Privacy Policy

CoffeeChat is a networking app for college students, run by its student founders. Since October 2026 a few mentors use it too: people with jobs who meet students, each one approved by our team (section 5). This policy explains what we collect, why, who else handles it, and what you can do about it. Questions or requests: coffeechat.dev.team@gmail.com.

1. What we collect

• Account: your name, school email address, and password (stored only as a secure hash by our login provider). We record when you confirmed you are 18 or older and accepted the Terms.
• Profile: school, your majors and minors, graduation year, target industries and roles, goals, bio, one-liner, up to three experience lines you type (a role and a place), headline, company, and, if you add it, your LinkedIn URL.
• Photos and files: your profile photo (we remove all metadata, including location, when you upload it) and your resume if you upload one.
• Photo verification: if you choose to get verified, a short face scan from your camera that is compared with your profile photo. It is used once and not kept. Section 3 explains exactly what happens to it.
• What you do in the app: swipes, your filters on Swipe (only you can see them), matches, messages, coffee chat plans (shop and time; for a video coffee, the time and the link to the call you paste or your saved video room; when a plan is cancelled, declined or moved, who did it and when), your video room if you save one (a Zoom, Microsoft Teams, Google Meet or Webex link you keep, under Edit profile), practice sessions and the feedback you give and receive, solo practice answers and their grades, badges, streaks, blocks and reports.
• Usage events: a record of key actions (for example “matched” or “coffee chat confirmed”) that we keep in our own database to see how the app is used. We do not use outside analytics or advertising tools.
• Technical data: your IP address and basic browser information, used to keep the app secure, stop spam and abuse, and run the bot check on sign up and log in.
• Feedback: what you type under Profile, Send feedback, kept with your account so we know who to ask about it. Only the people who run CoffeeChat can read it.
• Emails: when you last had the app open, your email setting (Profile, Settings, Emails, and the switch for the email about new students), and a record of each email we send you about the app (what it was about and when).
• My network: the notes you write about the people you have had coffee chats with, the reminders you set to reach out to them, and how you answered “How was coffee?”. Only you can read your notes and reminders: the person a note is about never sees it, and nobody else does either.
• Mentor requests: if you ask a mentor for a coffee chat (a like on their card on Swipe asks them too), the request, the note you add, and their answer. A pass on a mentor’s card on Swipe is kept like any other answer there.
• If you apply to be a mentor: the email address you sign up with (your work email, not a school one), your name, your role and company, the college you went to if you give it, earlier roles if you add them, the fields you work in, a short bio, your LinkedIn link if you add it, and your photo; how many students a month you take (set by us, two to start); and where your application stands (sent, approved or declined, who on our team decided, and when).
• Waitlist: if you join the recruiter waitlist, your email address and which list you joined.

2. What we don’t collect

We don’t collect your precise location, your contacts, or your activity on other apps and websites. There are no advertising trackers, ad pixels, or third-party analytics in CoffeeChat.

When you plan a coffee chat, your browser asks whether CoffeeChat may use your location. If you allow it, your phone or computer uses it on the spot to put the closest coffee shops first. Your location is not sent to us and is not saved anywhere. If you say no, you pick a campus from a list instead.

3. Photo verification and your face

Getting verified is optional. It puts a blue check next to your name that tells other students your profile photo is really you. This section is the full account of what it does with your face.

• What the scan is: three pictures taken by your camera while you look straight ahead and turn your head each way. Turning your head shows there is a live person in front of the camera and not a photo of one.
• What we do with it: our software measures the shape of the face in those pictures and in your profile photo (a set of numbers sometimes called a face template, which some laws call biometric data) and checks whether the two faces are the same person. That is the only thing it is used for.
• What we keep: the pictures and the measurements are discarded as soon as the comparison finishes, normally within a few seconds. We do not store a face scan or a face template, so there is nothing to keep, sell, share or hand over later. We keep only the outcome: that you agreed to the scan, when, whether it matched, a single similarity score, and technical notes on how the scan ran (how fast it was on your phone and, if it could not be completed, which step failed). None of that is a picture or a measurement of your face.
• The one exception: if the comparison is too close to call, one picture from the scan is held privately so a person on our team can compare it with your profile photo by eye. It is deleted the moment they decide, and they are the only people who can see it. The same goes for the single selfie you can send instead if you can’t do the scan.
• If you change your profile photo while you are verified, the new photo is compared with the old one in the same way, with the same rule: nothing is kept. If it isn’t clearly the same person, the check comes off until you scan again.
• Where it happens: on our own server code at our hosting provider. We do not send your face to a face recognition company, and it is never used for advertising, to identify you anywhere else, or to train anything.
• Your choice: nothing is scanned until you read this in the app and tap “I agree, start the scan”. You can use CoffeeChat without ever doing it. Because nothing from the scan is kept, there is nothing to take back afterwards; if you want the check removed from your profile, email us and we will take it off.

4. How we use it

• To run the app: build your deck, make matches, deliver messages, set up coffee chats and practice sessions.
• To keep people safe: verify photos, review reports, and suspend or ban accounts that break the Terms.
• To protect the service: rate limits, bot checks, and investigating abuse.
• To send account emails (sign-up codes and password-reset codes) and the emails about the app below. We do not send marketing email.
• To improve the app, using our own usage events, and to find and fix errors.

Emails about the app. When something happens while you are away, we email your school address: a new match or message (together, in one email at 9 AM), a match nobody has said hi to after two days (once per match), a coffee chat invite (and one reminder the day before if it is still unanswered), a calendar invite once a coffee chat is confirmed (to both of you, with a calendar file that names CoffeeChat as the organizer and only your own address as its guest), an email if the other person cancels a confirmed coffee chat or asks to move it, a reminder an hour before a coffee chat you agreed to, and, at most once a week, new students who joined after you had seen everyone. Rarely, news about a change to the app itself, once (for example, the new logo and how to update your Home Screen icon). Only news you haven’t seen in the app, never between 9 PM and 8 AM in your school’s time zone (the 9 AM email is 9 AM there too), never more than two a day (an email about a coffee chat you planned always goes, and counts in the two), and never about someone you blocked or who blocked you. An email can show the other student’s name, photo and profile line and the first line of their message. To stop them, tap “Turn these off” at the bottom of any of them, or choose in the app: Profile, Settings, Emails (all emails, only coffee emails, or none; the reminder an hour before a coffee chat also has a switch of its own). While Swipe has nobody for you yet, it also has a switch for the email about new students alone; choosing in Settings afterwards decides for that email too. If a mentor says yes to your coffee chat request, we email you that too.

Emails to mentors. A mentor gets an email when their application is approved or declined, and when a student asks them for a coffee chat (with that student’s name, photo, card line and note), from 8 AM to 9 PM Eastern; and the same emails about their conversations and coffee chats as students get. The request emails can be turned off the same way.

5. Who can see what

• Other students, at your school and at other schools, can see your profile (name, class year, school, majors and minors, photo, the field and roles you are aiming for, interests, bio, one-liner, experience lines, links, badges, streak, verified check). The school shown is the one your school email confirms: other students can see the part of your address after the @ (for example ufl.edu), never the rest. At a school we do not list, it is the school you typed. Your email address itself is never shown.
• Mentors are people with jobs, not students, who applied with their work email and were approved by our team. A mentor’s college and work are what they told us. They do not swipe and have no list of students: in the app, a mentor sees your card (the one other students see) and your note only when you ask them for a coffee chat (Ask, or a like on their card on Swipe). If they say yes, you are matched, and they see what any match sees. Every student can see an approved mentor’s card: name, photo, role and company, college if given, earlier roles, fields, bio, and LinkedIn link. A mentor’s email address is never shown.
• Your matches can see the messages, coffee chats and practice sessions you share with them. Your resume is only shared when you send it in a conversation, through a link that expires after 60 seconds.
• A video coffee’s link (the Zoom, Microsoft Teams, Google Meet, Webex or FaceTime link you paste when you plan one, or your saved video room) is kept with that coffee chat, for as long as the coffee chat is: until one of you deletes your account. In the app only the two of you can see it, and it is in the calendar invite and the hour-before email to each of you. CoffeeChat doesn’t connect to the call: joining opens that service, under its own privacy policy. Your saved video room is not on your card: only you can see it, and it reaches someone else only as the link of a video coffee you plan with them.
• Solo practice answers are private to you, and so are your notes and reminders in My network.
• My network shows you the people you have had coffee chats with, at the coffee shop where you met (or the town, zoomed out). It shows nothing they have not already shared with you on CoffeeChat, and never where anyone lives or is right now.
• Our team can see reports and the content they point to, a verification picture while it waits for review, app-wide usage numbers, and the list of accounts (name, school, email address, when you signed up and last logged in, and how far you got through sign-up), so we can help anyone who gets stuck, and the emails the app has sent you. They also read every mentor application, with the applicant’s email address, to decide it.
• If you block someone, you disappear from each other’s decks, chats and coffee chats.

6. Who else handles your data

We use these service providers to run CoffeeChat. They process data only to provide their service to us. We do not sell your data to anyone.

• Supabase (United States): our database, login system and file storage. Holds everything in section 1.
• Vercel (United States): hosts the website. Handles every page request, including your IP address, in its request logs. The photo verification comparison (section 3) runs here, in our own code, and nothing from it is saved.
• Google (Gmail): sends our account emails (sign-up codes and password-reset codes) and the emails about the app (section 4), so it processes your email address and the contents of those emails.
• Cloudflare Turnstile: the “I’m human” check on sign up, log in and password reset. It usually runs without showing anything, and asks for a tick only when it needs one. It processes your IP address and browser signals to tell people from bots.
• Anthropic (Claude): when AI practice features are switched on, the role, industry, question and your answer are sent to Anthropic to generate practice questions and grade solo practice answers. Anthropic does not use this data to train its models. Leave personal details out of practice answers.
• Sentry (United States): when something in the app breaks, an error report goes to Sentry so we can fix it: what went wrong, on which page, and your browser and device type. Reports don’t include your name, email, IP address or a recording of your screen.
• OpenFreeMap: draws the map in My network. Your phone loads the map pictures from OpenFreeMap’s servers, so they see your IP address and which part of the map you are looking at. Nothing about you or the people on your map is sent to them.
• Your browser’s speech service: if you use the microphone button, your browser turns speech into text. In Chrome the audio is processed by Google; in Safari, by Apple. We only ever receive the text.

7. Cookies and local storage

We only use what the app needs to work: login cookies that keep you signed in, unsent chat messages (kept in your browser only until you close the tab), two small settings kept on your phone (whether you have closed the Add to Home Screen tip, and whether you last practiced for a job interview or a coffee chat), and whatever the Cloudflare bot check needs to do its job. We don’t use advertising or analytics cookies, which is why there is no cookie banner.

8. How long we keep it

• Your account data stays until you delete your account.
• Deleting your account (Profile, then Settings, then Delete account) permanently removes your profile, photos, resume, matches, messages, practice history and everything else tied to you, right away.
• Face scans and face measurements are not kept at all (section 3). A verification picture that needs a person to look at it is deleted as soon as it is reviewed.
• The record of each email about the app is deleted after 90 days.
• A note or reminder in My network stays until you delete it (Edit, on that person’s page) or your account.
• Abuse-prevention counters that include an IP address are deleted within about a day.
• A mentor application stays with the account. A declined applicant can ask us to delete the account, and it is gone with everything else; an approved mentor can delete it from Settings like anyone.
• Waitlist emails are kept until that part of the app launches, or until you ask us to remove yours.
• Our providers may keep their own logs for a limited time under their own policies.

9. Your rights

Wherever you live, you can ask us for a copy of your data, correct it, or delete it. Most of this you can do yourself: edit your profile any time, and delete your account from Settings on your Profile tab. For a copy of your data or anything else, email coffeechat.dev.team@gmail.com from the email you signed up with and we will respond within 30 days.

California residents have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing, and we won’t treat you differently for using these rights. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months.

If you are in the EU, UK or a similar region: we process your data to provide the service you signed up for (contract), to keep it safe (legitimate interests), and, for the optional photo verification and voice input, because you chose to use them (consent, which you can withdraw by not using them). You can also ask us to restrict or stop processing, ask for your data in a portable format, and complain to your local data protection authority. Your data is stored and processed in the United States.

10. Security

Every database table is locked down so people can only reach their own data and what others chose to share with them. Private files use short-lived links, uploads are checked and cleaned, and logins are protected by a bot check and rate limits. No system is perfect; if you find a security problem, please tell us at coffeechat.dev.team@gmail.com.

11. Age

CoffeeChat is only for people 18 and older, and every account must confirm this at sign up. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we delete it.

12. Changes

When we change this policy we update the date at the top. If a change affects how we use data you have already given us, we will tell you in the app before it takes effect. See also our Terms of Service.