When you sign in. There are three ways in: a Google account, an Apple account, or an email address and a password you choose. From Google, Hazel receives your email address and a claim confirming the account belongs to the g.ucla.edu domain — that claim is what verification checks. From Apple, Hazel receives whatever Apple passes on, which may be a private relay address rather than your real one. From the third, Hazel receives the email address you type and nothing else about you. Hazel never sees your Google or Apple password: those are typed on Google's and Apple's own screens, not in Hazel. A Hazel password is different. You type it here, and it goes straight to Supabase, which runs sign in. The person who runs Hazel cannot read it back.
When you set up your profile. Your name, year, major, gender, and date of birth. Guests give an area, say how they usually eat and what they are hoping for from a meal, and can add a note about themselves. Cooks say what they cook and how experienced they are, answer a prompt about their cooking, describe what usually happens after dinner, say how long a meal usually runs, set a house rule if they have one, give the address where they cook, and give their availability. Both of you set who you are comfortable sharing a meal with, by gender and by age.
Your preferences. Cuisines you like, dietary restrictions, foods you would rather not eat, and who you are comfortable sharing a meal with. When you send a cook a request, they see your first name, year and major, and whatever you wrote with it. When they accept, Hazel shows them your dietary restrictions and the foods you would rather not eat, together, so they can say whether they can cook for you. Your cuisines are shown to no one unless you also cook — a profile in the browse feed can be read by anyone signed in, and your cuisines go with it. The database is wider than the app in one place: a cook holding your request could read your cuisines and the foods you would rather not eat before accepting, and no screen in Hazel shows them either of those then. Your comfort settings are shown to no one, and no other user can read them at all — they only decide which profiles you see.
Your photos. Meal photos, a photo of where you cook, a photo of your dining area, and a face photo. You choose each one from your photo library or take it with the camera, and you crop it before it is saved. Hazel reads only the photos you pick.
What you do in Hazel. Requests you send and receive, matches, messages, meals, ratings, and reports.
What a rating also holds. After a meal, Hazel asks whether you felt safe and respected, and asks guests whether the cook accommodated their dietary restrictions. Both answers are stored with the rating and are never shown to the person you rated.
Errors on your device. When something goes wrong, Hazel writes what happened to your phone — the error, which screen it was on, and your device type, OS version, and app version. This never leaves your phone, is never sent anywhere, and is deleted with your account.
Payments. Hazel does not collect a payment handle, a card, a bank account, an amount, or a transaction, and there is no field in Hazel that could hold one. Paying for a meal arranged through Hazel is against the Terms of Service -- see section 3 -- so there is no payment to record. If you want to know what someone paid, Hazel cannot tell you, including about yourself.
Hazel never reads your device location. There is no GPS, no coordinates, and no map lookup anywhere in Hazel. The only places Hazel holds are the ones you type: an area from a guest, and from a cook the address where they cook. There is no background tracking, no advertising identifier, and no analytics service watching what you tap.