Privacy Policy

Effective October 18, 2026

Admitly ("we", "us") helps high school students practice for the SAT and plan for college. Most of our users are teenagers, so we collect as little as we can, never sell it, and give students control over who sees their information. This policy explains exactly what we collect and why.

Who can use the site

You must be 13 or older to create an account. When you sign up we ask for your date of birth and check it. We do not store the date itself, only that you passed the check and when. If you sign up with Google, we ask for your date of birth right after, and if you are under 13 we delete the new account immediately. We do not knowingly collect information from children under 13. If we learn that a child under 13 has created an account, we will delete it. If you believe this has happened, email us at privacy@admitly.xyz.

What we collect

• Account information: your email address, your password (stored only as a secure hash we cannot read), whether you signed up as a student or a parent, and when you passed the age check.
• If you sign in with Google: Google tells us your email address, your name, and the link to your Google profile photo. Our sign-in provider (Supabase) stores these with your account. We use only the email address to run your account.
• Profile, if you add it: the name you want us to use and a profile photo. Both are optional.
• Student details, if you add them: your high school, graduation year, GPA, target SAT score, test date, latest Math and Reading and Writing scores from a past SAT, the date you took it, the domain results from that score report (how many of the 7 bars were filled in for each area), the days you study, how many hours you study per week, and any extra test time you are approved for. Every field is optional. We use these to show your goals, build your study plan, and time your practice tests.
• Practice activity: which questions you answered, the answer you chose, whether it was correct, whether it was your first try at that question, how long you spent on it, and when. We use this for your study plan, your progress charts, and practice rewards. If you reset your progress, we keep only a list of which questions you had already answered (not your answers), so those questions don't count as new for rewards. It is deleted with your account.
• College list, if you use it: the colleges you add (and, when you pick one from our list, which college it is), your application plan and deadline for each, its status and priority, which checklist items you have finished, and any notes you write. Only you can see it; linked parents cannot. The college facts we show (location, size, admit rate, cost) come from the U.S. Department of Education College Scorecard and the high school list comes from the National Center for Education Statistics. We download that public data ourselves; your searches and your information are never sent to them.
• Saved questions: which questions you chose to save, and when. Only you can see them.
• Practice tests: which of the five tests you took, which questions it gave you, your answers, how many seconds you spent on each question, which module you reached, and when you started and finished. We use this to build the next module, show your estimated score and time per question, and let you review the test. Your timer and in-progress answers are saved in your browser until you submit a module.
• Stored only in your browser: your light or dark theme choice, your best vocab match time, and your best question rush scores. These never leave your device.
• Vocabulary progress: which words you have reviewed, whether you got each one right, how many times and when you last missed it, when each one is due again, and any words you save. Only you can see it.
• Subscription, if you start one: which plan you chose, whether you are in the 7-day free week, its status, its renewal or end date, who paid (you or a linked parent), and the customer ID that Stripe gives us. You enter a card when the free week starts. If you earn a practice reward, we record which reward, when you earned it, and which renewal invoice it was used on, and we add a matching percent-off coupon to that invoice in Stripe. Rewards are worked out from your practice activity above; logins are not tracked for them. Your card number and billing details go straight to Stripe. We never see or store them.
• Email preference: whether you turned on emails about new features (off unless you turn it on in Settings) and a random code used in the unsubscribe link of those emails. We do not send feature emails today. Account emails, like password resets, are always sent.
• Transcripts you upload: the file itself (PDF, PNG, or JPEG) and its file name.
• Family links: which parent accounts you have approved, and a private invite code assigned to student accounts.
• Technical data: a login cookie that keeps you signed in, and standard request logs (such as IP address, browser type, and time of request) kept by our hosting and database providers for security and troubleshooting.
• Saved in your browser: your light or dark theme choice, the answers and timer for a practice test module you are still working on (so a refresh doesn't lose them), and your best Question rush score and best vocab Match time. We only get your test answers when you submit the module; the copy in your browser is a backup. The rest never leaves your device. Clearing your browser data removes all of it.

We do not keep your birth date, and we do not ask for your home address or phone number. We do not use advertising cookies or third-party advertising pixels. We count page visits and measure page speed with Vercel's own tools, described under Service providers. They set no cookies and do not identify you.

How we use it

Only to run the site: to sign you in, grade your practice answers, show your progress and mistakes, store your files, build your study plan, manage subscriptions, show approved parents your progress summary, keep the service secure, and respond when you contact us. We do not use student information for advertising, and we do not build profiles to sell or share.

Who can see your information

• You. You can see everything in your account.
• Parents you approve. A parent can request a link using your invite code, but sees nothing until you approve. After that they see only your name if you added one (otherwise your email address), how many questions you have answered, your percentage correct for each section, and whether you have a plan (so they can pay for one). They cannot see your photo, your student details, individual answers, or your transcripts. You can remove a parent at any time from Account, then Family.
• Our service providers, only as needed to run the site (listed below).
• Authorized staff, only when needed to operate or secure the service, or to answer a request from you.
• Legal requirements. We may disclose information if required by law, or to protect someone's safety.

We do not sell personal information, and we do not share it for targeted advertising.

Service providers

• Supabase stores our database, handles sign-in, and stores uploaded files.
• Resend sends account emails, such as sign-up confirmations and password resets. It receives your email address and the content of those emails, nothing else.
• Desmos provides the graphing calculator on math questions. When you open it, your browser loads it from desmos.com, which receives standard request data. We do not send Desmos your account information.
• hCaptcha (Intuition Machines) runs a security check on the sign-up, log-in, and password reset forms to block automated abuse. It receives standard browser and request data, not your account information.
• Google handles sign-in if you choose "Sign in with Google". Google learns that you signed in to Admitly. We do not send Google your practice data.
• Vercel hosts the website and keeps request logs. Vercel Web Analytics counts page visits: the page address, the page you came from, your country, and your browser, operating system, and device type. It uses no cookies and tells visits apart with a code made from your request that changes every day, so it can't follow you over time or across sites. Vercel Speed Insights measures how fast pages load on your device. Neither gets your account information, and we use them only to improve the site.
• Stripe processes subscription payments. On Stripe's checkout page you give Stripe your card and billing details directly, and we send Stripe the payer's email address. Stripe handles that information under its own privacy policy.

We do not currently use AI providers. Before we add one, we will update this policy to name it and explain what it receives. Transcripts will never be sent to an AI provider without your separate permission.

Transcripts

Transcripts and profile photos are stored in private storage that only your account can access. They are never given a public link. When you view one, we create a download link that expires after a short time. You can delete any transcript at any time.

How long we keep it

We keep your information while your account exists. When you delete your account, any subscription is cancelled, and your profile, photo, student details, practice history, vocabulary progress, subscription record, transcripts, and family links are deleted immediately. Stripe keeps its own payment records as required by law. Copies may remain in encrypted backups for a limited time until those backups are overwritten.

Your choices and rights

• Delete your account yourself from the Account page.
• Get a copy of your information, or ask us to correct it, by emailing us.
• Parents and guardians of a student under 18 may contact us to review or delete their child's information, even without a linked parent account. We will verify the request before acting.
• Depending on where you live (for example, California), you may have additional rights to know, access, correct, or delete your information. We honor these requests for all users and will not treat you differently for making one.

Security

Connections to the site are encrypted. Passwords are hashed. Database rules make sure each account can only read its own data, and parent access is checked on every request. No system is perfectly secure, but if a breach affects your information, we will notify you as required by law.

Changes to this policy

If we change this policy, we will update the date at the top. If a change affects how we use information we already have, we will tell you by email or on the site before it takes effect.

Contact

Questions or requests: privacy@admitly.xyz