Privacy policy

What we collect

Only what the tools need, and only what you give us or what your browser sends by default.

• Account: your name and email, and either a password (stored as a one-way hash, never in readable form) or your Google sign-in. We also ask for your date of birth to check your age. For students under 18, we ask for a parent's email address, which we store encrypted, and we record the time and IP address when a parent gives consent.
• Your student profile: GPA, test scores, courses, awards, intended majors, the schools on your list and the deadlines you track.
• Your household finances: income, savings and family details used to estimate aid. These fields are encrypted before they are written to our database.
• Aid letters and documents you upload: read by AI to pull out the figures. We do not save the file itself. We save the figures you confirm.
• Appeal letters you draft, and your conversations with Addie (your messages and Addie's replies).
• How much you use Addie: for each AI request, when it happened, which feature it was, and its size in tokens (never the text). We use it to keep costs and fair-use limits in check. It is deleted with your account, and for guests after 30 days.
• Payments: Stripe handles your card. We keep only your Stripe customer and subscription IDs and your plan, never card numbers.
• If you choose to share an aid offer anonymously, we turn your exact GPA and income into ranges before anything is saved. The exact numbers are never stored.
• The waitlist: if you join it before launch, your email address, whether you told us you are a parent, a student or something else, and the name of the link you came from (for example tiktok). You must be 13 or older: we ask for your month and year of birth only to check this, and we do not keep it. We email you a link to confirm your address, and we email you about Admit Junction opening, once, only if you confirm. Unsubscribe from the link in our emails, or email support@admitjunction.com.
• Automatically: your IP address (used for abuse protection and security logs) and standard server logs such as browser type and pages requested.

Before you sign up

The chat on our home page sends two things off your device: the state you pick and your income range, to look up public college prices. They travel in the web address of the request, so our hosting provider's logs can contain them. Anything you type in the box is not sent anywhere, and we don't build a profile from your answers until you sign up.

If you use Addie before creating an account, your conversation is saved under a random ID kept in a cookie called addie_guest_id, which lasts 30 days. If you then sign up or sign in on the same browser, the conversation is added to your account. A conversation that never gets moved to an account is deleted automatically 30 days after your last message.

How we use it

• To estimate what colleges cost for your family, rank your list, track deadlines and read aid letters.
• To run your account: sign you in, take payment, and send emails about your account (verification, consent, password and deletion notices).
• To tell confirmed waitlist members when Admit Junction opens, and to see which links people join from. A waitlist address is used for nothing else.
• To keep the service safe: rate limits, fraud and abuse checks, and an audit log of access to student data.
• To understand how the product is used, with the analytics described under Cookies and storage.
• To meet legal obligations.

AI and your information

Addie is powered by Anthropic's Claude. When you chat with Addie, or upload an aid letter or transcript for reading, the text or file is sent to Anthropic to produce the answer. Anthropic handles it under its own terms and privacy policy.

We don't use your information to train AI models. We store the figures you confirm from an uploaded document; we do not store the document. The records we keep of which tools Addie used leave out what went into and came out of them, apart from your deadlines.

Who we share it with

We do not sell your personal information, and we do not share it for advertising.

• Vercel hosts the website and app.
• Railway hosts our database, queue and data pipeline.
• Anthropic runs the AI described above.
• Stripe processes payments.
• Resend sends our emails.
• Google provides sign-in, if you use it.
• PostHog provides product analytics, described under Cookies and storage.
• Sentry receives an error report when something breaks, and timing data for a sample of page loads and requests: the page address (private link addresses are scrubbed), the error or timing details, and the browser type. We configured it not to collect cookies, request contents or session recordings.
• People you invite. Connect lets you give a parent, counselor or advisor access, section by section, and you can remove it at any time. Counselors never see dollar figures. Access by advisors is logged.
• When the law requires it, to protect people's safety or our rights, or in a sale of the business (we would tell you first).

How long we keep it

• Your account data stays while your account exists.
• When you delete your account, it is deactivated and you are signed out at once. Everything tied to it (profile, finances, schools, letters, appeals, conversations, shared links) is permanently erased after 30 days. Signing back in during those 30 days cancels the deletion.
• Payment records may be kept by Stripe for as long as the law requires.
• Guest conversations (see Before you sign up) are deleted automatically 30 days after your last message, unless you sign up first and they are moved to your account.
• Waitlist entries (your email address, whether you are a parent or a student, and the link you came from) are kept until you ask us to erase them. If you never confirm, we never email you about Admit Junction opening. If you unsubscribe, the entry stays, marked as unsubscribed, so we never add you or email you again, including under an alias of the same address. Email support@admitjunction.com to have it erased entirely.

How we protect it

• Connections to our site use HTTPS.
• Household finances and parents' emails for minors are encrypted with AES-256-GCM before they are stored.
• Every request is checked on our servers against the signed-in person, so a screen cannot ask for someone else's data.
• Advisor access to student data is limited to what the student granted and is recorded in an audit log.
• No method of transmission or storage is completely secure, and we can't promise it is.

Cookies and storage

• A session cookie keeps you signed in.
• The addie_guest_id cookie described above (30 days, not readable by scripts).
• A waitlist-age-refused cookie, set for one day only if the waitlist's age check fails, so the form is not retried with a different answer. It holds no personal information.
• PostHog product analytics keeps an anonymous ID in your browser. We turned off automatic capture and session recording, so it does not record what you type or click, it does not set cookies across subdomains, and it honors your browser's Do Not Track setting. Private guest-link addresses are scrubbed before they reach analytics.
• No advertising cookies, no retargeting, and your information is never used for ad targeting.

Your choices

• Download your data: Settings, then Data & privacy. You get a JSON file with your profile, household, schools, plan, aid offers, appeals and notification settings. It does not currently include your Addie conversations; email us if you want those.
• Delete your account: the same place. It asks for your password if you have one.
• Correct anything: edit it in your profile.
• Anything else, including access, correction or deletion requests we can't do in Settings: email support@admitjunction.com.

Children

• You must be 13 or older to have an account. Sign-ups under 13 are blocked, and an account created with Google that turns out to belong to someone under 13 is deleted.
• Students aged 13 to 17 need a parent or guardian's consent by email before they can use their account. The consent link works once and expires after 7 days.
• If you think a child under 13 gave us information, email us and we will delete it.

California and other state rights

We do not sell personal information or share it for cross-context advertising. If you live in California or another state with a privacy law, you can ask what we hold, ask us to correct or delete it, and we won't treat you differently for asking. Use Settings, or email support@admitjunction.com.

Changes to this policy

If we change this policy in a way that matters, we will tell signed-in users by email or in the app before it takes effect. The date at the top shows the latest version.

Contact us

Questions, requests or concerns: support@admitjunction.com.