This Privacy Policy explains what College Decoded collects, why, who it goes to, how long we keep it, and the choices you have. It covers collegedecoded.com, the College Decoded mobile apps, and our emails and text messages. College Decoded is operated by College Decoded LLC, a Delaware limited liability company founded in 2018.
The short version
- We use what you tell us (grades, scores, goals, saved colleges) to run your college plan. We do not sell it.
- Accounts are for people 13 and older. Accounts of students under 18 get stricter defaults: no advertising trackers, no third-party analytics, and AI features only after an explicit opt-in.
- AI features send what you type or upload to the AI providers named below, only for the purpose of answering you.
- If you allow marketing cookies, ad pixels from Meta and Reddit measure our ads. You can say no, and you can opt out at any time without an account.
- You can download or delete your data from the Privacy Center.
1. Information we collect
Information you give us
- Account: name, email address, date of birth, and how you sign in (email link, Google, Microsoft, Apple, or a passkey).
- Planning profile: grade or graduation year, school, state, city and ZIP code, GPA, courses, test scores, intended majors, career interests, activities, awards, college preferences, and the colleges, careers and scholarships you save.
- Optional details: family income or income range and other cost-calculator inputs, gender, race or ethnicity, first-generation status, and disability accommodations. These are optional and used only to personalize cost estimates and recommendations. You can clear them at any time in your profile.
- Your work: essay drafts, brainstorm notes, application and deadline tracking, test-prep answers and scores, and documents you upload.
- Family and counselor links: a parent's or guardian's email address when you invite them, and a linked parent's mobile number if they turn on text reminders. If you link with a counselor, the connection itself.
- Support and newsletter: messages you send us and the email address you subscribe with.
- School counselor resource applications: name, work email, school name and website, title, state, an optional staff profile URL, email verification times, application status, and review notes, used to verify school affiliation and prevent impersonation.
Information collected automatically
- Device and log data: IP address, browser and operating system, app version, pages and features used, and error reports.
- Approximate location (state or country) derived from your IP address, used to apply the privacy rules for where you live and to detect suspicious sign-ins.
- Cookies and similar technologies, described in section 6.
What we do not collect
We do not ask for Social Security numbers, bank account numbers, or biometric data. Payment card numbers go directly to Stripe or Apple; we never see or store them.
2. How we use information
- To run the service: your college list, cost estimates, deadlines, test prep, career matching, and reports.
- To personalize recommendations from the details in your profile.
- To send account, security, billing and deadline emails, and texts a parent has opted into.
- To send our newsletter and product emails if you subscribe. Every marketing email has an unsubscribe link.
- To keep accounts secure, prevent fraud and abuse, and enforce our Terms.
- To fix problems and improve the product.
- To comply with the law.
We do not use personal information from users under 18 or known K-12 students for targeted advertising.
3. AI features
Some features use artificial intelligence: the AI Counselor, essay feedback and brainstorming, College Plan reports, and other features marked as AI. When you use one, what you type or upload, plus the profile details the feature needs to personalize its answer, is sent to an AI provider to produce the response.
- Providers: Google Gemini handles the text and photo features. Image generation and some College Plan sections use Microsoft Azure OpenAI, or OpenAI when Azure is unavailable. The Privacy Center lists the providers active for your account.
- Consent: Students under 18, anyone whose age we don't know yet, and users outside the United States must turn AI help on before any AI feature sends data. Nothing goes to an AI provider until they do. When a student under 18 turns AI help on, each linked parent is told by email and can turn it off.
- Turning it off: Use the AI help switch in the Privacy Center. After that, AI features ask before sending anything.
- Training: We use these providers' paid business APIs. We do not sell your content to them or authorize them to use it to train their general models.
AI output can be wrong. Treat it as a starting point and check anything important against official sources.
5. Mobile numbers and text reminders
Text reminders are a Premium feature for linked parents and guardians who verify their mobile number and check the consent box. We store the number (encrypted) and a record of the consent: its date, time and IP address.
- The number is used only to send the deadline reminders signed up for and is shared only with Twilio, which delivers them.
- We never sell mobile numbers or share them with anyone for their own marketing.
- Reply STOP to any message to stop, or turn reminders off in your account. We keep a minimal record of past consent and opt-outs to show we followed the rules.
7. Your choices and rights
- Access and portability: download a copy of your data from the Privacy Center.
- Correction: edit your profile, or ask us to fix something you can't edit.
- Deletion: delete your account from the Privacy Center or Settings (see section 10).
- Do Not Sell or Share / targeted advertising: use the opt-out in the Privacy Center (it works without an account), choose "Essential only" in the cookie banner, or turn on Global Privacy Control in your browser. We treat a Global Privacy Control signal as an opt-out.
- Marketing email: use the unsubscribe link in any marketing email.
- AI help: turn it off in the Privacy Center.
Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana or Utah), you may have rights to know, access, correct, delete, and port your personal information, to opt out of targeted advertising and "sale" or "sharing", to limit use of sensitive information, and to appeal a decision we make about a request. We will not treat you differently for using these rights. To make a request, use the Privacy Center or email [email protected]. We verify requests before acting on them and respond within 45 days. You may use an authorized agent; we may ask the agent for proof of authorization.
In the past 12 months we have collected these categories of personal information: identifiers; education information; optional demographic and financial details you entered; internet and app activity; approximate location; professional information from counselor resource applicants; and inferences, such as college and career match scores, drawn from them. We collect them for the purposes in section 2 and disclose them to the recipients in section 4.
8. Students under 18 and parents
Under 13
College Decoded is not for children under 13. Our sign-up asks for a date of birth, and a birth date under 13 is refused: no account is created and the date is not stored. If we learn that a child under 13 has an account, we delete it, and a parent's request to delete such an account is honored right away.
Ages 13 to 17
- No advertising pixels, third-party analytics, or session recording, whatever the cookie setting.
- AI features only after the student turns AI help on; linked parents are told and can turn it off.
- Students may invite a parent or guardian. We recommend it, and a parent or guardian's agreement is required before a student under 18 buys a plan.
- A linked parent can see the student's college plan, download it, and see a log of who has accessed it. A parent can ask for the account to be deleted; the student is notified and decides. Nothing is deleted without the student's approval. Safety concerns can be sent to support for a manual review.
At 18
Parent sharing continues by default, because families often need it for financial aid forms, deadlines and deposits. The student gets a one-time notice that they now control what their parent sees and can stop sharing at any time in the Privacy Center. From 18, only the student can export or delete their data.
9. School counselor resource access
Free school counselor resource access is for professional reference only: guides, worksheets, calculators, share links, and sample product previews with sample data. It has no student rosters, uploads, notes, student records, messaging, reporting, or caseload tools. Please do not send us another person's student records through it or through support; if you do, we may delete them and point the family to their own account.
10. How long we keep information
- Your account and planning data: for as long as your account exists.
- When you delete your account (self-service in the Privacy Center): we immediately erase what identifies you (name, email, birth date, contact and family details) and delete your saved colleges, essays, recommendations and other records. We keep a de-identified account row so our audit records stay consistent. Any subscription billed by card is canceled at the same time, with no refund; a subscription bought through the App Store or Google Play must be canceled there first.
- A deletion a parent asked for and the student approved: carried out 30 days after approval, and the student can cancel it before then.
- Security and activity logs: request logs and failed sign-ins with IP addresses, 90 days; sign-in risk checks, 180 days; search history, 1 year; data-access audit logs, 2 years; sign-in links, 30 days; inactive sessions, 180 days.
- Payment and tax records: as long as the law requires.
- Backups: deleted data can remain in encrypted backups until they expire on our database provider's backup schedule.
- Anonymized statistics: aggregated data that cannot identify you may be kept.
11. Security
Data is encrypted in transit and at rest, access is limited to people who need it, and sign-ins are monitored for suspicious activity. Mobile numbers are encrypted separately. No online service can promise perfect security; if a breach affects your information, we will tell you as the law requires.
12. Where data is processed
College Decoded is based in the United States and our data is stored in the United States. If you use it from another country, your information is transferred to and processed in the United States, and the stricter settings described above (opt-in consent, no ad pixels, AI only with consent) apply to you.
13. Changes to this policy
When we change this policy we update the effective date above. For material changes we also notify account holders by email or in the app before the change takes effect.
14. Contact us
Questions or requests about privacy: [email protected].
College Decoded LLC