Privacy Policy

1. What we collect

When you look up a high school

We record the school, the page you looked it up on, and where you arrived from. We do not store your IP address with that record — it is put through a one-way hash and truncated, which lets us count distinct visitors without holding the address. We keep a running count of your own lookups in your browser, not on our server.

When you ask us to email you a report

Your name and email address, a phone number if you give one, and any of the optional details you choose to enter about your student: their grade, an approximate GPA, test scores if they have any, your family's college background, target campuses or majors, and a free-text note. Every one of those fields is optional and a blank one costs you nothing but a thinner report. Your IP address is recorded with the signup as an anti-abuse measure.

If you open an Admitted account

An email address and a password, which is stored only as a one-way hash — nobody here can read it or recover it. Then whatever you enter about your student: courses, grades, scores, priorities, and the colleges you are considering, along with any net-price quotes you record.

If you buy full access

Payment is handled entirely by Stripe. Your card number never touches our servers and we could not produce it if we wanted to. We keep Stripe's session and payment identifiers, the amount, the currency, and whether it succeeded or was refunded — which is what tells the site your account is open.

Ordinary server logs

The web server keeps standard request logs. They are operational, they are not joined to anything above, and they age out.

In the statute's own categories, that is identifiers, commercial information, internet or network activity, and education information. No sensitive personal information as CPRA defines it — that list is closed, and a student's grades are not on it.

2. Transcripts and student records

A transcript is a minor's education record and is treated as regulated content here, not as a file. The rules are written into the code that handles it and are not a matter of policy discretion:

• Nothing from the document is ever written to a log. Not a course title, not a grade, not the student's name, not the school's name, and not the filename — because parents upload files called Emma_Transcript.pdf. What gets logged is a random identifier, the outcome, and counts.
• The file goes to exactly one outside service and no other — the Anthropic API, solely to read the document into course rows that you then confirm or correct on screen. There is no third-party OCR, no object storage, no analytics sink.
• The reading step stores nothing on our systems. No temporary files, no cache, no database write. Only what you confirm is saved. The document is sent to the Anthropic API solely so it can be read; we do not permit it to be used to train models.
• It never guesses. Every extracted field carries a confidence, "not found" is a permitted answer, and it does not compute a GPA — it reports the one your transcript prints and cross-checks it.

You can delete an uploaded document from your account at any time, and deleting it deletes the stored file.

3. Why we have it

• To build and send the report you asked for. That is what the email address is for and it is the main reason any of this exists.
• To make the report about your student rather than about a building. That is what the optional details are for. Fewer answers, thinner report.
• To run your account and take your payment, if you open one.
• To know whether the site works — which pages produce signups, how often a school is looked up, whether a change helped. Counts, not surveillance.
• To keep the thing standing up — rate limits, spam traps, and abuse prevention.

4. Who else sees it

We use a small number of service providers, each for one job, and none of them is permitted to use your information for their own purposes:

We will disclose information if a law or a valid legal order requires it, and if this project is ever sold or transferred, the buyer inherits these commitments or the data does not go.

5. Advertising and measurement

We advertise, or expect shortly to advertise, MeritParity on Meta's platforms — Facebook and Instagram. If you arrive from one of those advertisements, Meta's measurement tools may set a cookie in your browser and report back to Meta that a visit or a signup happened, so we can tell whether the advertisement was worth running. What that reports is the action. It does not send Meta your student's grades, scores, transcript, or anything you typed into a form about them.

Under California law, that kind of advertising measurement counts as "sharing" for cross-context behavioural advertising even though no money changes hands. You can switch it off — see section 8.

We do not run third-party advertising networks on this site, and there are no retargeting pixels here beyond the one described above.

6. Your browser's own storage

Some things are kept in your browser and never sent to us. They are how the site remembers, on your device, that you have already looked up three schools or already given us an email address:

Clearing your browser's site data removes all of them. Doing so resets your free lookups, which we are telling you plainly rather than pretending not to know.

7. How long we keep it

• Signups and reports: as long as you are on the list, plus a short period afterwards. Unsubscribing stops the mail immediately.
• Accounts and student records: until you ask us to delete them.
• Payment records: as long as tax and accounting law requires — generally seven years. These are transaction records, not marketing data.
• Lookup counts: indefinitely, because they contain no identifier that resolves to a person.

8. Your California rights, and how to use them

California's Consumer Privacy Act, as amended, gives residents the right to know what has been collected and to receive a copy of it in a portable, readily usable format, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive information, and to not be treated worse for exercising any of them. You will not be charged more or given a thinner report for asking.

To exercise any of these, email jim@admittedca.com from the address in question, or from any address, saying what you want done. There is no form and no portal to navigate. We will confirm within 10 days and complete it within 45.

Do Not Sell or Share My Personal Information. We do not sell personal information. Advertising measurement, as described in section 5, is "sharing" under California law, and you can opt out of it in either of two ways:

• Turn on Global Privacy Control in your browser or extension. We treat that signal as an opt-out request, automatically, with nothing else required of you.
• Email jim@admittedca.com with the subject "Do Not Share".

An authorised agent may make a request on your behalf with written proof that you authorised them.

9. Children

We do not knowingly sell or share the personal information of anyone under 16. If we learn that a visitor under 16 arrived through an advertisement, their information is not shared for cross-context behavioural advertising, and our advertising is targeted to adults.

This site is built for parents and guardians, and accounts are for adults, which the signup page states and asks you to confirm. We do not knowingly collect personal information directly from anyone under 13. Information about a student is given to us by their parent, who decides how much to share and can have it deleted at any time. If you believe a child has given us information directly, email us and it will be removed.

10. Security

Traffic is encrypted in transit. Passwords are stored only as one-way hashes. Card numbers are never received. Access to the server is restricted to the owner. No system is perfect and anyone who tells you otherwise is selling something — but the smallest possible amount of information is collected here precisely so that there is not much to lose.

11. Changes

If this policy changes in a way that matters, the date at the top changes and anyone on the email list is told. We will not quietly widen what we do with your information and rely on you not re-reading a web page.