Overview

Campus2Air is a carpool matchmaking platform for adults with a UC Riverside-issued Google account (an @ucr.edu address), coordinating shared rides to and from airports. This Privacy Policy explains what we collect, why, who can see it, and what you can do about it.

Campus2Air is an independent, non-commercial project run by a small group of UCR students (the “maintainers”). It is not a company, a data business or an advertising platform. We collect only what we need to make carpools work.

Campus2Air is not affiliated with, endorsed by, sponsored by, or operated by the University of California, Riverside or the Regents of the University of California. UCR does not receive your Campus2Air data from us and is not responsible for this service.

1. What We Collect

Account Information

• Your UCR Google account email address (@ucr.edu only), received from Google when you sign in.
• Your name, taken from your Google account when you sign in. We store your first name and last initial.
• Your phone number, which you enter when you create or join a carpool.
• A record that you confirmed you are 18 or older and agreed to the Terms of Service: the version you agreed to and when, and when you last confirmed your age. Signing in is not possible without both.

Carpool Data

• The organizer's flight number, the airport, date, trip direction, planned time, seat count, and any optional notes. A “flight number” means the airline code and number, like UA1375. We never ask for booking or confirmation codes.
• Flight numbers riders choose to add when joining a carpool. These are stored with the carpool as a list, not with your account, and are not shown next to anyone's name.
• Records of carpools you have joined or created.

Activity, Notifications and Logs

• In-app notifications about your carpools (for example, someone joined or a carpool was closed). These are not marketing emails.
• An application activity log of what happens on the service (see Section 5).
• Our hosting provider automatically records standard server logs, such as IP address, browser type and the time of each request, for security and troubleshooting.

We do not collect location data, payment information, or advertising identifiers, and we do not track you across other websites.

2. Why We Collect It

We collect data only for these limited purposes: signing you in, matching and coordinating carpools, keeping the service secure and preventing abuse, meeting legal obligations, and understanding how the service is used so we can improve it. Specifically:

• Your email signs you in and confirms that you have a UCR-issued Google account. It does not confirm that you are currently enrolled, who you are, or that you are safe to travel with.
• Your name and phone number let carpool members recognize and coordinate with each other.
• Your carpool details power search and matching.
• The activity log and server logs help us investigate abuse and keep the service working.
• We calculate simple usage statistics (for example, how many carpools were created each day) from our own records. We do not use third-party analytics or tracking tools.

We do not use your data for advertising, marketing or profiling.

3. Who Can See Your Information

A signed-in person who opens an invite link but has not joined sees the same as other signed-in users. Notifications sent to carpool members use only first names and last initials. Admins use their access to run the service, suspend accounts that break the Terms, and handle requests.

We do not sell or rent your personal information, and we do not share it for advertising. We share it only: with the service providers in Section 4, which need it to run the service; when required by law (for example, a valid subpoena); to protect someone's safety in an emergency; and, if the project is ever transferred to new maintainers or an organization, with them, on the condition that they keep this policy or give you notice of any change.

4. Service Providers

Campus2Air runs on these providers. Each handles data under its own terms and privacy policy, which we encourage you to read:

• Google (Firebase Authentication and Google Sign-In): signs you in. Google provides us your email, name, profile photo link and account identifier, and keeps its own sign-in records.
• Vercel: hosts the website and keeps server logs under its own retention rules. We do not export or keep those logs ourselves.
• TiDB Cloud (PingCAP): stores the database. It may keep backups for a limited period, so deleted data can remain in backups until they expire.
• Google Fonts: provides the fonts on our pages; your browser requests them from Google, which receives your IP address.
• Google Forms: only if you choose to use the “Give Feedback” link.

5. Data Retention

• Carpool listings are automatically deleted at 11:59 PM UTC on the day after the listed date. Their membership records and flight lists are deleted with them, or earlier if the carpool is disbanded or closed.
• A record of which carpools you joined is kept for up to 48 hours to enforce the limit of 2 joins every 24 hours.
• The application activity log is kept for up to 180 days, and only admins can see it. It records events such as signing up, logging in, and creating, joining, leaving or sharing a carpool, linked to your email. It also stores the free-text reason an organizer gives when removing a member or disbanding a carpool, and the email of the person who removed someone or handed over a carpool.
• In-app notifications are deleted after 90 days.
• Your account (email, name, phone number and Terms record) is deleted automatically after 1 year without signing in, if you are not in any carpool. You can ask us to delete it sooner (Section 8).
• After a carpool ends, a summary without names, emails, phone numbers or notes (flight number, airport, date, seat count, group size and whether it departed or was disbanded) is kept for usage statistics.
• If your account is suspended, a record of the suspension (your email, the date and a short reason) is kept for up to 3 years, or longer only while needed for an active dispute or legal obligation, including after your account is deleted.
• Server logs and database backups are kept by Vercel and TiDB Cloud under their own retention rules (see Section 4).

You may leave a carpool or disband a carpool you organize at any time.

6. No Background Checks

Campus2Air does not perform background checks, identity verification beyond requiring a UCR-issued Google account, or screening of any kind. Matching is based only on flight and schedule information.

By using Campus2Air, you acknowledge that you are meeting other people at your own discretion and risk. We are a coordination tool, not a vetting service. If someone makes you feel unsafe, stop contact and leave the carpool, and in an emergency call 911. We do not monitor users or handle complaints between users.

7. Data Security, Cookies and Browser Storage

We take reasonable technical measures to protect your data, including HTTPS (encrypted connections), restricted database access, and signed session cookies that cannot be altered without detection.

Cookies. We set one necessary session cookie. It keeps you signed in for up to 30 days after your last visit (each visit restarts the 30 days) and protects your actions from forgery. We do not use advertising, analytics or tracking cookies.

Browser storage. Google's sign-in library (Firebase) keeps its own sign-in information in your browser's storage. Our pages also store your light/dark theme choice and which Terms version you agreed to on that device (so sign-in can finish after Google redirects you); these contain no personal information, and the server checks your agreement itself. Signing out ends your Campus2Air session and signs you out of Firebase in that browser.

Do Not Track. Some browsers send a “Do Not Track” (DNT) signal. Because we do not track you across websites or use your data for advertising, we treat all visitors the same and do not change our practices in response to DNT signals.

No online service is fully immune to security risks. Your UCR Google account is your credential for this service, so keep it secure.

8. Your Choices and Rights

Campus2Air is a small, non-commercial project and may not be legally required to follow the California Consumer Privacy Act (CCPA). We voluntarily give every user, wherever they live, these rights:

• Know and access: ask what personal information we have about you and how it has been used, and get a copy.
• Delete: ask us to delete your personal information.
• Correct: ask us to correct inaccurate information, or ask us to review a suspension.
• No discrimination: we will not treat you differently for using these rights.
• Opt out of sale or sharing: we do not sell or share personal information for advertising, so there is nothing to opt out of.

How to make a request. Email us at legal-campus2air@proton.me. Write from your @ucr.edu address if you can; if you can no longer use it, write from another address and include the @ucr.edu address you used so we can find and verify your account. We aim to respond within 45 days and, if we need more time, will tell you and take up to 45 more days. For a deletion, we remove your account, phone number, notifications, join history and activity-log entries (including mentions of your email in other entries), and take you out of your carpools; carpools you organize are closed and the riders are told the carpool was closed, not why. We keep any suspension record, usage summaries with no personal information, and anything the law requires us to keep. Please do not post requests or personal information publicly.

9. Age Requirement

Campus2Air is only for people 18 and older, and you must confirm that you are 18 or older to sign in. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 is using the service, contact us and we will delete their account.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top of this page. Continued use of Campus2Air after any changes are posted constitutes your acceptance of the revised policy.

We will not make retroactive changes that reduce your rights without clear notice.

11. Contact

Questions, data requests, or concerns about this Privacy Policy can be sent by email to legal-campus2air@proton.me. The maintainers check this inbox about once a month. Please do not post requests or personal information publicly (for example, in the project's code repository).

© 2026 Campus2Air. All Rights Reserved.