Your data is yours.

01 · What we collect

When you make an account, we collect what you give us: your name, email, school, graduation year, and (optionally) parent contact. When you use the product, we record what you do inside it — questions answered, words learned, drafts written, majors saved. This is the data that makes the platform useful: without it, Nova can't personalize, the planner can't plan, and the admissions odds engine can't calculate your chances.

We don't track you across the web. We don't load third-party advertising trackers. We use one product-analytics tool (PostHog, self-hosted) to count page views and feature usage; that's it.

02 · What we don't collect

• We don't sell student data, ever.
• We don't share content of your chats with Nova with parents, counselors, schools, or anyone outside our team — except to train safety filters, with all identifying information stripped first.
• We don't use your data to train public AI models. Period.
• We don't load Google Analytics, Facebook Pixel, or any ad-tech.

03 · How we use what we have

Your data powers four things: personalization (your drills, your majors, your plan), your dashboard (XP, streaks, history), your reports (what gets surfaced to you and — only if you opt in — to parents or counselors), and aggregate product improvement (we look at how thousands of students use a feature, never at how one student does).

04 · Who can see what

• You see everything you've ever produced inside Choose and Rise.
• Your parents see only what you've shared with them. Default is a weekly digest: streak, score trend, big milestones. They never see Nova chats, written drafts, or specific drill answers.
• Your counselor sees what you've shared with them, only if you connect your account to a school plan they administer.
• Your school sees aggregate data (how many students are on track, etc.) — never individual records unless you opt in.
• Our team only accesses your individual data with your written permission or when investigating a safety report.

05 · Your rights

You can export every byte of your data, delete your account, and revoke any sharing connection from your settings page — any time, no email required. Account deletion is permanent and immediate. We keep nothing in cold storage after you ask us to delete.

If you're under 13, a parent or guardian must consent before you sign up. We follow COPPA. If you're between 13 and 18, you control your own account; we still notify parents on signup if their email is on file.

06 · Security

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Authentication is handled by Clerk; we never see or store your password. Our infrastructure runs on AWS in US-East regions only — no offshore replicas. We run quarterly third-party penetration tests; if you find an issue, write to [email protected].

07 · Changes to this policy

If we change this policy in a way that materially affects what we do with your data, we'll email you at least 30 days before the change takes effect. We'll never quietly broaden it.

08 · Reach us

General	[email protected]
Privacy / data	[email protected]
Security report	[email protected]
Parents / schools	[email protected]