Privacy Policy

What we collect

Account info (email, name), applicant info (name, grade, school, GPA, SAT, AP, extracurriculars), and any essay materials and target schools you choose to enter.

We do not collect: Social Security numbers (SSN), home addresses, or card numbers (payment is processed by Stripe — we never see it).

How we use it

• Generate diagnostics, reports, and recommendations for your own family
• With your consent, contribute anonymized data to our reference pool (to help other Chinese-American families)
• Send product updates you've subscribed to (unsubscribe any time)

What we will never do

• Sell or rent your data to third parties
• Share your data with any third-party agency (including commercial consulting services)
• Use your data for ad targeting
• Use your data to train external-facing AI models without your explicit consent

Data handling for AI reports

Scoring on the quick assessment page runs entirely in your browser — nothing is uploaded, no email is required. This is our default promise and it never changes.

If you click "Generate AI Deep Report" while logged in, here's what happens — please understand it before clicking:

• Data flows to the AI model provider: the assessment inputs you entered (GPA, standardized scores, AP, ECs, identity, region, etc.) and the system score will be sent to our AI report engine (the underlying provider is listed under "Third-party data processors" below) for personalized interpretation.
• Data is stored in your account: full input parameters, AI return content, generation time, and view count are saved under your account so you can revisit any time. Not exposed publicly.
• Retention and deletion: records persist alongside your account by default. You can request deletion of all AI reports from the account center any time — we clear them within 24 hours. Account deletion removes all reports.
• Not shared externally: AI report content is never sold to third parties, used for ads, or used to train external-facing models. The AI model provider handles its own API call logs per its privacy policy (see processor list below) — that segment is outside our control.
• Usage limits: free users get 1 lifetime free generation per account; subscribers get 1 Semester Diagnostic per applicant per 90 days. Re-viewing the same input doesn't consume quota or trigger a new AI call.
• Share image: if you choose to generate a vertical share image on the report page, it only contains your profile summary (GPA, SAT, region, bucket distribution, report opening) — never the full report or any link that traces back to your account.

Tech details: data transit is HTTPS-encrypted; all AI model calls originate from our backend, your browser never talks to the model provider directly; local scoring runs fully offline with no network requests.

Minor data (COPPA)

We treat applicant data as sensitive. For applicants under 13, the parent must explicitly confirm during entry. We collect only the minimum fields needed to generate diagnostics, and never ask for any personal info unrelated to admissions.

Data retention and deletion

Retained while subscribed. After cancellation we keep your data for 6 months so you can restore the account, then auto-purge. You can also request immediate deletion of all data at any time from the account center.

Third-party data processors

To run the service we share limited data with the following processors, each of whom has signed a processor agreement:

• Stripe, Inc. (payments): card details you enter at checkout go directly to Stripe — we never touch them. We only store the customer ID, order ID, subscription status, amount, and currency that Stripe returns. Handled per Stripe Privacy Center rules.
• Anthropic, PBC (AI model inference service): when generating AI reports we share the minimum required fields with this AI inference provider, per the "Data handling for AI reports" section above. The vendor handles API call data per its privacy policy. The provider may change as the product evolves; we'll update this section accordingly.
• Transactional email provider: subscription confirmations, report delivery, and password resets are sent via a US-compliant transactional email service. Shared fields: email address, template variables (no applicant PII).
• Cloud database hosting (US region): our Postgres database is hosted on a compliant US-region cloud database platform with AES-256 encryption at rest.
• Cloud app hosting (US region): the Node.js app runs on compliant US-region cloud servers; logs do not record applicant PII.

We do not share data with: advertisers, data brokers, third-party analytics platforms (including Google Analytics / Facebook Pixel), or any commercial consulting service.

Cookies and analytics

We set only one essential session cookie (for login persistence). No tracking cookies, no cross-site profiles, no Google Analytics, no Facebook Pixel.

Contact us

For any privacy question, email [email protected] — we reply within 5 business days.