Privacy Policy

1.1 Profile information you provide: grades and grading scale, test scores (such as SAT, ACT, AP, IB, TOEFL, IELTS, Duolingo English Test), courses, country, citizenship, grade level, intended major, whether you need financial aid, and the colleges on your list.

1.2 Content you write: activities, honors, awards, and essays you choose to add, and the feedback generated for them.

1.3 Optional financial information: a family income range and yearly budget, if you use the cost estimator. We never ask for exact income, bank details, or tax documents.

1.4 Account information: your email address and name (from Google or an email sign-in link), your role (student or parent), and links between parent and student accounts.

1.5 Purchase information: payments are processed by our reseller (see Section 5). We receive your plan, its status and dates, the payer's email, and an order or customer reference. We never receive your full card number.

1.6 Security and abuse-prevention signals: a random device identifier stored in a cookie and a one-way hashed version of your IP address, used only to prevent abuse of free features, trials, and referrals.

1.7 Usage data: pseudonymous product analytics about which pages and features are used (see Section 5), and standard server logs kept by our hosting provider.

1.8 Decision results (optional): if you choose to share them, your admission decisions and academic stats, without your name or email (see Section 6).

If you choose “Continue with Google”, we ask Google only for your basic profile: your name, your email address, and your Google account ID (the standard “openid”, “email” and “profile” permissions). We do not request access to your Gmail, contacts, Drive, calendar, or any other Google data.

How we use it: only to create and sign you in to your ChanceMap account, to recognize you when you return, and to email you about your account (for example sign-in links, receipts, and updates you turn on, like the weekly parent summary).

How we store and protect it: your name and email are stored in our account database (Supabase), encrypted in transit, with access limited to what's needed to run the Service.

Who we share it with: no one, except the service providers listed in Section 5 that host and run ChanceMap on our behalf. We never sell Google user data, never use it for advertising, and never use it to train AI models.

Keeping and deleting it: we keep it while your account exists. Deleting your account (Account → Your data → Delete account) permanently removes it. You can also revoke ChanceMap's access anytime at myaccount.google.com/permissions, or email privacy@chancemap.app to have it deleted.

ChanceMap's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use personal data to: (a) calculate your estimated chances, build your school list and plan, and track deadlines; (b) provide AI feedback on essays and activities you submit; (c) create and run your account, including parent links; (d) process your plan and provide customer support; (e) send service emails, such as sign-in links and updates you choose to receive; (f) prevent fraud and abuse and keep the Service secure; (g) understand how the Service is used so we can improve it; and (h) comply with legal obligations.

We do not sell or rent personal data, do not use it for third-party advertising, and do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. Our estimates are informational only.

Where laws such as the GDPR, UK GDPR, LGPD, or Colombian Law 1581 of 2012 apply, we rely on: performance of a contract (providing the Service you asked for); legitimate interests (security, abuse prevention, and improving the Service, balanced against your rights); consent (for optional features such as sharing decision results and analytics where required, and, for younger users where required, a parent or guardian's consent), which you can withdraw at any time; and legal obligations (such as tax and accounting records).

We share personal data only with service providers that process it on our behalf under contracts that restrict its use, and only as needed for their service:

• Supabase: database, authentication, and account storage.
• Vercel: website hosting.
• Anthropic: AI processing of essays and activities you submit for feedback. Under Anthropic's commercial terms, this content is not used to train its models.
• Gumroad, Inc. and Paddle.com: our authorized resellers and Merchants of Record. They process checkout, payments, subscriptions, receipts, and sales tax, and handle your billing details under their own privacy policies.
• Google: sign-in, if you choose “Continue with Google”.
• Resend: delivery of service emails.
• Cloudflare: email routing for our support addresses and a bot check (Turnstile) on some free features.
• PostHog: pseudonymous product analytics (which pages and features are used), linked to a random account identifier, never your name, email, grades, or essays. No session recordings. You can turn it off in Account → Profile.

Parents and guardians: if a student links a parent account, that parent can see a read-only summary of the student's plan and progress. Either side can remove the link at any time.

Legal and safety: we may disclose information if required by law or valid legal process, or to protect the rights, safety, or property of our users, the public, or ChanceMap.

Business changes: if ChanceMap is reorganized (for example, transferred to a company formed to operate it) or sold, personal data may be transferred to the new operator, which must honor this policy.

You can choose to share your admission results to improve estimates for students like you. This is off by default. If you turn it on, we store the decision, round, and your academic stats with a scrambled identifier, never your name or email. Shared results may be combined into statistics (for example, “students from Colombia admitted to X”) and kept after you delete your account, because they can no longer be linked to you.

The Service is not directed to children under 13, and you must be at least 13 to create an account. Users under 18 should use ChanceMap with a parent or guardian's knowledge, and only an adult may make a purchase. Where the law requires a parent or guardian's consent to process a minor's data (for example, under 16 in some EU countries), we rely on that consent. If you believe a child under 13 has given us personal data, contact privacy@chancemap.app and we will delete it.

ChanceMap is operated from Colombia, and our service providers may process data in the United States and other countries whose data-protection laws may differ from yours. Where required, we rely on appropriate safeguards for these transfers, such as the providers' standard contractual clauses or equivalent commitments.

We keep account data, profile data, and your content until you delete them or your account. Abuse-prevention records (hashed device and IP signals, trial and referral records) are kept for up to 12 months, or longer where needed to prevent repeated abuse. Purchase records are kept as long as tax and accounting laws require. Backups are overwritten on a rolling basis. Anonymized statistics may be kept indefinitely.

We use industry-standard measures, including encryption in transit, row-level access controls on our database, restricted administrative access, rate limiting, and security headers. No method of transmission or storage is completely secure. If we become aware of a breach that affects your personal data, we will notify you and the authorities as required by law.

You can view and edit your profile at any time, export your data (Account → Your data), and permanently delete your account (Account → Your data → Delete account), which removes your profile, essays, activities, and parent links and cancels any subscription renewal.

Depending on where you live, including under the GDPR (EU), UK GDPR, LGPD (Brazil), Colombian Law 1581 of 2012 (habeas data), and U.S. state laws such as the CCPA, you may have the right to access, correct, update, delete, or port your personal data; to object to or restrict certain processing; to withdraw consent; and to know how your data has been used. To exercise these rights, email privacy@chancemap.app from the address on your account. We respond within the time required by applicable law (for Colombian users, within 10 business days for inquiries and 15 business days for complaints). You may also complain to your local data-protection authority; in Colombia, the Superintendencia de Industria y Comercio.

We use only what the Service needs to work: a sign-in session, a device cookie for abuse prevention, browser local storage to save your progress, and pseudonymous analytics (which you can turn off). We do not use advertising or cross-site tracking cookies.

We may update this policy. If we make material changes, we will notify you in the Service or by email before they take effect, and update the date at the top.

Data controller: Juan Carbonell, doing business as ChanceMap, Colombia. Privacy requests and questions: privacy@chancemap.app.

See also our Terms of Service and Refund Policy.