PRIVACY POLICY

Quad, LLC ("Quad," "we," "us") operates the Quad mobile app and website (the "Services"), a campus network where college students discover clubs, events, and recruitment opportunities. This Privacy Policy explains what we collect, how we use it, who we share it with, and the choices you have. The Services are intended for users aged 13 and older.

We collect only what the Services need to function. For each item: what we collect and how we collect it.

• Account and identity: your name, school email, and a user id from Clerk, our sign-in provider. You type the email and confirm it with a one-time code. Campus is derived from that email domain on our servers.
• Profile: university, school, graduation year, major/minor, interest tags, optional phone, bio, and photo. You enter these in onboarding or profile. Photos you pick on the device are uploaded to our storage.
• Activity: events you open, save, and RSVP to, and clubs you follow. Recorded when you tap those actions in the app, so we can rank your feed and campus lists.
• Applications: answers and files you submit to a club role. You send those when you apply.
• Assistant: messages you type (or dictate, which we turn into text on device), recent messages in that chat, and campus context already on your account (school, clubs you follow, events we look up to answer). Collected only after you tap continue on the in-app permission screen. See Section 5.
• Push token: a device token, collected only if you allow notifications in the system prompt.

We do not collect your location, and we do not use any advertising or third-party analytics or tracking SDKs. We do not track you across other apps or websites, and we do not share your data with data brokers.

• Create and secure your account, and keep you signed in (Clerk).
• Place you on the right campus and show clubs, events, and roles for that campus.
• Personalize feed and recommendations from follows, saves, RSVPs, and interests.
• Run the in-app assistant: send the data in Section 5 to OpenAI to write a reply, store the chat so you can reopen it, and filter unsafe content.
• Send the notifications you have enabled (Apple APNs).
• Let clubs receive applications you submit.
• Prevent abuse and comply with law.

Where GDPR/UK GDPR applies, we process your data to perform our contract with you (to provide the Services), on the basis of our legitimate interests (to secure and improve the Services and prevent abuse), and, where required, with your consent (which you may withdraw at any time). Interest tags such as "Politics" or "Philosophy" denote academic or career fields of interest only; we do not treat them as, or use them to infer, political opinions or beliefs, and we do not use them for advertising.

The assistant is a third-party AI service: OpenAI (openai.com). This is not only in this Policy. The iOS app shows a permission screen before any assistant data leaves the device. If you tap not now, the rest of Quad still works and nothing is sent to OpenAI. If you tap continue, then when you send a message we transmit:

• the message you typed or dictated
• recent messages in that conversation
• campus context already on your account: school, clubs you follow, and events or clubs looked up to answer you

Use: OpenAI writes a reply. OpenAI processes this on our behalf as a service provider and, under its API terms, does not use it to train its models. We also run a safety filter (keyword blocklist, classifier, and OpenAI omni-moderation) on messages and replies. OpenAI may retain content briefly for abuse monitoring, then delete it. Chat history is stored in our database so you can reopen it, and is deleted when you delete your account or clear history. Do not send financial, health, or government-id details to the assistant.

We do not sell your personal data. We share data only with the service providers that run the Services, each of which may use it solely to provide those services to us. Each third party listed here is required to provide the same or equal protection of user data as this Policy and as Apple's App Store guidelines:

• Clerk — authentication and account management.
• OpenAI — the in-app assistant and safety moderation (see Section 5).
• Apple (APNs) — delivery of push notifications.
• Neon — database hosting.
• Vercel — application hosting.
• Cloudflare (R2) — storage of images such as profile photos.

We may also disclose data if required by law, or in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Some club and event information shown in the Services is aggregated from publicly available sources, including public Instagram posts by student organizations. This content concerns organizations and their events, not private individuals. It may be incomplete or inaccurate. If you are an organization representative and want content corrected or removed, contact us at admin@join-quad.com.

We keep your information for as long as your account is active or as needed to provide the Services. You can delete your account at any time in the app under Profile > account settings > delete account. Deleting your account removes your Quad profile, activity, follows, saved events, assistant history, and push tokens from our systems and deletes your identity record with our authentication provider. Some records may be retained where required by law.

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. To exercise these rights, use the in-app controls or contact admin@join-quad.com.

EEA/UK: you may also lodge a complaint with your local supervisory authority. California (CCPA/CPRA): you may request access, deletion, and correction of your personal information; we do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising your rights.

We use encryption in transit, access controls, and other reasonable administrative, technical, and physical safeguards. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your data, we will notify you and the relevant authorities where legally required.

The Services are intended for users aged 13 and older. We do not knowingly collect personal information from anyone under 13. If you believe someone under 13 has provided us information, contact admin@join-quad.com and we will delete it promptly.

We are based in the United States and process data there. If you access the Services from outside the United States, you understand your information may be transferred to and processed in the United States and by the service providers listed in Section 6.

We may update this Policy from time to time. Material changes will be posted here with a revised "Last updated" date.

For questions about this Privacy Policy or your data, contact us at admin@join-quad.com.