Privacy Policy

TrayPal (“we,” “our,” or “the Service”) is an independently operated service based in Connecticut, USA. This Privacy Policy explains what personal information we collect from students, athletes, coaches, and dining operators who use TrayPal on the website or in the TrayPal iOS app, why we collect it, how long we keep it, who can see it, and what rights you have over it. It covers both the website and the app; where the app behaves differently, this policy says so. By creating an account or using the Service you acknowledge that you have read and understood this policy.

1. Information we collect

We collect information you provide directly, information generated by your use of the Service, and limited information we derive from those sources.

1.1 Account and identity data

When you register, we collect your institutional email address, a display name, a username, and optionally a profile avatar or photo you upload. Your email address is used to verify your institutional affiliation, to send transactional notifications (such as password-reset emails), and to identify your account in our database. Display name and username are visible to other users within the TrayPal community features. Section 1.8 explains how photos, including your profile photo, are stored.

1.2 Dining preferences and dietary tags

During onboarding and in your profile settings, you may provide dietary restriction tags (for example: vegetarian, vegan, halal, gluten-free, nut-free), cuisine preferences, and other food-related preferences. These preferences are used exclusively to personalize the menu display and filter recommendations shown to you. They are not shared with third parties or used for advertising.

1.3 Onboarding personalization and body metrics

If you choose to enable nutrition tracking (“macro tracking” mode), we collect additional personalization data during onboarding: your nutrition focus (for example: weight maintenance, muscle gain, general wellness), activity level, and body metrics: sex, age, height, weight, and, if you set one, a weekly weight goal. These fields are entirely optional and are used solely to calculate personalized daily macro and calorie targets that are displayed to you within the app. You may update or delete this data at any time through Profile Settings. Choosing the “browse only” mode (Calm Menu) does not require or retain body metrics.

1.4 Meal logs

When you add items to “Your Meal,” we record the menu items you selected, the quantities and portion sizes, the meal period (breakfast, lunch, dinner, or all-day), the date, and a timestamp. This data powers your personal meal history, your nutrition progress summaries, and (when you have consented) the athlete meal-sharing features described in Section 1.7. Meal logs are associated with your account and are not visible to other students.

1.5 Ratings, reviews and community content

TrayPal includes community features such as forum posts, Polls, comments, written reviews, and vote-based item ratings. When you submit a rating (on the 1 to 10 scale), post to the forum, share a Poll, comment on a post, or write a review, we store the content you submit, the date and time, and your account identifier. Ratings are aggregated and displayed publicly to all users of the same dining location. Forum posts, Polls and comments are visible to other signed-in users of the same institution. A Poll you share anonymously hides your name from other students, but it is still stored under your account so we can act on reports (see the Community Guidelines). Written reviews go to your school’s dining team; you choose whether a review is also posted for other students to read. Meal associations attached to forum posts (showing that a post was linked to a particular meal) are visible to other users as part of the post. Reports and blocks you file are stored with your account and the reported item; the person you report or block is not told who did it.

1.6 Behavioral analytics

To understand how users engage with the menu and to improve product performance, TrayPal collects anonymous behavioral signals using ephemeral session identifiers stored in sessionStorage (not in cookies, and not persisted across browser sessions). These signals include: which menu stations you viewed and for approximately how long (station dwell time); how far down the page you scrolled (scroll depth as a percentage); the number of times you scrolled back up (direction changes, used as a proxy for browsing hesitation); the number of menu item detail drawers you opened (item clicks); and the overall duration of your session. This data is collected without any persistent identifier and cannot be linked to your account or to you as an individual. Aggregate summaries, covering all students at a dining location for a given day, are surfaced to dining operators and TrayPal administrators to guide menu presentation decisions. No individual behavioral record is ever surfaced to a dining operator or to any third party. The iOS app does not collect these signals and contains no analytics or crash-reporting SDK.

1.7 Athlete-specific data

If you complete the athlete onboarding flow and consent to coach sharing, we additionally store your sport and team key, which links your account to a coaching staff roster. This data is used only to enable the coach-facing athlete meal-log features described in Section 4. Athlete data is collected only with explicit consent; you may withdraw that consent at any time (see Section 6.3). Non-athlete users are never enrolled in coach-sharing.

1.8 Photos you upload

You can upload a profile photo, a photo of your meal, a photo on a Poll (in the app), or a photo with a written review (on the website). A meal photo you share from the app is posted as a Poll for other students at your school to see. Photos are stored in Supabase Storage in buckets that are public: the image URL works for anyone who has the link, without signing in, even though TrayPal itself only shows the photo inside the app or website. Do not upload a photo you would not want to be seen outside TrayPal. Photos are deleted with your account (Section 6.2).

1.9 Push notifications (iOS app)

The app can send one kind of notification: an alert when a dish you favorited is on the menu. If you switch on “Notify me when a favorite is on the menu” in Profile, then Settings, and allow notifications when iOS asks, the app obtains an Expo push token for your device and sends it to us together with your account and school. We store the token only to deliver those alerts, and we delete it when you switch alerts off, sign out, or delete your account. If you never switch alerts on, no token is collected. Alerts we send pass through Expo’s push service and Apple Push Notification service, which receive the token and the text of the alert (a dish name and dining hall) and nothing else about you.

1.10 Data the iOS app keeps on your device

The app stores your sign-in session in the iOS Keychain, and keeps menu caches, unsent drafts, filters, your chosen school and your theme on the device. Deleting the app removes all of it.

If you rate dishes before signing in, the app generates a random guest rating id (a UUID that contains nothing about you or your device) and sends it with each unsigned rating. We store it with those ratings so the same phone can change its rating later and cannot vote twice. It is never linked to an account, not even after you sign in, and it is never used for anything other than unsigned ratings.

When you scan a packaged food’s barcode in the app, the app sends the barcode number to Open Food Facts, an open database, to look up the product. Nothing else is sent with it: no account, name, email or identifier.

2. Why we use each category of data

We collect only the information necessary for the specific purpose listed below and do not repurpose data without providing notice.

Account operation: Email address, display name, and username are required to create and maintain your account, authenticate your sessions, enforce institutional eligibility, and send essential service communications such as password resets or policy-change notices.

Menu personalization: Dietary tags and cuisine preferences are used to filter menu items and surface options that match your restrictions or preferences. We do not use these to infer health conditions or share them with any other party.

Meal tracking and nutrition guidance: Meal logs and body metrics are used to calculate your daily macro and calorie totals, display your meal history, and (when enabled) share that history with your coaching staff. These are never used for advertising or sold to any party.

Community features: Forum posts, comments, and ratings are stored and displayed to support the student-facing community functions of the product and to generate aggregate menu-quality signals.

Product improvement: Anonymous behavioral analytics are used to understand how the menu is browsed so that station ordering, default views, and menu presentation can be improved. No personal account data is combined with behavioral analytics for this purpose.

Safety and abuse prevention: We may use account identifiers and activity logs to detect and respond to policy violations, fraudulent accounts, or security incidents. These logs are accessible only to TrayPal operators and are not shared unless legally required.

3. How long we keep your data

We retain personal data for as long as your account is active. When you delete your account in the app (Profile → Settings → Delete account), it is deleted immediately and permanently; there is no grace period and it cannot be restored. If you email support@traypal.app instead, we will process the request within 30 days. Deletion removes your account and everything tied to it from our databases and file storage (see Section 6.2). Anonymized or aggregated data (data that cannot be used to identify you, such as a dish’s average rating or anonymous analytics events) may be retained for historical product analytics.

Push tokens (Section 1.9) are deleted as soon as you switch alerts off, sign out, or delete your account. Guest rating ids (Section 1.10) stay with the unsigned ratings they belong to.

For inactive accounts that have not been formally deleted, we may retain personal data for up to 2 years after the last recorded login before initiating automatic purge processes.

Anonymous behavioral analytics (Section 1.6) are retained in our database for up to 2 years from the date of collection, after which they are deleted or fully de-identified.

We may retain certain data for longer periods where required by applicable law, to resolve disputes, or to enforce our agreements.

4. Who can see your data

4.1 You

You can view all personal data associated with your account (your profile, dietary preferences, body metrics, meal logs, and ratings history) through your account settings and the Meals page within the app.

4.2 Coaching staff (athlete-consented users only)

If you are an athlete who has consented to coach sharing, your coaching staff can view your meal logs, macro totals, and nutrition goal progress through the coach dashboard. Coaches cannot see your body metrics (age, height, weight), your forum posts, your ratings, or your dietary restriction tags unless you share that information separately. Coach access is restricted to staff affiliated with your institution and is enforced at the database level.

4.3 Dining operators and directors

Dining operators and directors (for example, a Chartwells or institutional dining manager) may access aggregate, anonymous analytics through the TrayPal admin dashboard. These analytics show station-level engagement summaries and campus-wide consumption trends but contain no individual student identifiers. Dining operators cannot see your account, your meal logs, your dietary preferences, or any personally identifiable data.

4.4 TrayPal operators

The TrayPal operator and authorized technical staff can access personal data as necessary to support the service, investigate security incidents, respond to your support requests, and maintain system integrity. Access is logged and limited to what is necessary for the task.

4.5 Third-party service providers

TrayPal uses the following third-party providers to operate the Service:

• Supabase: database, authentication (including the sign-in code emails it sends), and photo storage.
• Vercel: hosting and serverless compute for the website and the API the app talks to.
• Upstash: Redis cache.
• Resend: sends our transactional email, such as an invite you send to a classmate and a reply from the dining team to an email you left with a review. Resend receives the recipient address and the message.
• Expo: the push notification service that delivers Favorite alerts to the app; receives your push token and the alert text (Section 1.9).
• Apple Push Notification service: delivers those alerts to your iPhone.
• Open Food Facts: receives the barcode you scan, and nothing else (Section 1.10).

These providers process data on our behalf under their data processing terms and are not permitted to use your data for their own purposes. We do not use advertising networks, data brokers, or analytics platforms that receive personal data, and we do not track you across other apps or websites.

4.6 No sale of student data

We do not sell, rent, or trade student personal data to any third party. We will never sell student data. This commitment applies unconditionally and is not subject to opt-outs because we do not engage in this practice at all.

5. FERPA and education records

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records held by educational institutions that receive federal funding. Dining behavioral data collected by TrayPal (such as meal logs, menu browsing patterns, and anonymous session analytics) is not an education record as defined by FERPA. This data is generated by your voluntary use of a supplemental service rather than being created or maintained by the educational institution as part of your academic record.

To the extent that TrayPal is deployed in a context where it processes any information that could be considered an education record, TrayPal operates as a service provider to the institution under the school official exception to FERPA (34 C.F.R. § 99.31(a)(1)), and uses such data only for the purpose of providing the contracted service.

6. Your rights and choices

6.1 Right to access your data

You may request a copy of the personal data we hold about you by emailing support@traypal.app. We will respond within a reasonable time and no later than 30 days. For data viewable directly in the app (meal history, profile information, ratings), you do not need to submit a formal request; open the relevant section of your account.

6.2 Right to request deletion

You may delete your account at any time in the app through Profile → Settings → Delete account. Deletion is immediate and permanent. You can also email support@traypal.app with the subject line “Account Deletion Request,” and we will process the request within 30 days of receipt. Deletion removes your sign-in and account record; your profile, name, username and photo; your posts, polls, comments and votes, including anonymous ones; your ratings, reviews and review photos; your meal logs, nutrition and habit goals, body metrics and dietary preferences; your coins, streaks, coin shop orders, invites you sent and invites sent to your address; your follows, notifications, reports, blocks, favorite alerts and push notification tokens; and any coach or dietitian sharing. We do not keep a copy of your personal data after deletion. Aggregated and fully anonymized data (for example a dish’s average rating, which is recalculated without your ratings) cannot be linked back to you and is not part of the deletion.

6.3 Right to withdraw coach-sharing consent

If you are an athlete who has previously consented to coach sharing, you may withdraw that consent at any time by updating the relevant setting in your Profile Settings or by emailing support@traypal.app. Upon withdrawal, your meal logs and nutrition data will no longer be accessible to coaching staff. Withdrawal of consent does not delete historical data that was previously shared; if you also want historical records removed, submit a deletion request (Section 6.2).

6.4 Correction of inaccurate data

Most account and profile data can be updated directly through your account settings. If you believe we hold inaccurate information that you cannot correct yourself, contact support@traypal.app and we will review and correct it where appropriate.

7. Security

We implement reasonable technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS/TLS), row-level security policies enforced at the database layer, authentication token rotation, and restricted operator access. However, no system can be guaranteed to be perfectly secure. If you become aware of a potential security issue affecting TrayPal, please contact support@traypal.app immediately.

8. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, such as adding new data categories or sharing with new types of recipients, we will post the revised policy with a new effective date and version number, and we may require you to acknowledge the changes within the product before continuing to use the Service. Continued use after the effective date of a non-material update constitutes acceptance of the revised policy.

9. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or the data we hold about you, please contact us (the support page covers the common requests):

Email: support@traypal.app
Operator: TrayPal, an independently operated service based in Connecticut, USA. The legal entity responsible for the Service can be identified on request.

We aim to respond to all privacy-related inquiries within 5 business days and to complete access or deletion requests within 30 days.