Since this was done by a student at a university, and at some level this involves tracking people, that's an opportunity to ask a professor about what human subjects protocols you'd need if this was research.

(A professor might be easier to ask than the university human subjects board -- who might refuse to talk with you because this isn't under their jurisdiction, or might get alarmed because you didn't talk with them sooner.)

There might also be campus IT privacy&security policies that apply. Of course people are getting violated much harder by ordinary Web sites, apps, and IoT devices, but sometimes universities aspire to be better than the outer world.