Privacy Policy
In plain English. No legal tricks.
Last updated: October 17, 2026
The Short Version
GradFax Connect activation and partner queries are temporarily paused. Before the pause, the query code was configured to return selected profile fields and a stable pseudonymous identifier to partner accounts. The returned combination may identify a person in context, and its legal classification has not been determined. Use Delete Account in Profile settings to start an account deletion request; provider copies and backups may have separate retention periods.
Why This Matters
College-search services can handle student information in different ways. Review each service's privacy terms to understand its practices and choices.
GradFax currently provides college-search and planning features. Its data practices are described on this page. Do not rely on comparisons with other services as a substitute for reviewing their terms.
What GradFax Collects (And Why)
Account Information
When: You sign up with email/password or Google sign-in.
What: Email address, display name, authentication credentials, and full date of birth for new email signups. The date and birth year are sent in Supabase authentication metadata. Web signups also store the birth year in GradFax account metadata. If you sign in with Google, GradFax receives your name and email from Google OAuth. GradFax never receives or stores your Google password.
Stored: Securely in Supabase (database and authentication provider). You can delete your account at any time.
Search Queries
When: Every time you search for schools.
Why: To return results and improve matching quality over time.
Stored: Processed by the GradFax search engine to find relevant results. Raw search queries are not stored permanently.
Profile Preferences
When: You fill out the student profile quiz or set preferences.
Why: To personalize your search results and match scores.
Stored: On the web, preferences are saved in your browser (localStorage) by default. If you create an account, preferences sync to Supabase so you can access them from any device. On the mobile app, preferences are stored locally using AsyncStorage on your device.
Financial Aid Information
When: You fill out financial-aid profile fields or use the Aid Appeal tool.
What: Family income bracket, Expected Family Contribution (EFC), foster care status, and military family status, if you choose to provide them. If you use Aid Appeal, GradFax also stores the per-school award details you enter: cost of attendance, grants, loans, and appeal status.
Why: To personalize aid-related recommendations and power the Aid Appeal tool.
Stored: In Supabase, same as your other profile data. This information is never shared through GradFax Connect, see that section below.
Saved Schools, Activities, and Checklists
When: You save schools, create activity lists, or use checklists.
Why: So you can come back to them later and track your progress.
Stored: On the web, this data is saved in localStorage by default and syncs to Supabase if you sign in. On the mobile app, activities, checklists, and offline cache data are stored locally on your device using AsyncStorage.
Transcript Uploads
When: You use the transcript analysis feature.
Why: To analyze your academic history and provide course-by-course insights.
Stored: GradFax sends extracted transcript text to OpenAI for parsing into structured academic data. GradFax does not intentionally store the uploaded document as an account record, but provider-side processing, logs, and backup retention have not been independently verified. Analysis results may be stored in your account. Review OpenAI's current terms and privacy materials for provider handling.
Analytics Data
When: You visit pages on the GradFax website.
Why: To understand which features people use so GradFax can improve them.
Stored: PostHog is configured to opt out of capturing by default and begins capturing after you accept analytics. The exact fields and provider retention depend on the deployed configuration. Use Cookie settings to change your choice.
Payment Information
When: You purchase a premium feature.
Why: To process your payment.
Stored: Stripe processes payment details. GradFax may receive and retain transaction, subscription, and billing status information. Review Stripe's current privacy materials for provider handling.
Mobile App Data
Local Storage: The GradFax mobile app stores activities, checklists, offline cache, and notification preferences locally on your device using AsyncStorage. This data stays on your device and is not transmitted to GradFax servers unless you sign in and choose to sync.
API Communication: The mobile app sends an API key header with requests for rate limiting purposes. This key identifies the app, not you personally.
Notification Preferences: If you enable push notifications, your preference is stored locally on your device. You can change notification settings at any time through your device settings or within the app.
How GradFax Uses Your Information
- 1.Provide the service. Search results, saved schools, transcript analysis, personalized recommendations.
- 2.Improve the platform. PostHog analytics may help GradFax understand feature use after you accept analytics in Cookie settings. We have not established that all resulting analytics data is anonymous.
- 3.Communicate with you. Account confirmations, feature updates, and scholarship deadline reminders (only if you opted in).
- 4.Process payments. Through Stripe, only when you purchase a premium feature.
- 5.Prevent abuse. Rate limiting and API key validation protect the platform from misuse.
What GradFax Does Not Do
Offer a direct sale of personal information through the consumer site. GradFax Connect separately makes selected fields available to partner schools after opt-in; its legal classification has not been determined.
Share the listed Connect profile details with schools unless you opt in through GradFax Connect. The profile omits the listed direct identifiers, but we do not claim it is anonymous.
Intentionally store the uploaded transcript document as an account record. Provider-side processing and retention have not been independently verified.
Let schools pay to access your profile without your permission.
Use dark patterns or manipulative design to trick you into sharing more.
Third-Party Services
GradFax uses the following third-party services to operate. Each has its own privacy policy:
These providers process information to support GradFax features. The source review did not verify every provider agreement, data-processing term, or downstream retention setting. Consult each provider's current privacy materials and GradFax's applicable agreements.
College Data Sources
College and university information displayed on GradFax is compiled from public sources, including government data such as the Integrated Postsecondary Education Data System (IPEDS). Sources and update dates vary by field. Check the cited source and the institution for current details.
GradFax Connect: Opt-In Data Sharing
GradFax Connectactivation and partner queries are temporarily paused. The former partner query code returned the fields listed below with a stable pseudonymous Connect ID. It omitted selected direct identifiers, but the remaining fields could identify someone in context. GradFax has not determined the feature's legal classification or verified a complete partner-use and retention framework.
What Is Shared
- ✓Stable pseudonymous Connect ID
- ✓GPA range, education level, graduation year, and community-college status
- ✓Intended major, recommended majors, and transcript rigor score
- ✓School type and size, preferred states, climate, and distance preferences
- ✓Interests, extracurriculars, sports, career goals, and STEM confidence
- ✓First-generation status and related support needs
- ✓LGBTQ support need, mental-health priority, religious-services need, and home state
What Is NOT Shared
- ✗Your name, email address, or phone number
- ✗Your exact GPA, test scores, or transcript data
- ✗Financial information (income, EFC, aid status)
- ✗Name, email address, and phone number
- ✗Exact GPA, test scores, and financial information listed below
Existing users can turn off their current Connect status from Profile settings. That status change excludes them from future queries when the query service is enabled, but does not delete prior results, logs, provider copies, or backups. New activations and partner queries are paused. A separate immutable consent-history log and fixed retention period have not been verified.
Data Retention
Account data: Retained while your account is active. The account deletion feature attempts to remove records from identified application tables and then delete the sign-in account. The source review did not verify a fixed deletion schedule for every provider copy or backup. If the deletion request reports a problem, contact support.
Transcript uploads: GradFax does not intentionally store the uploaded document as a user record. Provider processing and retention have not been independently verified. Analysis results may be retained in your account.
Analytics data: Retained by PostHog according to their data retention policy. GradFax does not maintain separate long-term analytics archives.
Payment records: Stripe processes payment details. GradFax may retain transaction, subscription, and billing status records; retention periods have not been verified here.
Mobile app local data: Stored on your device until you clear the app data, uninstall the app, or delete it within the app settings.
Connect consent: The application stores the current opt-in status and timestamp in account metadata. A separate immutable consent history and fixed retention period have not been verified.
Cookies
GradFax uses essential cookies to keep you logged in and remember your preferences. PostHog analytics cookies only turn on if you accept them in the cookie banner shown on your first visit, GradFax does not use advertising cookies or cross-site tracking cookies. You can decline in the banner and reopen Cookie settings from the floating button on the site to change your choice. You can also block non-essential cookies in your browser settings, without affecting core site functionality.
Children's Privacy
GradFax is intended for people age 13 and older. The current signup flow does not provide a verified parental-consent path for children under 13. Do not sign up if you are under 13.
Age notice. Email signup screens ask for a full date of birth and check that the person is at least 13. A database guard has been prepared to reject new accounts with missing, invalid, or under-13 dates, but it has not been applied. Once it is applied, new Google or Apple accounts cannot complete signup without a supported date-of-birth flow; existing Google or Apple accounts can still sign in. GradFax does not provide a verified parental-consent path for children under 13. If a child under 13 has provided information, contact us so the request can be reviewed.
Advertising. GradFax does not currently describe a targeted advertising feature. The source review did not establish age or residency verification for every user or a complete legal assessment of advertising-related obligations.
Data minimization. Some profile and planning fields are optional. The information requested depends on the features you use; see the sections above for examples.
California residents ages 13-15. California privacy rules can require affirmative authorization for certain sale or sharing involving consumers ages 13-15 when a business has actual knowledge of age. Before the pause, GradFax Connect asked for a self-attested age confirmation and separate sharing consent. The current source review did not verify age or California-residency checks, or establish that the flow meets every applicable legal requirement. Connect is currently paused. Do not use GradFax if you are under 13. If you are under 18, discuss use with a parent or guardian.
If you believe a child under 13 has provided personal information to GradFax, contact josh@gradfax.com so we can review the request and take appropriate action.
Your Rights
Delete Your Account
Use Delete Account in Profile settings. If the request reports a problem, contact josh@gradfax.com. Provider copies and backups may follow separate retention periods.
Export Your Data
Contact josh@gradfax.com to ask for an export. The available export may not include every record or media file.
Change Analytics Choice
Use Cookie settings on the site to change your PostHog choice.
Email Preferences
Contact josh@gradfax.com to ask about stopping optional email.
Correct Your Data
Contact josh@gradfax.com to ask us to correct information.
Withdraw Consent
You can withdraw consent for any optional data processing at any time, including GradFax Connect.
For California Residents (CCPA)
California privacy rights may include rights to know, correct, delete, and opt out of certain uses or disclosures, depending on the person and processing. GradFax does not currently claim that its source review establishes compliance with every CCPA/CPRA requirement. GradFax Connect asks for affirmative opt-in consent, but the source review did not verify age and California-residency checks or determine whether the feature constitutes a regulated sale or sharing. Contact josh@gradfax.com to submit a privacy request.
For EU/UK Residents (GDPR)
If the General Data Protection Regulation or UK data-protection law applies to you or a processing activity, you may have rights to access, rectify, erase, restrict processing, object, and port data. The lawful basis, territorial scope, and handling process depend on the facts and require a separate legal determination. Contact GradFax at josh@gradfax.com to submit a request.
Data Security
GradFax uses Supabase for authentication and data services, and Stripe for payments. This source review did not verify the deployed security configuration, access controls, encryption settings, incident procedures, or provider agreements. No online service can guarantee security. Contact GradFax at josh@gradfax.com to report a concern.
Changes to This Policy
GradFax may update this policy as its practices change. The effective date will be updated when the policy changes. Where required, GradFax will provide notice or obtain consent before a material change takes effect.
Contact
Questions about this policy? Want to exercise your data rights? Need something clarified?
josh@gradfax.com
GradFax LLC | California, USA
This policy was written by humans for humans. No legal jargon generator was involved.
© 2026 GradFax LLC. All rights reserved.