Privacy policy

Version 0.1 · Draft, pending legal review (WBS 8.8) · Last updated August 19, 2026

Who this is for

Every user of University Application Guide is a student in grades nine through twelve in the United States, or that student's parent or legal guardian. If you are under 13, you may not create an account, and we do not knowingly collect personal data from anyone under 13.

Who holds the account, and who pays

A parent or guardian creates and holds the account, accepts our Terms of Service, and pays for anything purchased. A student may also start using the free parts of the service on their own — see "When a student starts before a guardian does," below — but payment always requires a guardian, or, for a student who is 18 or older, requires that student to accept the Terms of Service for themselves before they can pay.

What we collect, and why

We only collect what changes a recommendation.

• To create an account: an email address, and — for a student — date of birth (to confirm age), current grade level, home state, and citizenship status (U.S. citizen, U.S. permanent resident, international student on a visa, or other). For a guardian, a name and email address.
• To generate your college list ("intake"): your grade point average (GPA), number of Advanced Placement (AP) / International Baccalaureate (IB) / honors courses, standardized test type and score (if you have one — you can say you haven't tested), your family's annual budget ceiling for college, and your intended field of study.
• To personalize field-of-study suggestions ("interest profiler"): answers to a short, public-domain vocational-interest survey. No open-ended answers — just a 1-to-5 rating per question.
• If you use the essay coach: the text of essay drafts you submit for feedback.
• If you pay: your purchase is processed by our payment provider (a "Merchant of Record" — see "Payments," below). We do not see or store your card number.
• Automatically: basic technical information needed to operate the site securely (for example, which pages were requested, response times, error logs) — never used to build an advertising profile, and never sold or shared with an advertiser.

We do not collect anything beyond this list. We do not run third-party advertising trackers, analytics pixels, or social-media widgets on this site.

How your data is protected

• Every table holding a student's personal data enforces database-level access rules ("Row-Level Security") so that even a bug in our application code cannot let one family see another family's data — this is checked by the database itself, not just by our code.
• Sensitive fields (date of birth, test scores, essay content, staff credentials) are encrypted at rest.
• All connections to the site are encrypted in transit (Transport Layer Security, TLS) once our production certificate is live — see "Where this policy is incomplete today," below.
• A student signs in with a one-time emailed code (One-Time Password, OTP), not a password — there is no password for a student to lose or reuse elsewhere.
• Every significant action (sign-in, purchase, refund, data request) is written to a permanent, tamper-evident audit log.

What we never do

• We never sell your data, to anyone, for any reason.
• We never share your data with advertisers, and we run no third-party advertising trackers on this site.
• We never use your essay drafts to train any AI model — yours or anyone else's. This is a contractual commitment, not just a policy.
• We never let our AI essay coach write any part of your essay. It gives structured feedback only; every sentence in your essay is yours.
• We never state a percentage chance, probability, or guarantee of admission to any college. Every recommendation is shown as a band — Reach, Target, or Likely — always with the specific facts and rules that produced it, never a number someone invented.
• We honor the Global Privacy Control (GPC) signal. If your browser sends it, we treat you as opted out of any data sale or sharing, automatically — even though we don't sell or share data regardless.

When a student starts before a guardian does

A student can create their own account and complete the free parts of the service — grade/course/test-score intake, the interest profiler, and a free preview of their results — entirely on their own, with no guardian signed up first. If the student wants a parent or guardian to see the results, the student provides a parent's email at the end, and we send that parent an invitation. A guardian's consent and acceptance of our Terms of Service happens at that point — when they claim the student's account — not before.

This means a minor's academic and personal information can exist in our systems for a period before any guardian is aware of or has consented to it. We bound this: if no guardian claims the student's account within 90 days, that account and all of its data are automatically and permanently deleted. Whether this sequencing fully satisfies every applicable law is still under legal review as of this document's date — we are disclosing it plainly here rather than describing a simpler flow than the one we actually built.

Turning 18

If a student is 18 or older when they sign up, they can manage their own account, accept our Terms of Service themselves, and pay for their own purchases with their own card — no guardian is required. We treat a successful, non-disputed card charge as sufficient confirmation that the person completing checkout is an adult; we do not separately verify a government ID. Anyone who claims to be under 13 is blocked from creating an account regardless of what they enter for date of birth.

Payments

We do not process card payments ourselves and never see or store your full card number. Payments are handled by a third-party payment provider (a "Merchant of Record") who becomes the seller of record for the transaction, handles sales tax, and is bound by their own privacy and security obligations. Every purchase is one-time — there are no subscriptions and nothing ever renews automatically. See our Refund Policy for how to get your money back.

Your rights

You — or, for a minor, your parent or guardian — can ask us at any time to:

• See what we have on file for you.
• Correct anything that's wrong.
• Delete your account and data. We will do this unless we're required to keep something (for example, a financial record needed for tax purposes) — and if so, we'll tell you what and why.
• Ask a real person to review any recommendation you disagree with, rather than just accepting an automated result.

Right now, these requests go through our contact page rather than a fully self-service button — we're honest that a one-click "download my data" / "delete my data" flow is not built yet. We will respond to any request within a reasonable time.

Where this policy is incomplete today

We would rather tell you exactly what is still in progress than describe a system that doesn't exist yet:

• The production website does not yet have a live security certificate (TLS/HTTPS) — this is being completed before the site accepts real payments.
• Self-service "see my data" / "delete my data" buttons are not built yet; use the contact page instead.
• We have not yet finalized which country's specific data-protection law framework, beyond U.S. federal and state law, applies to this service — including whether India's Digital Personal Data Protection Act (DPDP Act) 2023 applies to a service that only serves U.S. students. We are building our practices to a high standard regardless of the outcome of that legal question.
• We do not yet have a published, tested incident-response runbook for a data breach. If one occurs, we will notify affected users as required by law.

Changes to this policy

We'll update this page and the effective date above whenever our practices materially change, and we'll highlight material changes prominently rather than burying them.

Contact

Questions about this policy, or a request to see, correct, or delete your data: use the contact page, or email support@uniappguide.com.