What PawPass keeps, and why.

Last updated 2026-11-10.

Who we are

PawPass is an independent product built by Princeton students to run the guest list at eating-club doors. It is not affiliated with Princeton University or any eating club. Each club that uses PawPass decides what parties to run on it and who its officers are.

What we collect

Your Princeton email and directory record. When you sign in we look upyour own entry in Princeton's public directory once to confirm your netid and read your name, class year and affiliation. We store those fields on your profile only. We never bulk-query, cache or market from the directory.
Door photo. Required, so the door can compare a face to a pass: the app asks for it when you sign up, and a guest pass's code does not show without one. A Princeton student sets it from their prox (below); anyone else takes a selfie. We note which of the two it came from. It is set once. It is shown on your pass, in Apple Wallet, and to door staff and officers of the club whose party you hold a pass for, and it is your profile picture unless you change or remove it (below). Whether it came from your prox is shown only at the door. Location and camera metadata are stripped on upload.
Profile picture. What friends and club members see. Until you change it, it is your door photo; you can set your own, remove it (then they see a plain grey icon), or go back to your door photo any time under You. Anyone else on PawPass sees only a picture you set yourself, never your door photo. A picture you set yourself is never shown at the door. Location and camera metadata are stripped on upload.
Your prox, once, on your phone. If you are a Princeton student, the app sets your door photo by photographing your prox: it finds the card, checks that the printed name and class year match your account, and cuts out the face on your phone. Only that face is uploaded, together with the name and class year it matched; those two fill your profile only where it has none. The card image is never stored or sent, on your phone or ours, and neither are your PUID, your birthdate or any other printed field. If the scan cannot verify your card after three tries you may take a selfie instead, and the door sees your photo marked Not prox-verified.
App Attest key, if you scan your prox. The upload carries a check from Apple's App Attest that it came from the genuine PawPass app on a real iPhone. We keep that key's public half and a counter, linked to your account, and use them for nothing else. It is not a hardware or advertising identifier.
Passes, spots and invites. Which parties you hold a pass for, who gave you the spot, and when it was scanned.
Door scans. Time, door and result of each scan, kept for one year and then aggregated.
Your name at the door, if you work it. A bouncer types a name when they start. That club's officers see it with how many people that phone let in, and it is kept with each scan it made, on the same one-year terms. It is a record of the door, not proof of who held the phone.
Party cover images an officer uploads. They appear on the party's invite and club card, which anyone with the link can see, so they are served publicly. Location and other photo metadata are removed first.
Device tokens for push notifications and Live Activities, if you turn them on.
Club rosters uploaded by that club's officers: netid, name, class and role.

How we use it

To issue, show and verify passes at the door, and to show officers live counts and guest lists for their own club.
To send you sign-in codes, invites and party notifications you have opted into. Every notification carries an action; none are marketing.
To keep the service safe: rate limiting, abuse reports, and audit logs of officer actions.

Who can see what

Door staff and officers of a club see the names, class years, door photos and inviters of guests holding passes for that club's parties, and whether a Princeton student's door photo is a selfie rather than from their prox.
Members of a club can see their club’s member list: names, officer titles, whether each person has joined PawPass, and the profile picture of those who have one (a member's door photo unless they changed or removed it). They never see anyone’s email or netid.
Friends can see that you are going to a party only if you allow it (default: friends). Names of attendees are never public.
We do not sell data and do not share it with the University. Clubs receive exports of their own parties on request.

Where it lives

Data is stored with Cloudflare (United States) and email is sent through Resend. Photos are served through short-lived signed links. Secrets and signing keys are never on your device.

Your choices

Delete your account in the app under You › Other › Delete account. Passes are revoked and your profile is removed; anonymised audit rows are kept.
Report or block anyone from their profile.
Turn off notifications and visibility to friends at any time.

Contact

Privacy questions and security disclosures:bb7906@princeton.edu. We answer within two business days.