Privacy Policy
In plain English. No legal tricks.
Last updated: April 26, 2026
The Short Version
GradFax does not sell your data. Period. GradFax only shares information with schools if you explicitly opt in through GradFax Connect, and even then, your identity stays anonymous until you choose to respond. GradFax does not use your data for targeted advertising. You can delete everything at any time. That is the whole policy.
Why This Matters
Most college search platforms make money by selling your information to schools, advertisers, and data brokers. They collect your GPA, test scores, interests, and contact info, then package it up and sell it to the highest bidder. You become the product.
GradFax is different because the business model is different. Revenue comes from schools who want to provide verified, transparent information about themselves, not from harvesting your personal details. The moment GradFax sells your data, the trust that makes the platform valuable disappears.
What GradFax Collects (And Why)
Account Information
When: You sign up with email/password or Google sign-in.
What: Email address, display name, and authentication credentials. If you sign in with Google, GradFax receives your name and email from Google OAuth. GradFax never receives or stores your Google password.
Stored: Securely in Supabase (database and authentication provider). You can delete your account at any time.
Search Queries
When: Every time you search for schools.
Why: To return results and improve matching quality over time.
Stored: Processed by the GradFax search engine to find relevant results. Raw search queries are not stored permanently.
Profile Preferences
When: You fill out the student profile quiz or set preferences.
Why: To personalize your search results and match scores.
Stored: On the web, preferences are saved in your browser (localStorage) by default. If you create an account, preferences sync to Supabase so you can access them from any device. On the mobile app, preferences are stored locally using AsyncStorage on your device.
Saved Schools, Activities, and Checklists
When: You save schools, create activity lists, or use checklists.
Why: So you can come back to them later and track your progress.
Stored: On the web, this data is saved in localStorage by default and syncs to Supabase if you sign in. On the mobile app, activities, checklists, and offline cache data are stored locally on your device using AsyncStorage.
Transcript Uploads
When: You use the transcript analysis feature.
Why: To analyze your academic history and provide course-by-course insights.
Stored: Processed and then discarded. GradFax does not keep your transcript after analysis is complete. If you have an account, GradFax stores the analysis results (not the transcript itself) so you can reference them later.
Analytics Data
When: You visit any page on the web or use the mobile app.
Why: To understand which features people use so GradFax can improve them.
Stored: PostHog collects page visits, device type, and general location (city level, not your address). You can opt out through your browser settings or by using an ad blocker.
Payment Information
When: You purchase a premium feature.
Why: To process your payment.
Stored: Processed entirely by Stripe. GradFax never sees, stores, or has access to your full card number. Stripe handles all payment security. See Stripe's privacy policy for details.
Mobile App Data
Local Storage: The GradFax mobile app stores activities, checklists, offline cache, and notification preferences locally on your device using AsyncStorage. This data stays on your device and is not transmitted to GradFax servers unless you sign in and choose to sync.
API Communication: The mobile app sends an API key header with requests for rate limiting purposes. This key identifies the app, not you personally.
Notification Preferences: If you enable push notifications, your preference is stored locally on your device. You can change notification settings at any time through your device settings or within the app.
How GradFax Uses Your Information
- 1.Provide the service. Search results, saved schools, transcript analysis, personalized recommendations.
- 2.Improve the platform. Aggregate, anonymized usage data helps GradFax understand which features matter most.
- 3.Communicate with you. Account confirmations, feature updates, and scholarship deadline reminders (only if you opted in).
- 4.Process payments. Through Stripe, only when you purchase a premium feature.
- 5.Prevent abuse. Rate limiting and API key validation protect the platform from misuse.
What GradFax Does Not Do
Sell your data to third parties. Ever.
Share your data with schools unless you explicitly opt in through GradFax Connect, and even then it is anonymized.
Use your data for targeted advertising.
Store your transcripts after processing.
Track you across other websites.
Let schools pay to access your profile without your permission.
Use dark patterns or manipulative design to trick you into sharing more.
Third-Party Services
GradFax uses the following third-party services to operate. Each has its own privacy policy:
GradFax does not sell or share your personal information with any of these providers beyond what is necessary to operate the service. No data is sold to third parties under any circumstances.
College Data Sources
The college and university data displayed on GradFax comes from publicly available government databases, primarily the Integrated Postsecondary Education Data System (IPEDS) operated by the National Center for Education Statistics. This is public data. GradFax does not collect this information from users or private sources. Every data point is sourced and citeable.
GradFax Connect: Opt-In Data Sharing
GradFax Connect is an optional feature that lets you share an anonymized version of your profile with universities. You must explicitly opt in. It is never automatic or pre-selected.
What Is Shared
- ✓Academic interests (intended majors, fields of study)
- ✓Geographic preferences (preferred regions, distance from home)
- ✓School size and type preferences
- ✓GPA range (e.g., 3.5-4.0, not your exact GPA)
- ✓Education level (community college, 4-year, graduate)
What Is NOT Shared
- ✗Your name, email address, or phone number
- ✗Your exact GPA, test scores, or transcript data
- ✗Financial information (income, EFC, aid status)
- ✗Your identity (you stay anonymous until you choose to respond to a school)
You can opt out of GradFax Connect at any time from your Profile settings with one click. Your anonymized profile is immediately removed from the Connect pool. No waiting period. When you opt out or delete your account, Connect data is removed within 24 hours. Consent records (opt-in/opt-out timestamps) are retained for up to 3 years for compliance purposes.
Data Retention
Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
Transcript uploads: Processed and immediately discarded. Only analysis results are retained if you have an account.
Analytics data: Retained by PostHog according to their data retention policy. GradFax does not maintain separate long-term analytics archives.
Payment records: Managed by Stripe in accordance with financial regulations. GradFax stores only a transaction reference ID.
Mobile app local data: Stored on your device until you clear the app data, uninstall the app, or delete it within the app settings.
Connect consent records: Retained for up to 3 years for compliance purposes, even after opt-out.
Cookies
GradFax uses essential cookies to keep you logged in and remember your preferences. PostHog uses analytics cookies to understand usage patterns. GradFax does not use advertising cookies or cross-site tracking cookies. You can block all non-essential cookies in your browser settings without affecting core site functionality.
Children's Privacy
GradFax is designed for students aged 13 and older. GradFax does not knowingly collect personal information from children under the age of 13, in compliance with the Children's Online Privacy Protection Act (COPPA) and its 2025 amendments.
Age verification. During account creation, users must confirm they are 13 or older. GradFax does not accept registrations from users who do not confirm this. If GradFax learns that personal information has been collected from a child under 13, that information will be deleted immediately.
No behavioral advertising for minors. GradFax does not use personal information from users under 18 for behavioral advertising, cross-context tracking, or data profiling. GradFax does not sell or share the personal information of users under 18 with third parties for commercial purposes.
Data minimization. GradFax collects only the information necessary to provide the college search service. Optional profile fields (such as ethnicity and gender) are never required and are used solely to improve search relevance when you choose to provide them.
California residents ages 13–15 (CCPA). Under the California Consumer Privacy Act (CCPA), GradFax will not sell or share the personal information of users between the ages of 13 and 15 without their explicit affirmative opt-in consent. This applies to GradFax Connect and any future data-sharing features. If you are 13–15 and located in California, GradFax Connect will require your specific opt-in authorization before any anonymized profile data is shared with universities — separate from the general opt-in required of all users.
If you believe a child under 13 has provided personal information to GradFax, please contact info@gradfax.com and GradFax will take prompt action to remove it.
Your Rights
Delete Your Data
Request deletion of all your data at any time. GradFax will remove it within 30 days.
Export Your Data
Request a copy of everything GradFax has about you in a readable format.
Opt Out of Analytics
Use an ad blocker or browser settings to prevent analytics tracking.
Unsubscribe
Every email has an unsubscribe link. One click and you are done.
Correct Your Data
If something is wrong, contact GradFax and it will be corrected.
Withdraw Consent
You can withdraw consent for any optional data processing at any time, including GradFax Connect.
For California Residents (CCPA)
Under the California Consumer Privacy Act (CCPA/CPRA), you have the right to know what personal information GradFax collects, request its deletion, and opt out of its sale. GradFax does not sell personal information. The only data sharing GradFax offers is through GradFax Connect, which requires affirmative opt-in consent. For users aged 13–15, GradFax requires explicit opt-in before any data is shared through GradFax Connect, satisfying CCPA requirements for minors. GradFax does not use personal information from users under 18 for targeted advertising or data profiling. You can exercise any of your rights by contacting GradFax at info@gradfax.com.
For EU/UK Residents (GDPR)
Under the General Data Protection Regulation, you have rights to access, rectify, erase, restrict processing, and port your data. The lawful basis for processing is legitimate interest (providing the search service you requested) and consent (for email communications and GradFax Connect). You may withdraw consent at any time. Contact GradFax to exercise any of these rights.
Data Security
GradFax uses industry-standard security measures to protect your data. Authentication is handled by Supabase with encrypted credentials. Payments are processed by Stripe, which is PCI DSS compliant. All data is transmitted over HTTPS. While no system is 100% secure, GradFax takes reasonable precautions to protect your information from unauthorized access, alteration, or destruction.
Changes to This Policy
If meaningful changes are made to how GradFax handles your data, this page will be updated and, if you have an account, you will be notified by email before the changes take effect. GradFax will never retroactively change how data you already shared under a previous version of this policy is used.
Contact
Questions about this policy? Want to exercise your data rights? Need something clarified?
info@gradfax.com
GradFax LLC | California, USA
This policy was written by humans for humans. No legal jargon generator was involved.
© 2026 GradFax LLC. All rights reserved.