Last updated: November 5, 2026
This policy describes what information USD Passport ("the app") collects, why, and how it's handled. The app is operated by University of San Diego Residence Life for residents of the University of San Diego.
Account information. When you create an account, we collect your name and email address, and a password (stored securely — we never see or store your actual password, only a one-way cryptographic hash of it, handled entirely by Firebase Authentication). Students may optionally provide their major and class year as part of their profile. We also store which residence hall you chose and any event groups you joined, so the app shows you the right events.
Two-factor authentication (optional). To give you extra account protection, you may optionally turn on two-factor authentication. We use industry-standard authenticator apps (such as Google Authenticator, Microsoft Authenticator, Apple Passwords, or Duo) that generate rolling 6-digit codes. We do not ask for, collect, or store your phone number, and we never send SMS text messages. When you set up 2FA, your authenticator app pairs with your account using an encrypted secret key stored securely in your private cloud profile so you can verify logins from any authorized device. The app also generates single-use emergency backup recovery codes so you are never locked out if you misplace your phone. For your security, our servers only store one-way cryptographic SHA-256 hashes of those backup codes — meaning no one, including app administrators, can ever see or read your actual recovery codes. Two-factor authentication is completely voluntary for students, can be toggled on or off at any time under Profile → Settings, and is permanently purged if you delete your account.
Biometric authentication (optional). You may optionally enable Biometric Quick-Unlock (such as Apple Face ID, Touch ID, or Android Biometric Prompt) to protect access to your digital Torero Pass and staff tools on this device. Biometric authentication is handled entirely on-device by your phone's secure operating system hardware (Secure Enclave / Trusted Execution Environment). The app and University of San Diego servers never request, access, process, or store your biometric data. Biometrics can be enabled or disabled at any time in Profile → Settings, operates strictly offline, and incurs zero network or cloud costs.
Location data. When you scan or manually enter an event's QR code, the app checks your device's current GPS location to confirm you're actually near that event before awarding a stamp. This location check happens only at the moment you scan — the app does not track or store your location at any other time, and does not build a location history.
Camera. The camera is used only to read QR codes while the scanner is open. No photos or video are taken or saved.
Stamps and activity. We record which events you've collected stamps for, when, and (for verification purposes) the GPS coordinates at the moment of that specific scan — this is the same location data described above, retained as part of your stamp record so it can't be disputed later. Stamps are stored on your device; when you tap Sync Stamps on Profile, they're also backed up to your account so they carry over to a new phone.
Event attendance records. Separately from your own stamp collection above, hall staff also keep an administrative attendance record for events — your name, email, and the time you attended — similar to a physical sign-in sheet, used for internal reporting on event turnout. This record is retained independently of your account and is not deleted along with it (see Data Retention and Deletion below).
Digital Torero Check-In Pass. The app provides a digital Torero Check-In Pass containing a QR code encoded with your student name, email, user ID, and residence hall. Showing this pass at event entry tables or rapid kiosk stations allows hall staff and event coordinators to record your attendance without physical sign-in sheets. If venue Wi-Fi drops, scans are held in an offline queue on the scanning device and synced when reconnected. The data recorded is identical to the administrative attendance record described above.
Event ratings (optional). After collecting an event's stamp you may rate the event from 1 to 5 stars. Ratings are seen only by hall staff and are used to improve events. Skipping is always an option.
Event RSVPs (optional). For events that take RSVPs, tapping RSVP stores your account ID, the event, and the time you RSVP'd, so the app can hold your spot or your place on a waitlist. Other users only ever see the total number of RSVPs; hall staff see the totals for turnout planning. You can cancel an RSVP at any time.
Badges. Achievement badges are worked out on your device from the stamps you already have. No additional information is collected or stored for them.
Resident Assistants only. For RAs, the app records progress toward each semester's event requirement, and each rounds checkpoint an RA scans, with the time and the location at that moment (including how precise the location was and whether the phone reported it as simulated), so supervisors can confirm rounds were completed.
Staff-awarded stamps. If a staff member awards you a stamp manually (for example, when your phone couldn't confirm your location), a pending award with your email address is stored until your app picks it up.
Optional stamp photos (event organizers only). If you're an event organizer, photos you choose to upload for an event's stamp design are stored locally on your own device only — they are not uploaded to any server and do not sync to other devices.
Reminders. Event reminders you turn on are scheduled on your device only.
To create and secure your account. To verify you were actually present at an event before awarding its stamp (this is the entire purpose of the location check). To track your stamp collection progress and tier status. To generate the completion certificate available once you've earned stamps. To hold your RSVP spot or waitlist place, to give hall staff attendance records, RSVP totals and event feedback, and to help RA supervisors confirm event attendance and rounds.
We do not sell your information. We do not share it with third parties for advertising or marketing purposes. We do not track you across other apps or websites. We do not use it for anything beyond operating the features described above.
You can see your own profile and stamps. Hall staff (administrators and managers) can see attendance records, event ratings, RA progress and rounds, and the list of accounts. An RA or event organizer assigned to show an event's code can see how many people have checked in to that event, but not who.
The app is built on Google Firebase (Authentication, Cloud Firestore, App Check, and related infrastructure), operated by Google. All data sent to and from Firebase is encrypted in transit. Firebase's own privacy policy governs how Google's infrastructure handles data in transit and at rest: https://firebase.google.com/support/privacy
You can permanently delete your account and all associated data at any time from within the app: Profile → Settings → Danger Zone → Delete Account (you'll be asked for your password, then tap Delete Forever). This deletes your profile, every collected stamp (on your device and the backup), your event ratings and RSVPs, your two-factor credentials, your staff-awarded stamp records, RA progress and rounds records, and any admin, manager, RA, distributor, or event-organizer privileges. Any local biometric preferences and queued offline scans on your device are also permanently cleared. This is immediate and cannot be undone. There is currently no way to delete only part of your data (for example, just your stamp history) while keeping your account — account deletion is all-or-nothing.
One exception: if you attended an event that recorded attendance, that attendance record (your name, email, the event, and the time) is retained as part of the hall's administrative records (similar to a physical sign-in sheet) even after your account is deleted. It is not linked to any other data about you once your account is gone, and is not used for anything beyond that administrative purpose. No other data is retained after deletion.
Events themselves are removed automatically about 18 months after they take place; stamps you already collected stay in your passport.
If you can't sign in, reset your password from the Log In screen, or email usdcampuspassport@gmail.com to ask for your account to be deleted.
You can turn off camera, location or notification access at any time in your phone's Settings; scanning needs camera and location access to award stamps. Event ratings, RSVPs and two-factor authentication are optional.
This app is intended for university residents and is not directed at children under 13. We do not knowingly collect information from children under 13.
If this policy changes, the updated version will be posted at this same URL (https://sites.google.com/view/usd-campus-passport/home) and in the app, with a new "Last updated" date.
Questions about this policy or your data can be directed to: usdcampuspassport@gmail.com