after reports or by a moderator, its photos are shown to no student, and our team can see them to review the post; a removed post's photos are deleted once it has stayed hidden for 30 days, so a post restored by mistake gets them back.

Drops. If Drops are on at your campus, a Drop is separate from an Up-To: one line about something happening now, at an exact spot anywhere on the map, on campus or off it, visible only to verified SCU students. We keep its category, text, latitude and longitude, the account that posted it, when it was made and when it ends. We also keep each student's Still there or All gone vote, reports and their chosen reasons, Drop-only blocks, which version of the Drop rules a poster accepted, and any temporary or permanent posting restriction. Other students never receive the poster's identity; they see the text, exact spot, age, vote totals and whether the Drop is theirs. Anyone who can see a Drop can also send its text, the name of the nearest building and how long it has left to anyone else, including people outside SCU, through the iPhone's share sheet. What they send says nothing about who posted it. It carries a link that opens the Drop in Up-To only for a verified SCU student while it is live; anyone else who opens the link sees a page about Up-To, not the Drop.

What you do. Whether you said you are going, interested or not going to an Up-To or a campus event, and when you said it. In lists of who is going, people appear as “A student” unless they chose to show their name (see "Posting anonymously, and who sees your name"), guests as “A guest”, and the counts are true counts. The RSVP name flag no longer changes what others see. Your residence hall, class year and interests if you choose to set them, and when you last changed your hall or class year. If you report how busy the gym is, what is on a court, or how many courts are free, we receive what you picked. Reporting needs an Up-To account, verified or not, so we keep what you picked, when, and which account it came from, for 90 days, so the gym's level and that day's chart survive our server restarting; then we delete the report. A daily count of each answer (a number, with no account on it) is kept indefinitely, and it is what lets the chart go on showing when the gym is usually busy after the reports behind it are gone. Other students see only the combined result, never who reported what; nobody but you sees your own reports, and no screen in the app shows them back to you. Deleting your account takes your account off the reports it made and leaves the daily counts. The fifteen-minute wait before you can report again is counted against your account now, rather than against a code your phone made up.

Cards you swipe on Home. When you swipe one of the event cards on Home, either way, we keep which event it was and when, linked to your account, so the app never shows you that card again, on this phone or another one. The app also remembers them on your phone, so this works without a connection; if you swipe before signing in, what it remembered is added to your account when you sign in. Nobody else sees it, and it changes nothing else about what the app shows you. We delete it a day after the event is over, or 30 days after you swiped if we no longer list the event.

Your Campus Cred. Campus Cred has been retired. The app no longer shows Cred or awards it, sends us nothing for it, and deletes the copy your phone kept. What we already hold stays linked to your account until we delete it: for each award, what it was for (a post, a pin you dropped, a saved or explored event, a day you cleared your event deck, a pin you settled, a check-in at an event) with the event, post or Drop it was for, its points and when, and a single total for the Cred your phone held before it began sending each award. Where you were when you checked in was never sent. Until we switch it off, our server still adds a row when you post an Up-To, make a Drop or settle a pin, and a copy of the app from before this change can still send Cred until you update it. The current app shows your Cred to nobody, you included.

Saved events and clubs. The events you bookmark and the clubs you pick are kept on your account, so they come back when you sign in again or on another phone. You need to be signed in to save an event or pick a club. The app also keeps a copy on your phone and sends your changes to your account whenever it has a connection; signing out removes that copy from the phone, not from your account. Nobody else sees your lists. Discover uses how many verified students saved an event to rank what is popular, and never says who. A club's page shows how many verified students follow it, and never who.

Searches in Discover. This version of the app does not send what you search for in Discover to us. Your recent searches are kept only on your phone, and what is trending is worked out on your phone. Test versions of the app sent each search to our server, without your account, your internet address or any identifier we keep; if one of them sent yours, we keep the search term, the campus, when it was searched and a code that changes every day, and delete each search 30 days after it was made.

Kept only on your phone. Your recent searches in Discover, the campus places you recently shared in a chat, whether you want events added, which calendar is connected, and which entries Up-To added (with each one's title, time and place) are saved on your phone and never sent to us. They are gone if you delete the app or change phones. An event or Drop draft is kept only on this device until you submit or discard it. If you connect Google Calendar through Google's own sign-in, that sign-in and the Google account's email address are kept in your phone's Keychain and never sent to us. Your private calendar link is the exception: it is made by our server (see "Google Calendar, if you connect it").

In the older screens: the friend lists you make; messages, photos, videos, voice notes and reactions you send in chat, which reach the same chats as the current app's (see "Chat"); and the polls on an Up-To you make and answer. Squads are gone: a squad you were in is now a group chat, and the older screens can no longer make one. Files are stored with Amazon Web Services. Deleting a message hides it from everyone, but we keep the stored copy.

Feedback you post. It appears on a board every signed-in student can read and vote on, without your name, and a copy is emailed to the Up-To team with your name, email address, phone number if you have one, and account id. A Drop report keeps the fixed reason you pick but has no free-text note. A Drop block hides that anonymous poster's Drops for you without adding them to the app-wide named account block list. Reports and blocks made in the older screens are kept with the reason and any note you wrote.

Reports, blocks and the Community rules. When you report an Up-To, a Drop, a feedback post or a chat message, we keep the reason you pick and which account reported it. When you block someone from an Up-To or a chat, we keep a record of the block so our team can see it; we do not tell the person you block. Before you first post an Up-To, make a Drop, post feedback or send a chat message, you agree to the Community rules, and we keep which version you agreed to and when.

Your device push token, if you turn notifications on, so we can send them. With it the app sends an identifier for this phone that Apple gives each app (it is the same for Up-To on this phone until you delete the app, and is not the advertising identifier), the app's version and that it is the iPhone app; we keep them with the token, along with when it was last used and whether the last notification sent to it worked. The app sends the same phone identifier when you sign out, so we can stop notifications to this phone. We delete the token when you sign out, when you ask to delete your account, or when Apple or Google tell us it no longer works. We also keep a history of the alerts we create for you (that someone is going to your Up-To, for example), whether or not your phone shows them.

Contacts, only if you use contact matching in the older screens; the current app never asks for them. Each phone number and email address in the contacts you share is turned into a SHA-256 hash on your phone, and only those hashes are sent and stored; the server no longer returns contact matches, so matching finds nobody. A hash is not unbreakable: phone numbers are short and predictable, so someone holding these hashes could recover many of the numbers by trying every possible one. We keep a hash of each account's school email address and phone number, if it has one, for verification and matching requests. User search also returns nobody.

People without an account. Anyone who has a live Up-To's link can say they are going from its web page by giving a name and an email address or phone number. We keep those details with the Up-To, but show “A guest” to everyone, including the host.

How you use the app. Which screens you open and which actions you take (opening an event, creating an Up-To, reporting or blocking a Drop, taking down your own Drop, saying you are going to something, getting through sign-up) and when the app is installed, opened and sent to the background. Each is recorded as an event name and a few details: labels written into the app, such as which sign-in method you used or why a sign-in failed; yes-or-no answers, such as whether a post had a location; and counts, such as how many characters a chat message had. None of it is text you typed. These Drop analytics records only the fixed action and, for a report, the fixed reason, never the Drop's text, id or coordinates. In chat they record that a poll was made or answered (never the question or which answer), that a location was shared and whether it was a campus place or your current spot (never which place or where), and that a message was scheduled, sent later or cancelled. For a post that is happening now they record that someone said "Still here" or "It's over", or that the host added time or ended it. These events are not anonymous: they are linked to your account by an identifier we send with them, which is not your name, your username or your email.

We also keep simple counts of our own for each account, such as how many Up-Tos you have posted and people you have invited, and the last day you used the app.

Crash reports. This version of the app sends no crash reports. It has no crash reporter, and the error reporting in our analytics software is turned off. If a later version adds one, we will update this policy before it ships.

Technical logs. Our servers log the requests the app makes, so we can run and repair the service. When you post, the log records which account posted, along with the post's text, time, place name and pin. Those logs are kept by our hosting provider, and deleting a post or your account does not clear them.

3 Your location, and the pin on your posts

This is the part people most want a straight answer on, so here it is.

Up-To asks for location only while the app is open. Never in the background, never overnight.

Most of what the app does with your position happens on your phone and goes nowhere: the map's blue dot, and sorting what is nearest by walking time. It takes a fresh reading when you open the Map tab or the post screen, open the post screen's place picker, open a chat's Location sheet, or tap a map's locate button.

When you post an Up-To, a place and a pin go with it, and unless you choose otherwise they are where you are. Opening the post screen takes a reading and sends it to Apple's map service, which returns the nearest named place, such as "Benson Memorial Center", even if you then decide not to post. The post is pinned to that reading: its latitude and longitude, precise to within about 100 metres and often closer, which is usually enough to tell which building you are in, or only roughly if you have turned off Precise Location for Up-To in iOS Settings.

You can choose the place yourself instead. The post screen's place picker lets you search for a campus building or an address, or move the map under its pin or tap a spot, and the post is then pinned where you chose rather than where you are. The same picker is on a post you are editing, so you can move its pin until it expires; if you do not choose a new place, the pin stays where it was. To name that spot, the app looks it up on your phone and then with Apple's map service; a spot nothing can name is called "Dropped pin". You cannot post without a place. The pin is what tells people where something is happening.

Start from a photo can suggest the place too. If a photo you pick has the place it was taken saved in it, as iPhone photos taken with Location Services on usually do, the app reads that location on your phone and, when it is on campus, suggests the nearest campus building as the post's place. The post screen says the place came from your photo, and you can change it before you post. The saved location is removed from the photo before it is sent anywhere, and it only reaches us as the post's place and pin, if you post with that place. Reading it needs no extra permission: you only give the app the photos you pick.

We store the pin and the place name with the post, linked to your account, even though other students are not shown who posted it. We keep them until you delete the post or your account is deleted; an Up-To expiring does not remove them.

The pin is shown to you and to the people the post is sent to, on their map, and to nobody else. The post's public link page shows the place name but never the pin, and the pin is not in calendars or notifications. Your location is never shown on your profile or to clubs, and Up-To never shares where you are live: only the spot each post or Drop is pinned to, and a spot you choose to send in a chat.

When the pin is where you were, which it is unless you move it, it can narrow down who posted an Up-To. A post pinned to your residence hall late at night can identify its author even though no name is shown.

A Drop works differently from an Up-To. You place it on the Map: the pin starts at your foreground location and you can drag the map to move it, and the app sends the exact latitude and longitude of the spot you pinned to our server. Every verified SCU student who can use Drops can see that spot until the Drop ends; it is not limited to invitees, and no web page shows it. A Drop can go anywhere, on campus or off it, which takes in the streets and apartment blocks around campus and wherever else you are. If you leave the pin where it starts, that spot is where you were standing when you posted, and from where you live, that is your address, shown to every verified SCU student until the Drop ends.

Sharing a location in a chat. In a chat, Location lets you send a campus place, a place you find through Apple's map search, or where you are now. A campus place or a place from search is sent as that place's name and its latitude and longitude, and says nothing about where you are. To send where you are, you tap Share my current location, the app shows the spot on a map, and only when you tap Send does it go: once, as one point that never updates as you move. Our server stores the place's name and its latitude and longitude, to six decimal places (about ten centimetres), with the message, linked to your account like any message, and the people in that chat can see it on a map and open it in a maps app. The notification for it says "Shared a location", never the spot. A location message cannot be edited. It is kept, and deleted, like any other chat message (see "Chat" and "How long we keep it").

You can say no. You can still browse everything, say you are going to things, use the map, post and send a campus place in a chat, but you lose walking times, each Up-To you post needs a place you choose on the map yourself, you cannot make a Drop, and you cannot share your current location in a chat. You can change your answer at any time in iOS Settings.

4 Posting anonymously, and who sees your name

Every Up-To you post is anonymous to other students: they see “A student” where the poster's name would be, and the public share page says “Someone”. You still see your own name on your screens.

If you have a posting badge (for example “CF · Swig Hall” or “Chess Club · President”), you can choose on each post to show the badge. The composer says “Showing your badge: …” and explains: “Everyone who sees this post sees this badge, never your name. You can’t hide it later.” The current composer keeps its badge choice while editing, but the server allows a later edit to switch the badge off. Anyone who saw it before may remember it. A club post shows the club name, not your name.

The server removes other identifying details from what it sends to other students about a post, including the account id, username and avatar. Push notifications say “Someone”; plan update or cancellation notifications say “The host”. A share page says “Someone”, or the club name for a club post. The server still keeps which account made each post so we can handle reports and legal requests.

These promises also apply to copies of the app from before the redesign: an older screen can still set a name flag on a post, but the server strips your name from what it sends to other students, and post share pages say “Someone” or the club name. Search returns nobody and contact matching finds nobody. This covers posts made before this rule too: the name is removed whenever a post is sent, not when it was made.

Anonymity hides the account behind a post from other students, not from us. We can still tell which account made it, and look only when there is a report or legal obligation. It hides who posted, not what the post says or where it was made. A shared link and its messaging preview show the post's category, time and place name, and a preview can stay in someone's messages after you edit or delete the post.

Drops are anonymous under a separate, stricter read path. No student, including the poster, receives the poster's account id, name, username, email or avatar. Up-To still keeps the account behind each Drop so reports, limits and posting restrictions can work.

Outside posts and Drops, your name shows. Since 13 October 2026, other signed-in people see your first name and last initial, such as “Maya T.” for Maya Torres: in chats you are in (on your messages, in the member list, when you are typing, in who reacted and who answered a poll), in a new-message, reaction or friend-request notification, on your profile, in Friends, and in Start Chat's suggestions and, unless you leave it, its list of everyone on Up-To. They never see your full name, your username or your email address. You stay “A student” to anyone you have blocked or who has blocked you, and in an Up-To's own chat when you are its host; a deleted account, or one waiting to be deleted, appears as “Deleted User”. Each person is also marked “Verified SCU student” or “Not verified”. Your profile photo shows only in chat, and only if you say yes (see "Chat").

Who is going. Lists of who is going to a campus event or an Up-To, and the friends shown as going to one, show you as “A student”, without your online status, unless you turn on Settings > Show my name when I’m going. The first time you tap Going, the app asks, and staying anonymous is the default. Either way you are counted. An answer you gave to an Up-To without showing your name stays anonymous whatever the setting says.

Everyone on Up-To. Start Chat lists every account that is signed up, verified or not, except people blocked either way and accounts being deleted, most recently active first. Each row shows the person's first name and last initial, whether they are a verified SCU student, and how recently they were on Up-To: “Active now”, “Active today”, “Active this week”, or nothing if it was longer ago, never an exact time. There is no search by name. You can leave this list by turning off Settings > Show me in Everyone on Up-To, which is on until you turn it off. With it off, nobody sees you in the list, and nothing else changes: people you already share a chat with can still see you there and message you, your friends still see you in Friends, and Start Chat's suggestions, which only name people you share an event, a friendship or a chat with, work as before. Blocking someone also takes each of you off the other's list. If you are a verified SCU student, tapping a person opens their profile, which shows their first name and last initial, their initials, that they are verified, whether you are friends, and buttons to add them as a friend or message them. It does not show their photo, class year, hall or interests.

5 Chat

Anyone signed in to Up-To can message anyone else who is, one to one or in a group of up to 50 people, whether or not either of you is a verified SCU student. Each campus event also has one group chat, open only to people who said they are going; if you stop going, you leave it. Group chats replace squads: a squad you were in stays in your chat list as a group chat. Next to each person's name, the app marks them a “Verified SCU student” or “Not verified”, and keeps a warning at the top of a chat that has someone in it who is not verified.

Your profile photo in chat. If you have a profile photo, the first time you send a chat message the app asks whether to show it to the people you talk to; if you add a photo after you have already chatted, it asks then. Your answer is stored on your account, and you can change it at any time in Settings > Show my photo in chats. If you say yes, the people in your chats see your photo next to your messages, in a chat's details and on a direct message, beside your name. If you say no, or never answer, they see the same plain avatar as everyone else's. Your photo is never shown to people you have not chatted with: not in chat suggestions or the list of everyone on Up-To, not on your profile or in Friends, not on the list of people going to an event, not on your posts, not in notifications. You always see your own photo.

What we keep. Every message you send, with when it was sent, the chat it is in and the account that sent it, is stored on our servers, linked to your account, so the people in that chat can read it on any phone. You can send photos from your camera or your library; the app removes their location and camera details on your phone before sending them. A chat photo is stored privately with Supabase. The app shows it through a link that stops working after an hour, and asks our server for a fresh one while you are in the chat, so a link copied out of the chat stops working within the hour. The people in the chat can still save a copy of a photo they have seen. We also keep which chats you are in and when you last read each one. Messages and photos are not deleted on a schedule. Leaving a chat takes you out of it; what you sent stays for the others.

Editing, unsending and deleting. Within 15 minutes of sending a text message you can edit it, up to 5 times. It then shows “Edited”, everyone in the chat can see its earlier versions, and we keep every version for as long as we keep the message. Within 2 minutes of sending a message you can take it back with Undo Send: everyone else in the chat then sees, where it was, the name the chat shows them for you, such as “Maya O. unsent a message.”, or “A student unsent a message.” if you appear to them as “A student” or your account has been deleted (you see “You unsent a message.”), and a reply that quoted it no longer shows its words. We keep an unsent message's text, its earlier versions and its photo, GIF or link preview for 30 days, so a report about it can still be reviewed, then delete them, unless the message was reported. Delete for me takes a message off your own screen, and Delete conversation clears a chat's messages so far for you alone; nobody else is told, and the messages stay for the others. When our team removes a message, everyone in the chat sees “Message deleted”; we keep its text, and keep its photo for 30 days so the report about it can still be reviewed, then delete the photo.

Reactions. You can react to a message with one emoji: one of the six tapbacks (❤️ 👍 👎 😂 ‼️ ❓), or any other single emoji from your keyboard. You have one reaction on a message at a time; picking another replaces it. Everyone in the chat sees how many of each a message has, and the list of who reacted shows each person's first name and last initial (“A student” across a block). When someone reacts to your message, your phone may be told who reacted, by first name and last initial, with the emoji they picked, but never the words of your message; there is no such notification in an event's chat.

GIFs. You can send GIFs from GIPHY (the picker says “Powered by GIPHY”). Our server asks GIPHY for the GIFs you browse and search for without saying who you are, and does not record what you search for. A GIF is sent by GIPHY's number for it, which our server checks with GIPHY, and each phone that shows the GIF loads it from GIPHY, which sees that phone's internet address.

Link previews. When you type a link into a message, your phone visits the page, before you send it, to show the page's title and picture above what you are typing, so the page's owner sees your internet address, as when you open any page. Your phone makes no preview for a link to a bare internet address, a device on a local network or an unusual port. If you send the message with its preview, your phone uploads the preview's picture to our server, which stores it privately with Supabase; a picture that is never sent is deleted after 24 hours. The people you send it to see the preview your phone made: neither they nor our server visit the link to make it.

Notifications. A notification for a new text message carries its text, and the sender's first name and last initial, to your phone. Editing a message sends no new notification, and a notification already on someone's phone keeps the words it arrived with; when a message is unsent or removed, our server asks the phones it notified to take that notification down. A chat you mute sends you none until the time you chose, and an event's chat sends none at all. A notification that someone added you to a group chat says “Someone”, and names the group only if its name does not name anyone in it.

Who can see that you are around. Anyone signed in can see, in Start Chat's list of everyone on Up-To, how recently you were on Up-To, unless you have left that list (see above). People who share a direct message or a group with you see the same: “Active now” while you are online, “Active today” if you were on Up-To earlier that day (the day in Santa Clara), “Active this week” if it was within the last seven days, and nothing after that. Nobody is shown the time you were last on Up-To. If you turned on Show my name when I’m going, people going to a campus event you are going to can see the same when they look at who else is going, and the app may suggest you to them to chat with, saying which event you share; no one is told the moment you come online in an event's chat. People in a chat with you can see when you are typing, except in an event's chat. In a direct message, the other person sees “Delivered” under their message once your app has received it, which our server decides. They see that you have read it, and when, only while you send read receipts: Settings > Send read receipts is off until you turn it on, and a direct message's Chat info can turn it on or off for that one chat. Turning read receipts on never shows a message you read while they were off. Group chats and event chats show neither Delivered nor read. In a direct message, the chat's details show the upcoming events you are both going to. In a direct message with someone you have blocked, or who has blocked you, neither of you sees whether the other is online, or whether a message was delivered or read.

Your settings. Mute, Archive, Pin and Mark as Unread belong to you alone: muting a chat stops its notifications for as long as you choose, archiving moves it out of your list until someone writes in it again, pinning keeps it at the top of your list, and marking it unread puts its dot back until you open it. Pins and marks follow you to every phone you use. Nobody else in the chat is told.

Message requests. When someone who is not your friend starts a direct message with you, or adds you to a group, it arrives under Message requests, with no notification. Until you answer, they can send you one message there. Replying accepts: in a direct message it also makes you friends. Delete removes it from your list (and takes you out of the group) without telling them, and for 30 days after you delete a direct message request, they cannot send you a friend request. We keep a record of each request: the chat, who sent it, who it was for, and when it was made, accepted or deleted.

Polls. In a direct message or a group (never in an event's chat or an Up-To's chat) you can ask a poll with two to six answers, including a "When works?" poll whose answers are times. We keep the question, the answers, who asked it, whether it has ended, and each answer each person picked, with their account and when. Everyone in the chat sees the counts, and can open who picked what, shown by first name and last initial. The poll's question shows in the chat list and in its notification. Unsending a poll hides it from everyone; as with any unsent message, we keep the poll, its answers and who picked which for 30 days, then delete them, unless the message was reported.

Send Later. You can schedule a text message to send between one minute and 14 days ahead (up to 50 waiting at a time). We keep it on our server, with the chat and the time you chose, until it is sent, and only you can see it before then. You can send it now, change the time or delete it. When it is sent it becomes an ordinary message and the scheduled copy is deleted; a deleted one is deleted at once. If it cannot be sent (because you left the chat or blocked someone, for example), it shows "Couldn't send" and we delete it 14 days later.

Group photos. The person who made a group can give it a photo, which everyone in the group sees. We store it privately with Supabase, with which account set it, until it is changed or removed.

Reporting. Report a message and pick a reason, and add a note if you want. We keep the report, as "What we collect" says, with a copy of the message as you saw it and every earlier version of it, so a later edit or Undo Send does not change what our team reviews, and email our team a link to it. Our team reviews chat reports in our moderation dashboard, which shows them the message and its photo, up to five earlier messages from the same chat for context, the sender's account and whether the sender is a verified SCU student, and the reasons, notes and reporting accounts. They can dismiss a report, which leaves the message where it is, or remove the message, which shows “Message deleted” to everyone in the chat; either way the message and the report stay on record. A report does not hide the message from the others in the chat. A report you made stays after you delete your account, without your account on it.

Blocking. Blocking someone from a chat stops direct messages between you, both ways, and takes each of you off the other's suggestions and the lists of people going to events. In a group or an event's chat you are both in, you stop seeing their messages and photo, and see “Message from someone you blocked” instead. It does not take either of you out of that chat, and they can still see what you send there; leaving it is how to stop that. We do not tell the person you block, but they will find they cannot message you. Settings > Blocked people lists everyone you have blocked in chat, as “A student”, and lets you unblock each one; Settings > Unblock all undoes every block you have made. Unblocking does not put anyone back into a group or tell them.

Before you send your first message, the app asks you to agree to the Community rules. An automatic filter screens text messages for slurs, and a message it catches is not sent.

6 Friends

Friends are for verified SCU students. From someone's profile you can send them a friend request; they get a notification and a row in Notifications, and can accept or decline. A request is kept until it is accepted, declined or cancelled, and a friendship until either of you removes it. Cancelling, declining and removing delete it. The person who sent a request is not told it was declined; for 30 days after a decline we keep a record of it, and a new request from them is refused with "Try again later". You can send at most 20 requests an hour.

You choose who can send you friend requests, in Settings: everyone, people you have chatted with in a direct message or a group (the default), or no one. We keep your choice. Being friends changes nothing about how your name shows. Your Friends list and requests show each person's first name and last initial and initials, never a photo. On an event, Friends going shows how many of your friends are going, and names only those who turned on Show my name when I’m going.

The notifications for a request and for an accepted request name the other person by first name and last initial, or "Someone" across a block. The notification on the phone carries that name, but the copy we store for the Notifications screen does not: it says "Someone wants to be your friend on Up-To." or "Someone accepted your friend request." When you open the Notifications screen, the app looks the person up again and shows their first name and last initial and initials, while the request or friendship still exists. It shows "Someone" if either of you has blocked the other, if their account is deleted or waiting to be deleted, or if the request was withdrawn or declined or you are no longer friends.

7 Up-To's older screens

Up-To is partway through a redesign. The app you use today has no calendar sharing or contact matching, and its polls are the chat polls described under "Chat", not the polls on an Up-To in the older screens. Its chat is the one described under "Chat", and it holds the same chats as the older screens. Its friends are the ones described under "Friends". You can report someone else's Up-To, or block the person who posted it, from the post itself. Drops have their own report and Drop-only block controls. The calendar feature it has is adding the events you are going to to your phone's calendar or to Google Calendar, if you turn that on (see "Who we share it with" and "Google Calendar, if you connect it"). Copies of the app from before the redesign still have those features, and this policy covers what they collect.

Older screens may still store legacy name and RSVP flags, but those flags do not change what the server sends to other students: it never sends a full name or a username, and it names a post's host only as “Someone”, or “The host” for a plan update or cancellation. Search returns nobody and contact matching finds nobody. If an older post cannot name a place you picked on its map, its coordinates become the place name, which the post's link page shows. A calendar share can still show an Up-To's title, time and invite list to people who were not invited, but the other people on that list appear as “A student”.

8 Campus information

Dining hours come from Santa Clara University's dining website, which its food-service provider runs. Gym hours come from SCU Campus Recreation, athletics fixtures from SCU Athletics' public calendar, and the club list and term dates from scu.edu. Most campus events come from the university's public events calendar, as the university publishes it. The rest come from announcement emails received by an SCU inbox our team reads: university mailing lists, club newsletters and campus services. Software, which can include Google's Gemini AI service, pulls the event details out of those emails, and a listing can show the name of the person or group that sent the announcement. None of this is information about you.

Some things in the app are reported by students rather than measured: how busy the gym is, for example. When a figure comes from student reports, the app says so, with how many reports it is based on and how recent they are. Where a source gives us nothing, the app shows no number: "Nobody has said yet" rather than a guess. One exception today: the Wednesday food-truck hours on the Dining screen were supplied by our team and have not been confirmed with the university.

9 Who we share it with

We do not sell your personal information, and we do not share it for advertising.

We use these providers to run the service, and each receives what its job needs. Render runs our servers and Supabase holds our database, the photos posted with Up-Tos, the photos sent in chat and profile photos. Resend delivers the emails we send, such as sign-in codes and copies of feedback to our team. Google Firebase Cloud Messaging and Apple's push notification service carry each notification, including its text, to your phone. PostHog receives product analytics and the internet address they are sent from. Amazon Web Services stores photos and voice notes sent in the older screens, and delivers any text-message codes they send.

Apple's map service receives your position each time you open the post screen, to name the place, and whatever you type into map search, the post screen's place search or a chat's Location search, along with the point the map is centred on, which is your own position if you have centred the map on yourself. When you choose a post's place on the map, it also receives the spot you chose, to name it. Apple's map service also draws the map itself, the small map on a location in a chat, and its satellite imagery if you switch to it: like any online map, it sees your internet address and which part of the map is on your screen. The app's typefaces come with the app; it downloads none.

Start from a photo. If you choose it on the post screen, the photos you pick (up to four at a time, read together as one draft) are sent to our server and on to Google's Gemini service, which reads the text on them and describes what is happening in them, so the app can fill in a draft for you. Their saved location and camera details are removed on your phone before they are sent. It is told not to say who anyone in a photo is. Reading the photo stores nothing on our side: we do not log it or what Gemini reads from it. A photo you then post with your Up-To is kept with it, as "What we collect" describes. Google handles the photos under its own terms for Gemini, and under those terms Google may keep them and what Gemini reads from them, use them to improve its services, and have people at Google review them. So do not use a photo with anything private in it. Nothing is posted until you check the draft and post it yourself.

Your calendar, only if you turn it on. In Settings > Calendar, you can connect Apple Calendar or Google Calendar. The first time you tap Add to calendar or say you are going to an event, if you chose to have events added and nothing is connected, the app asks which one to use. With Apple Calendar, iOS asks you for access, and each event is added to the calendar your iPhone uses for new events — its title, time, place and a note that Up-To added it — and taken off again if you stop going. The app changes only the entries it added, and keeps its list of them on your phone. None of it passes through our servers; if your iPhone's default calendar belongs to an account such as iCloud or Google, that account syncs the entry. You can change whether events are added, and which calendar is connected or disconnect it, in Settings > Calendar. The connection choice, your answer and that list belong to this phone rather than to your account: signing out leaves an Apple Calendar connection and your answer in place, so an entry still comes off if you stop going after signing back in. Google Calendar works differently (see "Google Calendar, if you connect it").

What PostHog receives is usage events, not content: which screens are opened and which actions are taken, with the details described under "What we collect", and the basic device and app details its software adds, such as phone model and app version. Never your posts, your messages, your contacts or your position. The only location-related things it gets are yes-or-no: whether a post had a location, and whether you allowed location. PostHog also receives the internet address your phone connects from with these events, and may use it to estimate roughly what city you are in. You can turn it off in Settings > Share usage data: this phone stops sending it from that moment, it stays off the next time you open the app, and nothing about the app changes when you do.

One thing about those counts, stated plainly: they are linked to your account. When you sign in, and each time the app opens with you signed in, we give PostHog your account identifier (not your name, your username or your email) so that we can see how a student gets through the app rather than only how often a screen is opened. The identifier is what lets us tell one student's counts from another's.

Our own counts. Separately from the app's analytics, our team sees totals worked out from the records our server already keeps to run Up-To: how many accounts are created and verified, and how many Up-Tos, Drops, club posts, RSVPs (including Going), saved events, club follows, reports, feedback posts and Discover searches there are each day, and which campus events have the most people going and which clubs have the most followers. These totals include every account, whether or not Share usage data is on, because they come from our own records rather than from the app's analytics. They are only ever totals, never broken down per person. Our team also sees how many accounts gave each residence hall and each class year, and how many verified students graduate in each year. In any of those breakdowns, a group of fewer than 5 people is merged with the other small groups, and a merged group that is still fewer than 5 is shown only as "fewer than 5", so no one can be identified from them.

That switch covers PostHog only; it does not change our own counts above. It belongs to this phone rather than to your account: signing out, or being signed out, leaves it where it was, and so does signing back in.

We may disclose information if the law requires it, or where we genuinely believe it is necessary to prevent serious harm.

10 Google Calendar, if you connect it

Connecting Google Calendar is optional, and none of this happens unless you choose it. When Up-To asks whether to add the events you are going to to your calendar, or later in Settings, under Calendar, you can choose Google Calendar instead of Apple Calendar. In the App Store version of the app today, that gives Google Calendar a private calendar link; test versions of the app, and the App Store version once we turn it on, connect through Google's own sign-in instead (below).

Your private calendar link. Our server makes a link to a calendar of what you are going to, and the app opens Google Calendar so you can add it. Google Calendar then fetches that link from our server every few hours. The calendar holds the campus events you said you are going to and, while you are a verified SCU student, the Up-Tos you host or are going to: for each, its title, its time, its place name and a link to it in Up-To. Never its description, its host, who else is going or its pin. Whoever has the link can read that calendar, so treat it like a password. We store only a scrambled form of the link (a SHA-256 hash), with your account, when it was made and when it was last fetched. More > Reset link makes a new one and stops the old one working at once. Google keeps what it fetched under its own terms. The link is deleted when your account is deleted.

Add to Google Calendar. On an event's page, Add to Google Calendar opens Google Calendar with the event filled in for you to save. Up-To cannot change or remove that copy later, and nothing about it comes back to us.

Through a Google account on your iPhone. A phone that connected Google Calendar this way in an earlier version keeps that connection. There Up-To writes to the calendar of a Google account you added in iPhone Settings, through iOS, the same way it works with Apple Calendar: it adds, changes and removes only its own entries (the event's title, time, place and a note that Up-To added it), it does not sign in to Google, and none of it passes through our servers. Disconnect it in Settings, under Calendar.

Google's own sign-in. Test versions of the app, and the App Store version once we turn it on, connect Google Calendar through Google's own sign-in. A phone that connected it this way keeps that connection until it is disconnected, and the rest of this section describes it. There, Google asks you to sign in with the Google account you choose and to give Up-To permission to "see, create, change, and delete events on Google calendars you own". That is how Google words the one calendar permission Up-To asks for (calendar.events.owned); Up-To uses it only to add, change and remove its own entries in your main calendar.

What Up-To does with that connection. For each event you add, say you are going to, or post, if you chose to have those added, the app creates an entry in that Google account's main calendar: the event's title, time, place, a note that Up-To added it, and a hidden tag with Up-To's own id for the event, so the app can find its entry again. It updates that entry if the event's time or place changes, and deletes it if you stop going or take it off. It changes and deletes only entries it created. It does not read, list, copy or change any other event or calendar in your account, with one exception: when you connect, the app makes a single request to check that Google gave the permission, and Google may answer it with one event from that calendar. The app looks only at whether the request worked and keeps nothing else from the answer. Signing in also tells the app your Google account's name, email address and profile picture; the app keeps only the email address, to show you which account is connected.

Where that connection is kept, and who sees it. All of this happens directly between your phone and Google. None of it passes through Up-To's servers, and we never receive your calendar, your entries or your Google sign-in. The sign-in that lets the app add to your calendar (the tokens Google issues) and the connected account's email address are kept in your iPhone's Keychain, and the app's list of which entries it created is kept in the app's storage on your phone. We do not sell anything from your Google account, use it for advertising, use it to train AI or machine-learning models, or share it with anyone. Nobody at Up-To can read it, and the app's usage analytics never include your calendar, your entries or your Google account.

How long that connection lasts, and how to stop it. It lasts until you end it. Disconnect at any time in Settings, under Calendar: the app withdraws Up-To's access to your Google account, signs out of Google, deletes the saved sign-in and the account's email address from your phone, and stops adding to your calendar. If your phone is offline at that moment, Google keeps listing Up-To's access until you remove it there. You can remove it yourself at any time at myaccount.google.com/permissions, which stops the app adding anything from that moment. Signing out of Up-To also stops it on that phone until you connect again. Entries Up-To already created stay in your Google Calendar until you delete them there. Because none of this reaches our servers, there is nothing of it for us to delete when you delete your Up-To account.

Up-To's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).

Copies of the app from before the redesign also offer a Google Calendar connection and do more with it: there the app adds each Up-To you create that has a start time to your main calendar, updates or removes it when you do, and reads that calendar's events for the week you are viewing to show them beside your Up-Tos. That too happens only between your phone and Google, never through our servers, and the same limits apply to it.

11 How long we keep it

Up-Tos have an expiry, not a deletion date. When one expires it leaves everyone's feed and the map, it can no longer be joined or edited, and its link says it has expired, but it is not deleted. We keep it, with its RSVPs and its pin, until you delete it or your account is deleted. It stays in your past posts, and the people it was sent to can still open it.

A Drop leaves the Map within an hour. If nobody reported it and a moderator did not remove it, we delete it 30 days after it ended. We keep a reported or moderator-removed Drop, with its votes and reports, for up to 183 days after it ended, then delete it. We also keep for up to 183 days an attempted Drop refused for weapon or violence wording, including its text, category, spot, account and time, so the safety alert has a record behind it.

Chat messages and photos are not deleted on a schedule. An unsent message's text, earlier versions, photo, GIF and link preview, and an unsent poll with its answers, are deleted 30 days after it was unsent, unless it was reported. A photo in a message our team removed is deleted 30 days later. A link preview's picture that was never sent is deleted after 24 hours. Chat reports, with the copy of the message kept for each, are kept.

A scheduled message is deleted as soon as it is sent or you delete it, and 14 days after it fails to send. A message request record, a poll that was not unsent and its answers, and a "Still here" or "It's over" answer are not deleted on a schedule: a "Still here" or "It's over" answer goes when its post is deleted. A record of a declined friend request is what stops a new request for 30 days.

Searches in Discover sent by test versions of the app are deleted 30 days after they were made. They are not linked to your account, so deleting your account does not delete them sooner.

Your account lasts until you delete it. When you ask us to delete it, the deletion is scheduled for 30 days later, you are signed out everywhere, and we stop sending notifications to your phones and delete their push tokens, with the phone identifiers and app versions kept beside them; signing back in during those 30 days cancels it.

After the 30 days, we delete your Up-Tos (every date of a repeating one, and the record of the series) with their chats, RSVPs, photos and "Still here" and "It's over" answers, your private calendar link, any photo you uploaded for a post you never made, your RSVPs to Up-Tos and campus events, your "Still here" and "It's over" answers and poll answers on other people's Up-Tos, friends, friend requests and friend lists, your choice of who can send you friend requests, the records of declined friend requests to or from you, your uploaded contact hashes, your answers about showing your name when you are going and showing you in Everyone on Up-To, your posting badges and club officer roles and requests, feedback, notifications, blocks, reports, sign-in records and our counts for your account. We take you out of every chat you were in, and delete the photos and files you sent in chat and the pictures of your link previews, your reactions, your votes in chat polls, the message requests you sent or received, any message still waiting to be sent later, your pins, Mark as Unread and read-receipt settings, and the records of which messages you had received and read; a group you made passes to the person who has been in it longest. We replace your name, username, email address, phone number and sign-in details with an anonymous placeholder, and clear from it the hashes of your email address and phone number, your hall, class year, interests and gender, any two-factor settings, and any change of email address or phone number you had not finished. Some things stay, without your name: the messages you sent in chats with other people stay there under "Deleted User", with their photos, files and link pictures removed, and a location you shared in one is cut down to the campus place's name, or to "Shared a location" for any other spot, with the spot itself deleted; a poll you asked stays with its message. A message that was reported keeps its location, and keeps its photo or link picture until our team has dealt with the report. Reports on chat messages, whether you made them or they were made about yours, with the copy of the message kept for each, stay, and so do any restriction our team put on your chatting, the record that you removed someone from a group or set a group's photo, and other students' mutes of your posts. We also delete your ordinary Drops, Drop votes, Drop-only blocks you made and Drop-rules agreement, and your Campus Cred. We also delete your saved events, the clubs you picked and which cards you swiped on Home. We also delete your verified scu.edu address, the dates and class year that go with it, and the codes and handovers left over from verifying. Your gym reports are not deleted: we take your account off them, so what was reported stays and who reported it does not.

Deleting an account currently deletes the blocks it made or received and the reports it filed or that were filed against its posts, except reports on chat messages, and deleting a post deletes the reports against it. We do not yet keep a separate safety record for Up-Tos. For Drops, a moderator-removed Drop, reports you filed on other students' Drops, refused weapon or violence attempts, active or recent posting restrictions, and other students' Drop-only blocks of your account can remain for the retention periods above. The account on retained rows points to the anonymised placeholder.

12 What you control

Your posts and Drops never show your name. If you have a posting badge, you can choose per post whether to show the badge. Choose whether lists of who is going show your name, in Settings > Show my name when I’m going; guests always appear as “A guest”. Choose who can send you friend requests, in Settings, under Friends. Choose whether you appear in Start Chat's list of everyone on Up-To, in Settings > Show me in Everyone on Up-To.

Decline location or notifications and keep using the app; without location you choose each post's place on the map yourself. You can change either later in iOS Settings. Asking to delete your account stops notifications to every phone you were signed in on. Signing out stops them on that phone when it can reach us as you sign out. If it cannot, or if the app signed you out itself because your sign-in had already ended, they can keep arriving; to stop them, turn them off for Up-To in iOS Settings.

Turn off usage data, from Settings > Share usage data. That stops the app's analytics; it does not take you out of our own counts, which are only totals.

Turn adding the events you are going to to your calendar on or off, from Settings > Add events you’re going to. Entries already added still come off your calendar if you stop going.

Connect or disconnect Google Calendar, from Settings, under Calendar. If you added your private calendar link, remove it in Google Calendar, and use More > Reset link to stop the old link working. If you connected through Google's own sign-in, you can also take away Up-To's access from your Google account at myaccount.google.com/permissions.

Delete an Up-To you posted, at any time, from its page. That removes it, its RSVPs, its chat, its pin and any photos posted with it. You can edit its text, its time and its place until it expires; choosing a new place moves its pin to the spot you chose.

Report an Up-To or a Drop, or use Block this person to hide that person's posts, from the post itself. Report a feedback post from the board. In chat, accept or delete a message request, change or delete a message scheduled for later, edit a message within 15 minutes or unsend it within 2, delete a message or a whole conversation for yourself, turn read receipts on or off (in Settings, or for one direct message in its Chat info), report a message, or use a chat's details to block or report the person, mute the chat, archive it or leave it. Settings > Blocked people undoes a chat block one person at a time, and Settings > Unblock all undoes all your blocks. For anything else, write to support@up-to.co.

Add, change or remove your profile photo from your profile, and choose whether the people you chat with see it in Settings > Show my photo in chats. Saying no there hides it from them from then on.

Delete your account, from Settings > Delete account. That starts the 30-day deletion described above, and signing back in during those 30 days cancels it. If you cannot get into the app, write to privacy@up-to.co and we will start it for you.

Ask us what we hold about you, or ask us to correct or delete it, by writing to privacy@up-to.co.

13 Security

Email sign-in codes are stored only as hashes, and so are passwords on accounts made in the older version of Up-To. Traffic between the app and our servers is encrypted in transit. Two-factor authentication is available only to accounts that have a password, which means older accounts; for an account made in the current app, the emailed code or your Google sign-in is the check.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects you, we will tell you.

14 Age

Up-To is for university students and is not intended for anyone under 13. If we learn we have collected information from a child under 13, we delete it.

15 Changes, and how to reach us

If we change this policy in a way that materially affects you, we will tell you in the app rather than quietly editing this page.

Questions about privacy: privacy@up-to.co.