Privacy Policy

1. What we collect

When you look up a high school

We record the school, the page you looked it up on, and where you arrived from. We do not store your IP address with that record — it is put through a one-way hash and truncated, which lets us count distinct visitors without holding the address. We keep a running count of your own lookups in your browser, not on our server.

When you ask us to email you a report

Your name and email address, a phone number if you give one, and any of the optional details you choose to enter about your student: their grade, an approximate GPA, test scores if they have any, your family's college background, target campuses or majors, and a free-text note. Every one of those fields is optional and a blank one costs you nothing but a thinner report. Your IP address is recorded with the signup as an anti-abuse measure. Once you are on the list we also record whether you opened each email we sent and which of its links you followed — see section 5.

If you open an Admitted account

An email address and a password, which is stored only as a one-way hash — nobody here can read it or recover it. Then whatever you enter about your student: courses, grades, scores, priorities, and the colleges you are considering, along with any net-price quotes you record.

If you buy full access

Payment is handled entirely by Stripe. Your card number never touches our servers and we could not produce it if we wanted to. We keep Stripe's session and payment identifiers, the amount, the currency, and whether it succeeded or was refunded — which is what tells the site your account is open.

Ordinary server logs

The web server keeps standard request logs. They are operational, they are not joined to anything above, and they age out.

In the statute's own categories, that is identifiers, commercial information, internet or network activity, and education information. No sensitive personal information as CPRA defines it — that list is closed, and a student's grades are not on it.

2. Transcripts and student records

A transcript is a minor's education record and is treated as regulated content here, not as a file. The rules are written into the code that handles it and are not a matter of policy discretion:

• Nothing from the document is ever written to a log. Not a course title, not a grade, not the student's name, not the school's name, and not the filename — because parents upload files called Emma_Transcript.pdf. What gets logged is a random identifier, the outcome, and counts.
• The file is read by one outside service — the Anthropic API, solely to read the document into course rows that you then confirm or correct on screen. There is no third-party OCR, no analytics sink.
• The uploaded file is kept on our own server (Linode) with your account, so you can see and replace it, until you delete it or ask us to close your account. The document is sent to the Anthropic API solely so it can be read; we do not permit it to be used to train models.
• It never guesses. Every extracted field carries a confidence, "not found" is a permitted answer, and it does not compute a GPA — it reports the one your transcript prints and cross-checks it.

You can delete an uploaded document from your account at any time, and deleting it deletes the stored file.

3. Why we have it

• To build and send the report you asked for. That is what the email address is for and it is the main reason any of this exists.
• To make the report about your student rather than about a building. That is what the optional details are for. Fewer answers, thinner report.
• To run your account and take your payment, if you open one.
• To know whether the site works — which pages produce signups, how often a school is looked up, whether a change helped. Counts, not surveillance.
• To keep the thing standing up — rate limits, spam traps, and abuse prevention.

4. Who else sees it

We use a small number of service providers, each for one job, and none of them is permitted to use your information for their own purposes:

We will disclose information if a law or a valid legal order requires it, and if this project is ever sold or transferred, the buyer inherits these commitments or the data does not go.

5. Advertising and measurement

We advertise Admitted California on Meta's platforms, Facebook and Instagram, and the pages of this site carry Meta's pixel. When you visit, the pixel may set a cookie in your browser and tell Meta which page you looked at, and whether you then did something such as ask for a report, start checkout or pay. We use that for two things: to tell whether an advertisement was worth running, and to show Admitted California's own ads, on Facebook and Instagram, to people who have visited this site.

What the pixel reports is the page and the action. It does not send Meta your student's grades, scores, transcript, or anything you typed into a form about them; it is set not to read the forms or buttons on a page by itself. It stays off every page whose web address is private: the links in our emails and your report, and the parent portal, apart from the pages a parent passes through to sign up and pay. None of the portal pages a student sees after logging in carries it.

Under California law, this kind of advertising counts as "sharing" for cross-context behavioural advertising even though no money changes hands. You can switch it off — see section 8. If you do, the pixel does not load in your browser at all.

We do not run any other advertising network on this site, and there is no other tracking pixel here.

The emails we send you

Our own emails carry a single-pixel image and record two things: that the message was opened, and which links in it you followed. Nobody else is involved — the image is served from admittedca.com, the count stays here, and it is not passed to Meta or to anyone else. It exists so we can tell whether these emails are worth sending and whether the report links actually work.

Open counts are unreliable by nature and we treat them as such: Apple Mail fetches that image on your behalf whether or not you read anything, and a mail program set to block images never fetches it at all. If you would rather not be counted, blocking images in your mail program is enough, and unsubscribing ends it entirely — every one of our emails carries a one-click unsubscribe link at the bottom.

6. Your browser's own storage

Some things are kept in your browser and never sent to us. They are how the site remembers, on your device, that you have already looked up three schools or already given us an email address:

Clearing your browser's site data removes all of them. Doing so resets how many schools we think you have looked at, which we are telling you plainly rather than pretending not to know.

7. How long we keep it

• Signups and reports: as long as you are on the list, plus a short period afterwards. Unsubscribing stops the mail immediately.
• Accounts and student records: until you ask us to delete them.
• Payment records: as long as tax and accounting law requires — generally seven years. These are transaction records, not marketing data.
• Lookup counts: indefinitely, because they contain no identifier that resolves to a person.

8. Your California rights, and how to use them

California's Consumer Privacy Act, as amended, gives residents the right to know what has been collected and to receive a copy of it in a portable, readily usable format, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive information, and to not be treated worse for exercising any of them. You will not be charged more or given a thinner report for asking.

To exercise any of these, email jim@admittedca.com from the address in question, or from any address, saying what you want done. There is no form and no portal to navigate. We will confirm within 10 days and complete it within 45.

Do Not Sell or Share My Personal Information. We do not sell personal information. Advertising on Meta, as described in section 5, is "sharing" under California law, and you can opt out of it in either of two ways:

• Turn on Global Privacy Control in your browser or extension. We treat that signal as an opt-out request, automatically, with nothing else required of you.
• Email jim@admittedca.com with the subject "Do Not Share".

An authorised agent may make a request on your behalf with written proof that you authorised them.

9. Children

We do not knowingly sell or share the personal information of anyone under 16. If we learn that a visitor under 16 arrived through an advertisement, their information is not shared for cross-context behavioural advertising, and our advertising is targeted to adults.

This site is built for parents and guardians, and accounts are opened by adults, which the signup page states and asks you to confirm. A parent can give their high-school student a login of their own, on the student's email address, to work on their essays and their record; the student sees only their own record, not their siblings' or the family's payments, and the parent can see everything the student does. We send that student the login and the daily essay reminders the parent signs them up for, and nothing else. We do not knowingly collect personal information directly from anyone under 13, and a student login is for students 13 and older. Information about a student is given to us by their parent or by the student with their parent's invitation, and the parent can have it deleted at any time. If you believe a child has given us information directly, email us and it will be removed.

10. Security

Traffic is encrypted in transit. Passwords are stored only as one-way hashes. Card numbers are never received. Access to the server is restricted to the owner. No system is perfect and anyone who tells you otherwise is selling something — but the smallest possible amount of information is collected here precisely so that there is not much to lose.

11. Changes

If this policy changes in a way that matters, the date at the top changes and anyone on the email list is told. We will not quietly widen what we do with your information and rely on you not re-reading a web page.

12. Text messages (SMS)

If you sign up for Admitted California Essay Reminders, we collect the mobile number you give us, your name and the student's first name if you give them, whether you are the parent or guardian or an adult student, and a record of your consent: the exact words you agreed to, the date and time, and the web address and device you signed up from. We use it only to send the reminders and review updates described in the Text Message Terms, to honour STOP and HELP replies, and to show that you agreed if we are ever asked.

Reply STOP to any message to stop texts. We keep the consent record, marked as cancelled, for four years after you opt out, because carriers can ask us to prove consent after the fact. Ask us to delete it before then and we will, unless the law requires us to keep it.