Privacy Policy
Effective date: October 20, 2026
By the Quad lets one person (the "sharer") show people of their choosing (the "viewers") which campus building the sharer is in.
What we collect
From the sharer's phone, after the sharer has turned sharing on in the app and while it stays on: location (coordinates, accuracy, time), the buildings entered and left that day, and whether sharing is paused.
From every account: the Sign in with Apple identifier, the name and email address Apple provides, a session token, and the phone's time zone.
From a viewer: whether the viewer turned on the walking alert, and the push-notification token for that phone.
From every phone: how the app is used — each day, how many times the app was opened and how many times each feature was used (for example switching between students, turning the walking alert on or off, pausing). From the sharer's phone, also its location-permission setting (Always, While Using, or off).
How we use it
The location is used to work out which building the sharer is in and when the sharer enters or leaves one, and to show the sharer's accepted viewers a pin at the sharer's latest location, marked as accurate or rough, and the path walked between buildings that day. The path is drawn on the viewer's phone from the locations it was shown and is not stored. The walking alert is sent to viewers who turned it on. The sharer is shown which viewers have the walking alert on. Names are shown to the people you are paired with. The time zone is used to label times and to decide when a day ends. The email address is not used.
The usage counts are used only by us, to understand which parts of the app people use and how often. They are stored under a random number made for each account, not under a name, an email address or the account itself, and they never contain a location, a building, a name, or who is watching whom. They are not shared or sold.
Who receives it
The viewers the sharer has accepted. Our server runs on DigitalOcean (New York) and its database on Supabase (Oregon), with backups in DigitalOcean Spaces (San Francisco); they store the data on our behalf under their own terms.
Diagnostics
The app contains no crash-reporting code and no third-party analytics code. If you let iOS share diagnostics with developers, or install through TestFlight, Apple may send us a crash report containing a stack trace, the device model and the OS version.
The campus quiz on our website
The campus quiz at bythequad.com/play needs no account and sets no cookie. The first time you finish a round, your browser makes a random code and keeps it in its own storage on your device. It is sent with each round you finish, so that each browser counts once, by its latest round, when we compare scores. The code is not your name, email address, IP address or device identifier, and clearing your browser's data for our site removes it. When you finish a round, we keep which quiz it was, the score, how long it took, when it finished, and that random code; and, kept apart from the round and the code, whether each answer was right or wrong. Nothing else about you is kept: no name, no email address, no IP address, and no device identifier. We use it to show how a score compares with other players' and to learn which questions are hard. If you tell us a question is wrong, we keep which question, which of the two reasons you picked, and the day, so we can fix it. All of it is kept with no end date.
How long we keep it
The latest location, until the next one replaces it. The day's buildings, until the day ends. Account data, until the account is deleted. Usage counts are kept after that, but once the account is deleted nothing connects them to it. Backups of the database, 14 days.
Deleting your data
Remove a viewer, stop sharing, or delete your account from inside the app, or write to the address below.
Children
The app is for people 13 and older. We do not knowingly collect information from anyone under 13 and delete it if we learn we have.