Privacy

• Your account: your email address. Your password is handled by Supabase, our sign-in provider, which keeps only a hash of it.
• The name you'd like us to use, if you give one.
• Your answer to the age check when you sign up, which confirms you're 13 or older.
• Your record: the colleges you attend, your courses and grades, exam scores, goals, plans and scenarios, unit targets, planning answers, tasks, registration details, your answer about California residency, and what you report yourself (like “I've finished this”).
• A history of changes to your record, so you can see them and undo them in History.
• Your notification settings, and a phone number only if you add one for texts.
• Notes you send with the Feedback button, and your questions to “Ask about my plan” with their answers, when that's on.
• A college, university, school or major you report as missing from our list.
• When we don't have the full list of what one of your goals needs, a note that you reached that gap (the university, major or college, never your courses or grades), so our team can fill it in. Our team sees how many students reach each gap, not who.
• A pathway you checked before signing up, kept with your new account so setup can offer it, until you use it or turn it down.
• Which pages and features you use: the page's address without anything after a “?” or “#”, never your courses or grades.
• For each transcript you upload: when, how many pages, whether it was read, and a fingerprint of the file (a SHA-256 hash) so the same file is recognized. Never the file itself.
• If you pay for Plus: which Stripe customer your account is and what you've paid for. Never your card number.
• If you aren't signed in, nothing you enter in the pathway check is saved. To limit abuse, our public search and pathway check count requests with a keyed fingerprint of your network address; the address itself isn't stored.

We keep your record while you have an account. Deleting your account removes it, as Your choices below describes.

• In the app, only you can see your record, plans and tasks. Our database enforces this on every request.
• A share link shows your summary to anyone who has the link, until it expires or you revoke it. You can hide grades.
• Destination research is shared across students, but it never includes anything from your record.
• Our team can read these in our admin tools, without your name or email next to them: notes you send with the Feedback button, what you report as missing from our list, and your questions to “Ask about my plan” with their answers.

These companies handle your information only to run TransferPlanner for us, each for the part below:

• Supabase runs our database and sign-in. Everything above is stored there. It also sends account emails: confirming your address, password resets and sign-in links.
• Vercel hosts the app. Every page you open goes through it, with your network address, as with any website.
• Anthropic, through its API:
  • Transcript import. Your file is sent to Anthropic's API to read the course rows. We don't store the file, and we don't save your name or student ID.
  • Research: it reads universities' and colleges' public pages for us. What it's given is a university, college, school, major, course code or exam, never your name, email or grades.
  • “Ask about my plan”, only when it's on: your question and your plan are sent to Anthropic, our AI provider, to write the answer. It holds your courses (with their grades, terms and colleges) and your plan, your exam scores and the credit they earn, your goals, transfer term and timeline, your colleges and where you stand with each, your residency answer, the titles and dates of your open tasks, and the requirements, key dates, application steps and costs already in your plan, with their sources. Never your name or email.
• Sentry receives a report when something breaks: what went wrong, the page it happened on, your browser type and a random account number. Never your name, email, courses, grades or transcript.
• Cloudflare Turnstile checks that a person, not a bot, is signing up, signing in or resetting a password. For that check, Cloudflare receives your network address and details about your browser.
• Stripe, only when payments are on, takes payments. You enter your card on Stripe's page; we never see its number. Stripe keeps its own records of payments.
• PostHog, only when analytics are on, records page views and feature use, tied to a random account number, never your name or email. Text on the screen is masked, screen recording is off, and web addresses are sent without anything after a “?” or “#”.
• Resend, once email is set up, delivers the emails we send, account emails and reminders: your email address and the message.
• Twilio, only when texts are set up, sends texts to the number you verify.
• Browser notifications, only when they're set up and you turn them on, are delivered through your browser's own push service.

• Download everything: Settings → Download my data gives you one file with everything listed above, except two things: a text-message code waiting to be used (kept only as a salted hash) and the daily counters that limit transcript reads and questions.
• Review and correct anything: your record is in Courses, Requirements and Plan. Edit your courses in Courses → My courses, and undo changes in History.
• Stop reminders: turn them off in Settings, or use the link in any reminder email.
• Stop sharing: revoke a share link in Counselor summary.
• Delete your account: Settings → Delete account removes your account and everything that belongs to it, including your feedback notes and usage events. Deleting your account cancels your Plus subscription right away. If it can't be canceled at that moment, your account is still deleted and we record the subscription for our team to cancel. Until then, it can still renew.
• Anything you can't change in the app: write to fattimah.hadi@gmail.com from the address on your account, and we'll correct or delete it.
• If you're under 18, you can remove anything you've entered, or your whole account, at any time, in the same places.

Deleting your account can't remove:

• Usage events already sent to PostHog, when analytics are on. They're tied to a random account number, not to your name or email.
• Stripe's own records of your payments, if you paid.
• Our record of payment events: each event's id, type and a fingerprint of its contents, no longer linked to your account.
• Research results, which are about universities and colleges, not about you.

• Sign-in cookies, to keep you signed in.
• Your light or dark choice, and, for 24 hours, a pathway you checked before signing up.
• Edits you haven't saved yet, in that tab only, until you save, discard or close it.
• When analytics run in your browser, PostHog keeps its own identifier once you sign in.

Your browser can send a “Do Not Track” signal. We treat every visit the same way whether or not it does, because TransferPlanner doesn't track you across other websites. There are no ads here, and we don't let advertising or data companies collect what you do on TransferPlanner to follow you elsewhere.

• TransferPlanner is for people 13 and older. Sign-up asks your age, and we don't make an account for anyone younger.
• We don't knowingly collect personal information from children under 13, as the Children's Online Privacy Protection Act (COPPA) requires. If you think a child under 13 has given us information, write to fattimah.hadi@gmail.com, and we'll delete it.

• We post every change to this page here, with a new effective date at the top.
• If a change affects how we use information you've already given us, we'll tell you in the app or by email before it applies to you.