Privacy policy

The short version

• We collect what the admission model needs, plus an email address so you can sign in.
• The site runs on Vercel's servers and its database is held by Supabase, so your data is stored on and passes through their systems. See where it is stored.
• Apart from that hosting, one company outside this one receives anything, and it receives only your email address: Resend, which sends you verification and password-reset emails. This site is not sending email yet, so for now it receives nothing. Your essays are not sent anywhere unless you press the button on a draft that asks for an AI second opinion: that sends the prompt and that draft, once, to Cloudflare Workers AI, which says it does not keep or train on them. See the second opinion below. An earlier version sent drafts to Google for coaching; that was removed, and it is described below rather than quietly dropped.
• Signing in with Google is optional. If you choose it, Google tells us your email address and an identifier for your Google account, and learns that you signed in to Northstar. We send Google nothing about you. See signing in with Google.
• Ethnicity is optional and changes nothing about your estimate at all. Household income band is optional and does not move your estimate either — but it does narrow the range around it, so it is not true to say it changes nothing. An earlier version of this page said both fields changed nothing. That was half right, which is the same as wrong.
• We do not sell or share your data, and there is no advertising and no tracking cookie. We count visits anonymously, without cookies, to see which pages are used.
• You can export your data or delete it permanently at any time, from your profile page.
• Deletion is immediate and irreversible — not a 30-day queue. Two operational tables are not swept by it, and they are named under how long we keep it rather than glossed over.

Who we are

Northstar provides college admission estimates and essay coaching. You can reach us at northstar.collegeapp@gmail.com. If you are running this software yourself, you are the data controller and should replace that address (in lib/contact.ts) with your own and, where required, name a data protection contact.

How to reach us

Email northstar.collegeapp@gmail.com. There is no contact form, no phone number and no postal address; that inbox is the one way to reach a person. Until October 2026 there was not even that, and this page said so rather than telling you to “contact us” somewhere that did not exist. Here is what to use for what:

• Everything you can do yourself, you can do now. Signing other devices out, editing every academic field, downloading your data and deleting your account are all buttons on your profile. None of them require asking permission or waiting. Two things are switched off for now: changing your password, and resetting one you have forgotten. Both finish by sending you an email, and this site cannot send email yet.
• Everything that needs a person goes to that address. Changing the email address on an account, asking us to delete an account you cannot sign in to (or a child's), a guardian exercising a right on a child's behalf, a suspended account, reporting a security vulnerability, or lodging an objection. If it is about an account, write from the address on that account if you can, so we know it is yours.

What we collect

Information you give us

Written out field by field, from the database schema rather than from memory. An earlier version of this list described about half of it; the version before this one was closer but still missed whether you are applying for financial aid, which the model does read.

• Account: email address, a hashed password, optionally a first name. If you signed up with Google instead, there is no password: we hold the identifier Google gives us for your account, so that we recognise you when you come back.
• Birth year: used solely to apply the right protections for minors (see below). Not used in the model. We ask for the year and nothing finer, deliberately, so that we hold less about a child — see the limitation that causes under if you are under 18.
• Guardian email: only on accounts created before we made birth year a required question, and only where one was given. We no longer ask for it — see if you are under 18.
• Grades and tests: unweighted GPA; if you typed it on another scale, the figure you typed and which scale; weighted GPA and its scale; SAT best single sitting and SAT superscore; ACT composite; class rank percentile; graduation year. Per saved college, whether you have marked it as reading the single sitting.
• Where you are applying from, and to: country of residence, US state of legal residence, whether you are a US citizen or permanent resident, and which countries you told us you are applying to. The last of those is immigration status, and we ask it because it decides whether you are read in the domestic or international applicant pool — which genuinely changes the estimate.
• Whether you will be applying for financial aid. A single checkbox, and a real input to the model: most selective US colleges are need-blind for domestic applicants so it barely moves a domestic estimate, but nearly all are need-aware for international applicants, where it is a substantial factor. This was missing from earlier versions of this list, which is exactly the kind of omission that matters — a field that changes your number should never be an undisclosed one.
• Your school and curriculum: the name, city, state and country of your high school; which curriculum you follow (AP, IB, A-Level or other); every course you add, with its level, the year and the result you report for it; and, for IB, your Extended Essay and Theory of Knowledge grades, whether CAS is complete, the bonus points that follow from those grades, and whether you are registered for the full Diploma. We also store a slug derived from your school's name and state, so that two spellings of the same school group together.
• Context you tick: whether you will be the first in your family to attend a four-year college, whether a parent attended a college on your list, and whether a coach is recruiting you.
• Activities: the name of each one, an optional description, the Common Application category, the role title you type, plus structured details (scope, level of responsibility, years, hours per week, recognition).
• Honours: the title, the level of recognition, the grade level you were in, and the school year.
• When you asked for essay measurements: a timestamp each time, and nothing else — not which draft.
• Saved colleges: which ones, your own priority order, the application round, the programme you are applying to at each, any free-text note you attach to one, the result you record and when you recorded it, which one you commit to, and which planner to-dos you have ticked for each.
• What you want from a college: your stated field, budget, preferred size, regions, setting and priorities, stored so the matcher can be re-run.
• Essays: the prompt, which college it belongs to if you picked one, the word limit, your draft, and any coaching feedback generated on it.
• Sessions: a random session identifier, when it was created and when it expires, and the browser user-agent string it was created from.
• Password reset and email confirmation requests: which kind it was, when it was issued, when it expires, and when it was used. The link itself is never stored — only a SHA-256 digest of it, so a stolen backup yields useless hashes rather than working reset links.
• Account status dates: when you signed up, when your address was confirmed, when a guardian consented, and when you finished or skipped the intro tour.

Things you choose to turn on

• Contributing to your school's totals. Off unless you turn it on. When it is on, the application rounds and results you have recorded are counted into anonymous totals shown to other students from the same high school. See who we share it with — this is the only way any of your data reaches another student, and it is worth reading before you enable it.

Two optional fields, and they are not the same as each other

Both can be left as “Prefer not to say”. Neither is an input to the probability. But only one of them genuinely changes nothing, and an earlier version of this page put them in the same sentence and told you both were inert. That was wrong about income, so they are separated here.

• Ethnicity — changes nothing, and that is testable. Used for exactly one thing: showing how a campus's student body actually breaks down, next to the cost figures on each college page. An earlier version of this page also claimed it fed the essay guidance. It does not, and never did — nothing in the essay coach reads it. It has no effect on your estimate either: a test in our suite asserts byte-for-byte identical probabilities and identical ranges across every category at every level of selectivity, and fails the build otherwise. Since Students for Fair Admissions v. Harvard (2023) US colleges may not weigh it either.
• Household income band — does not move your estimate, but does narrow the range. One of five bands, matching the ones the federal net-price data is reported against. It is what lets us show what a college would actually cost a family like yours instead of the sticker price, which is fiction for most people. We store which band you picked, never a figure. What the old wording got wrong: the model counts how many of its inputs you have supplied, and widens the confidence interval for each one that is missing. Income band is on that list. So filling it in leaves your percentage where it was and pulls the range in around it — and because the tier label (safety, likely, target) is read off the bottom of that range, it can move the label too. Leaving it blank costs you precision, not odds. That is a different sentence from “without changing a single number”, and the old one should not have been there.

An earlier version of this page said we collected neither field. That was wrong from the day we added the net-price and campus-breakdown features, and it stayed wrong for months. We have corrected it here rather than quietly deleting the sentence.

Information we do not collect

We do not ask for or store your gender, religion, disability, sexual orientation, street address, or phone number. The model does not use any of them, so collecting them would be gathering sensitive information about young people for no purpose.

Collected automatically

One cookie. northstar_session keeps you signed in. It contains a random session identifier, is HttpOnly (JavaScript cannot read it), signed, SameSite=Lax, Secure in production, and expires after 30 days. We store the browser user-agent string alongside the session. Your profile now tells you how many other devices are signed in and lets you sign them all out, but it does not show you that string — so it is still held and not shown to you, which is worth saying plainly rather than describing as a feature.

Things kept in your own browser. ns-theme in localStorage remembers whether you chose light or dark, so the page does not flash the wrong one before it loads. Colleges you temporarily hide from a list are kept in sessionStorage and are gone when you close the tab. Neither of those ever reaches the server. If you use the quick check on the home page and then choose to save it, the college and the grades you typed are kept in sessionStorage until you create your account, are then saved to it, and are removed from your browser. If you don't sign up, they are never sent to us and are gone when you close the tab. None of these is a tracker, and clearing your site data removes them.

Rate-limit counters, which do hold identifiers. To stop password guessing and bulk account creation, we count attempts in a database table keyed by what is being limited. Those keys embed real identifiers: your email address for sign-in attempts and password reset requests, your IP address for sign-ins, new accounts and reset requests from a network (IPv6 addresses are truncated to a /64 prefix first), and, for the few limits on things you do while signed in, a digest of your account id rather than the id itself. The rows hold a count and a time window and nothing else — no passwords, no indication of whether an attempt succeeded, and no link to your account record. They are cleared on a 24-hour cut-off, but only opportunistically, whenever somebody signs in or signs up; there is no scheduled sweep, so on a very quiet instance they sit there longer. They are also not touched when an account is deleted. See how long we keep it.

Anonymous visitor counts, and nothing else of the kind. We use Vercel Web Analytics to count page views. It sets no cookie and stores nothing in your browser. For each page view it records the page address, the referring site, the browser, operating system and device type, and the country, worked out from your IP address; Vercel says it does not store the IP address itself. Visits are grouped using a value derived from the request that Vercel discards after a day, so we can count visitors without being able to recognise anyone. Before anything is sent, this site removes the parts of an address that are about you: everything after a “?” (which on password-reset and email links is a one-time code) and the id of an essay draft. It is never linked to your account, and we see only totals. Vercel already hosts the site, so this adds no new company (Vercel's note on it).

No advertising, and no third-party tracking scripts. The Content-Security-Policy this site sends actively blocks them: scripts and network connections from the browser are restricted to this origin, which is also where the visitor counts are sent.

Why we use it, and on what basis

• Your academic profile — to compute admission estimates. This is the service you asked for (contract).
• Email and password — to give you an account you can return to (contract).
• Birth year — to comply with laws protecting minors (legal obligation).
• Essay drafts — to generate coaching feedback at your request (contract).
• Rate-limit counters and the audit trail — to keep accounts from being broken into and to detect misuse of staff access (legitimate interests).

If you are under 18

Most people using this are minors, which changes what we owe you.

• Under 13: Northstar is not available to you. Signup is refused outright, and no account is created.
• 13 and over: you can use Northstar on your own. We do not ask for a parent or guardian's email address, we do not email one, and nothing here waits on a grown-up's permission.

This changed, and it is worth being straight about what changed. Northstar used to require a parent or guardian to confirm by email before it would store anything about a student under 16. That requirement has been removed: 13-to-15 year olds now use the product exactly as older students do. The machinery that enforced it is still in the code and still refuses to store anything for an account it cannot put an age to — see the next paragraph — but being under 16 no longer triggers it. If you hold an older account where a guardian was asked and confirmed, that record stays on your account and is listed above.

What we still refuse. A handful of accounts were created before we made birth year a required question, so we do not know how old those people are. Because Northstar is not available to under-13s, an account we cannot put an age to is treated as a child's rather than an adult's: we will not store grades, courses, activities, match preferences or essays on it. Reading, exporting and deleting stay open, because someone who cannot consent to us holding their data must still be able to leave and take it with them.

A known limitation of the age check, stated rather than papered over. We hold your birth year and not your birth date, so we work out your age by subtracting one from the other. That treats you as having already had this year's birthday. A 12-year-old who turns 13 in December therefore reads as 13 from January, and could sign up a few months early. We ask for the year and nothing finer on purpose — computing a real age means asking every child for a full birth date, which is more information about them, not less — and subtracting another year would wrongly refuse genuine 13-year-olds for months. It has not been decided which to do.

If you believe a child under 13 has created an account, email northstar.collegeapp@gmail.com and we will look at it.

Who we share it with

One company, apart from the hosting described under “Where it is stored”. We do not sell data, do not share it with advertisers, and do not send it to data brokers. Apart from the anonymous visitor counts described above, which go to our host, nothing about you is sent anywhere by your browser: the one transfer below happens server-side.

Your essays stay on this server unless you ask for the second opinion

An earlier version of Northstar sent the full text of a draft to Google's Gemini API when you asked for coaching on it. That is gone. Every measurement you see on an essay — rhythm, passive voice, clichés, concreteness, how long you spend setting up before you start thinking, the checklist score — is computed on this server, and no draft of yours leaves it for any of that. We do not use your essays to train anything, and we have nothing to train.

One button sends a draft out, and only when you press it. On a draft, “Get a second opinion” sends the prompt and the text of that draft, as it is at that moment, to Cloudflare Workers AI (Cloudflare, Inc.), which runs a language model on it and returns comments: what a stranger takes the essay to be about, whether it answers the prompt, its strongest and weakest moment, questions, one next step. Nothing else about you goes with it — not your name, email, age, school or grades. Cloudflare's Workers AI privacy page states that it does not use what is sent to train models and does not keep it after the reply; it does not say where in the world the model runs, and it does not say whether a person could ever read it. We store the comments it returns, beside your draft, until you delete the draft or the account. Five a day for one account, fifty a day for the whole site. If you never press the button, nothing you write leaves this server.

We are saying what it used to do rather than quietly having always been this way, because the second version is the one you cannot check.

Resend — the emails we send you

Every email this product sends goes through Resend (api.resend.com): password resets, email confirmation, the notice that your password was changed, and — only for an account whose age we cannot confirm, which is now the sole case that asks anyone for permission — the guardian consent request. Resend receives the recipient's address and the full text of the message. On that last one the text includes the student's own email address, because a parent being asked for permission has to be told which account it is about, so two addresses reach Resend rather than one.

It is sent nothing else: no grades, no essays, no college list. This site has no Resend key at the moment, so none of that is happening: no email leaves the server, Resend receives nothing, and the things that need an email — resetting a forgotten password, changing one, confirming your address — are not offered until it does.

Google — only if you choose to sign in with it

Signing in with Google is offered beside the ordinary email-and-password form, and nothing here requires it. If you use it, your browser goes to Google, you choose an account there, and Google sends us two things: your email address, and a number that identifies your Google account. We ask Google for nothing else — not your name, your photo, your contacts or your calendar, and no permission to ask about you again later. We never see your Google password.

In the other direction we send Google nothing about you: no grades, no college list, no essays. Google does learn that your account was used to sign in to Northstar, and when. That is true of signing in to anything with Google, and what Google does with it is governed by Google's privacy policy rather than this one.

Google does not tell us your age, so we still ask for your birth year before the account is created, and the under-13 rule applies exactly as it does on the ordinary form.

If you already have an account with a password, you can connect Google to it from your profile page, and disconnect it again there. Connecting works only with the Google account for the email address already on your Northstar account, and it marks that address as confirmed.

Other students from your school, if you opt in

This is the only route by which anything of yours reaches another user, so it is spelled out in full. If you turn on contributing, the colleges you have recorded a result for — and what that result was — are counted into totals shown to other students who have entered the same high school. What travels is a count, never a row: no name, no email, no grades, no test scores, and no indication of which student any figure came from.

Three protections, and one honest limit. A school's figures stay hidden entirely until at least five students have contributed, from accounts at least a week old — the week is there because signing up is free, and five accounts made in an afternoon must not be enough. A college's row is shown only when three or more of those students reported on it, because “1 applied, 0 admitted” from a named school identifies a real person; colleges with fewer are counted but not listed. And the aggregation runs on the server, so a suppressed figure is never sent to the browser in the first place. The limit: a determined classmate who kept several accounts for a week could still narrow the totals, and nothing short of verified identity would stop that. We would rather say so than imply the floor is a wall.

It is still worth understanding what you are agreeing to: a rejection you record becomes part of a number your classmates can see. Turning it off stops your rows being counted from that moment.

Legal obligation

If we were legally compelled to disclose data, we would comply, and would notify you unless legally prohibited.

Not processors, despite appearing in the code

Northstar's college figures come from the College Scorecard, the Department of Education's data APIs and the Urban Institute. Those are downloaded by a script when the data is refreshed, before anyone visits the site. They receive nothing about you, and they are not third parties your data reaches.

Where it is stored

The site runs on Vercel's servers and its database is held by Supabase, so your data is stored on and passes through their systems. That covers everything listed on this page: your account, your profile, your college list and your essays.

Supabase offers every project a public data interface. Ours is closed: every table has row-level security switched on with no rule granting access, so that interface returns nothing, and the database is reached only by this application's own server. That is checked each time the site is deployed, and the deployment is refused if any table fails it.

How long we keep it

• Account and profile: until you delete it. A staff member can also delete an account, or suspend one — see what staff can see and do.
• Sessions: a session stops working 30 days after it is created, and the expired row is deleted the next time it is presented or the next time anyone signs in. There is no scheduled sweep, so on a very quiet instance an expired — and already unusable — row can sit in the table for a while.
• Reset and confirmation links: a reset link lasts an hour and a confirmation link a day; both stop working the first time they are used. The record that one was issued is removed about a week after it expired, or a day after it was used, whenever someone next asks for one; there is no scheduled sweep.
• Deleted accounts: your account row and every table keyed to it — profile, courses, honours, activities, saved colleges, essays, feedback, sessions, token records — are hard-deleted the moment you confirm. Immediately, irreversibly, no queue and no archived copy. Two things are not swept with them, and both are named below rather than left for you to find out.

Some rate-limit counters survive deletion. The counters for things you do while signed in — exports, confirmation emails, password changes — are keyed by a digest of your account id, and the purge removes them. The counters keyed by your email address or your network address are not linked to the account and the purge does not find them; such a row can outlive your account until the next sign-in attempt on the instance clears rows older than a day. That is a real gap, not a design decision.

Staff audit entries survive deletion, without you in them. If a staff member ever changed your account — switched the comparison and export tools on or off, signed it out, suspended or restored it, or deleted it — that is recorded: who did it, what they did, and when. Deleting your account sets the reference to you in that row to null, so what is left says an operator did something to an account that no longer exists. The row itself stays, and it stays on purpose. That log exists to make staff misuse against a student detectable, and letting the subject's own deletion erase it would mean the record of someone being wronged disappears at exactly the moment it matters. It holds no grades, no essays and no profile data — only the operator, the action and the timestamp.

Your rights

Depending on where you live you may have rights under the GDPR, the UK GDPR, the CCPA/CPRA, or similar laws. We provide these to everyone regardless — except where we say below that something works differently.

• Access and portability — download your data as JSON, in one click, from your profile. It covers your account record, profile, courses, honours, activities, saved colleges, essays, coaching feedback, sessions, and the record of any reset or confirmation link. Four things are deliberately withheld and we would rather name them than write “everything we hold” and leave it at that: your password hash and the digests of reset links, because handing you a crackable hash of your own password in a file you will email to yourself helps nobody; the session identifiers themselves, which are part of your sign-in cookie, so the file lists when and on what browser each sign-in happened without them; a few account-status flags such as whether your address is confirmed or whether the comparison and export tools are switched on for the account; and the two tables described under how long we keep it. A test in the suite fails the build if a new table holding your data is added without appearing in this file.
• Correction — every academic and background field on your profile can be edited at any time. Your password cannot be changed at the moment, and a forgotten one cannot be reset: both end by sending you an email, and this site cannot send email yet, so both are switched off rather than left to fail. They come back when it can. Your email address cannot be changed from the site either — there is no screen for it. Email northstar.collegeapp@gmail.com from the address on your account and we will change it by hand.
• Deletion — erase your account and all associated data immediately, from your profile, subject to the exceptions named above. One more exception, stated rather than hidden: a suspended account cannot sign in, so it cannot export or delete itself; it stays as it is until staff restore it or delete it. If yours is suspended, email northstar.collegeapp@gmail.com from its address to ask for either.
• Objection and restriction — you can stop using the service and delete everything, and both are one click. Anything short of that — objecting to a particular use while keeping your account — email northstar.collegeapp@gmail.com.
• Complaint — you may lodge one with your local data protection authority.

Go to your profile to export or delete your data →

Security

• Passwords are hashed with scrypt (N=2¹⁷, r=8, p=1) and never stored or logged in plain text.
• Session cookies are HttpOnly, SameSite=Lax, signed, and Secure in production.
• A strict Content-Security-Policy with per-request nonces blocks injected scripts.
• The site sends X-Frame-Options: DENY, so it cannot be embedded and clickjacked.
• Every query made on your behalf is scoped to your own account on the server. A previous version of this list stopped at that sentence, which read as a promise that nobody can see across accounts. That is not true, and the exception is described immediately below.

Staff can see account-level data. Here is exactly what.

There is a staff console. It is not linked from anywhere, it answers 404 to everyone who is not staff, and it deliberately reads across every account — an operator who cannot answer “what happened to this person” cannot run the service. What it lists, for every account:

• Email address and first name.
• When the account was created, and whether and when the address was confirmed.
• How many colleges are saved — a count only. Not which ones.
• How the account signs in — with a password, with Google, or both. Not the password, which nobody here can see.
• How many devices are signed in to it at the moment — a count only. Not which devices, or where.
• Whether it is a staff account, and whether it has been suspended.

What it does not show, and what the query behind it does not even select: your grades, test scores, courses, activities, honours, essays, coaching feedback, match preferences, ethnicity, income band, guardian's address or password hash. There is no screen anywhere in the product that shows an operator another person's essay or academic record.

A staff member can do three things to an account, and nothing else:

• Sign it out of every device. You can sign straight back in.
• Suspend it, which signs it out and stops it being signed in to. Nothing is deleted, and restoring it puts everything back exactly as it was.
• Delete it. That is the same permanent erasure as deleting it yourself: the account and everything in it, with no archived copy.

Every one of those makes an account harder to reach, or removes it. None of them opens it: a staff member cannot read your data, cannot set or see your password, and cannot sign in as you. They cannot make another staff member either; that needs shell access to the machine holding the database. Every privileged write, including a refused one, is recorded against the operator who attempted it in a log that the console itself cannot edit or delete.

No system is perfectly secure. If you find a vulnerability, please report it privately rather than disclosing it publicly, to northstar.collegeapp@gmail.com.

Changes to this policy

If we change it materially — particularly anything about what we collect or who we share it with — we will say so prominently in the product rather than silently updating the date at the top.