Privacy Policy

When you use Carpe Studia, we collect:

• Account information: your name, email address, and profile photo (from Google sign-in or provided by you).
• Student profile data: student names, grade levels, extracurricular activities, awards, test scores, and other application-related information you enter.
• School preferences: target schools, favorites, and tier classifications.
• Conversations with Studia: what you and Studia say to each other is stored so you can pick up where you left off. Starting over keeps the earlier conversation in our records instead of deleting it. A small part of our team reads conversations to check the quality of her advice and improve it. They are never shared outside the team, never used to train AI models, and never shown to a counselor your family invites. Your ratings of her replies are stored with them. They are deleted with your account.
• Before you have an account: if you talk to Studia without an account, we keep what you tell her, whether you are a student or a parent, a first name if you give one, and your email address. We use the address only to send the link that confirms it and, if you do not finish, one reminder. Your first name and email address are never sent to the AI service. If you do not confirm your address, all of it is deleted after 14 days.
• File attachments: documents you upload to your activities (stored in a private bucket, never publicly accessible).

Carpe Studia is built for high-school students and their parents. Most of our students are minors, so we are careful about who creates an account and who consents to the processing of a student's data.

• Parent-created accounts: a parent or legal guardian creates the family, confirms they are the student's guardian, and consents to this policy on the student's behalf. The student then receives their own login by email.
• Student-created accounts: a student who is 16 or older may create their own account after confirming their age and agreeing to this policy. A student of 13 to 15 may create their own account after confirming that a parent or guardian has approved it and agrees to this policy. We do not knowingly serve anyone under 13.
• What we record: who consented, for which student, the version of this policy, and the time. We do not collect a date of birth.
• Sign-in: students and parents sign in with Google or a one-time link sent to their email. We never store passwords.
• Paid plans: a paid plan is always held by a parent.
• Deletion: you can delete your own account at any time in Settings. A parent can delete the whole family account, which removes every student's data.

Your data is stored on Supabase Cloud, hosted on AWS in Paris (eu-west-3), inside the EU, with encryption at rest. All connections use HTTPS/TLS encryption in transit.

• Row-Level Security: every database query is filtered by your authenticated identity. You can only access data belonging to your family. There is no way for one family to see another family's data.
• File storage: attachments are stored in a private bucket. Downloads use signed URLs that expire after one hour.
• Daily backups: the database is backed up daily by Supabase as part of our infrastructure plan.

Our AI features are powered by Anthropic's Claude. When you use the AI advisor, chat, or analysis tools, your profile data is sent to Anthropic's API to generate personalized advice.

Your names are never shared with the AI. Before any data leaves our servers, all personal names (student, parents, and family) are automatically replaced with anonymous placeholders like "[Student]" and "[Parent]". The AI never sees your real names.

The microphone is the one exception. If you choose to speak instead of type, your recording is sent to OpenAI to be turned into text, before our name filter can run. The recording is not stored. Avoid saying names when you use it.

• Your data is used only to generate responses for your session. It is not used to train AI models.
• AI-generated advice is for informational purposes only and should not be considered professional admissions consulting.

We do not sell your personal data. We share data only with:

• Supabase: stores and processes your account and student data (database, authentication, and file storage), hosted on AWS with encryption at rest. Names are not redacted here, as this is where your data lives.
• Anthropic: AI-related data (with names redacted) to power the AI features. Your data is never used to train their models.
• OpenAI: only if you use the microphone, the recording is sent to OpenAI to be turned into text. It is not stored by us, and it is not used to train their models.
• Google: if you sign in with Google, Google processes the OAuth authentication. We receive your name, email, and profile photo.
• Resend: email delivery for magic link sign-in and notifications.
• Usersnap: the in-app feedback button. It appears only for people who choose it in Settings (our beta testers start with it on and can switch it off), and only after sign-in. It receives your account ID and email so we can follow up on feedback you send, plus any screenshot or message you choose to include. It sets no cookies.
• Google Ads: sets cookies that record that your visit came from one of our ads and whether you then created an account or finished an SAT score check. In the EU, the UK, Switzerland and Quebec this happens only if you accept cookies; elsewhere unless you decline (see Cookies below). It does not receive your planning data, student details or conversations. You can change your choice any time with Cookie settings at the bottom of our pages.
• OpenAI (ChatGPT ads): if you came to us from one of our ads in ChatGPT, and accepted cookies (in the EU, the UK, Switzerland and Quebec) or did not decline them (elsewhere), we tell OpenAI that the ad led to an account, and later to a subscription. We send the ad's click reference, the time and the plan's price, from our server. OpenAI receives no name, email, planning data, student details or conversations, and no OpenAI script runs on our site.
• Vercel: hosts the web application and provides cookieless usage analytics (page views, referrers, performance). No user data is stored on Vercel and visitors are not individually identified.
• PostHog: product analytics, hosted in the EU. It records which pages and features are used (for example that a list was built or a visit was planned) and session recordings: the screen as you see it, including what you type, such as your answers to Studia, so we can see where the product is hard to use. We record every visit, whether or not you accept cookies: declining stops the cookies, not the recording. It identifies you by your account ID, not by your name or email, only our team views the recordings, and they are deleted after 30 days. Only if you accept cookies, it sets a cookie so it can recognise you on your next visit; until then, and if you decline, it stores nothing on your device.

Apart from Vercel's analytics, PostHog, and Google Ads and ChatGPT ads conversion tracking (as described under Cookies), we do not use any other analytics trackers or third-party marketing tools.

Your data is retained as long as your account is active.

You can delete your account at any time in Settings, on the web or in the iPhone app. A parent can also delete the whole family account, which removes every student's data. Deletion happens straight away, and copies in our daily backups are removed within 30 days. We keep invoices with our payment provider, Stripe, for as long as Dutch tax law requires, and an anonymous record that a deletion took place.

We always use essential cookies and local storage for sign-in (your Supabase session). The site cannot work without them.

On your first visit, local storage also remembers how you found us for up to 60 days: the link you followed (for example our ad or a friend's invitation) or the website you came from (for example a search engine), and the first page you saw. It holds no identifier, except one case: if you arrive from our ad in ChatGPT and cookies are allowed (see below), it also keeps that ad's click reference. If you create an account, we keep it with your account so we know which ways of finding us work, and remove it from your browser.

In the European Union and the European Economic Area, the UK, Switzerland and Quebec, we use Google Ads and PostHog cookies only after you press Accept on our cookie choice. Until you choose, the answer is no: no Google script loads, no advertising cookie is set, and PostHog stores nothing on your device. Pressing Decline keeps it that way. We tell where you are from your device's time zone, and when we cannot tell, we ask.

Everywhere else, we do not show the cookie choice. Google Ads conversion tracking runs unless you decline, with ad personalisation switched off: Google counts that our ad led to an account or a finished score check, and does not use your visit to choose the ads you see. PostHog also sets its cookie, and a ChatGPT ad's click reference is kept, as if you had accepted. If your browser sends a Global Privacy Control signal, we treat it as Decline.

You can change your choice at any time with Cookie settings, also found at the bottom of our pages. Withdrawing your consent removes the Google Ads and PostHog cookies we can reach.