Sharing and access

Who can see a shortlist, what the edit toggle does, and why a student never sees notes.

A student record can have four kinds of people on it: the counselor of record, that counselor’s institute admin, the student themselves, and their guardians. None of them sees the same thing, and none of it is decided by hiding buttons — every rule below is enforced in the database, so it holds whoever is asking and however they ask.

Nothing is shared until someone shares it

Adding a student to a roster shares nothing. Inviting them to their own login shares nothing. Linking a parent shares nothing. Access is a separate, deliberate act, made in the Share dialog on the student’s page.

Two audiences, two surfaces, two levels

The dialog is a grid of switches, and it is a grid because each axis is a real question.

Audience: the student, or their guardians

They are separate grants. Sharing a shortlist with a parent does not share it with the student, and the reverse is just as true. A counselor routinely wants one and not the other.

Surface: the shortlist, or the application tracker

Also separate. The tracker is where a family does the work, so it is common to open it wider than the working shortlist — and just as valid to share a shortlist while keeping the tracker closed.

Level: view, or view and edit

The second switch. With edit on, that audience can add and remove programs, and the counselor sees their changes. With it off, they read.

One combination is not allowed: the tracker cannot be shared without the shortlist, for the same audience. The tracker is a list of shortlisted programs, so a tracker-only viewer would get a page naming rows they are not allowed to read. The switch stays disabled until the shortlist is shared, and withdrawing the shortlist share takes the tracker with it.

What the edit toggle does not do

The counselor’s note on a shortlisted program — the reason they put it there — is never editable by the student, even with edit switched on. Edit means “change which programs are on the list”, not “change what your counselor said about them”.

A guardian with edit access can write their own notes, labelled Family note against the counselor’s Counselor note. They cannot edit the counselor’s. Neither the student nor a guardian ever gets the staff powers — transfer, delete, or the share switches themselves.

Why a student never sees counselor notes

Student-level notes are a counselor’s candid working record: the reason a program is a stretch, what a family said on the phone, what to watch. A counselor who has to write those knowing the student will read them stops writing them, and the record becomes useless for the job it exists to do.

So it is not a toggle that happens to default off. The student is absent from the notes policy in the database entirely, and no combination of switches grants it. A student export does not contain them either.

Guardians are treated differently — they do read counselor notes, but only through the guardians share, along with the shortlist. That pairing is deliberate: half the notes name programs, so notes without the shortlist would be incoherent. Withdrawing the guardians share withdraws both, and a guardian’s own notes survive it.

The one case with no gate

When a record has no counselor — a child a parent created, or a student who registered themselves — there is no staff to grant a share and the family is the owner, so the gate does not apply. They see everything on the record because it is theirs.

That closes by itself the moment a counselor takes the record on. It is the main thing to understand before asking a counselor to adopt a self-made record: you gain a counselor, and the shortlist and notes become theirs to share back to you.

Guardian links

There are three ways a guardian gets attached, and they carry different authority.

The counselor invites them

The default and the strongest. The counselor already knows who the guardians are, which a password check never establishes. The link is active immediately.

The parent proves they hold the student’s login

At Create account → Families, or from an existing parent account. It is a password check on a minor’s account, so it is rate-limited per address and per network, every failure reads identically regardless of cause, and both the student and their counselor are emailed on every link and on repeated failures. A counselor can switch the route off for any student.

A parent invites a co-guardian

Only for a child no counselor manages — otherwise guardians are the counselor’s call.

Removing a link never deletes a record. A guardian can always unlink themselves, unless they are the last way into a record that has no counselor and no student login — in which case the record would become unreachable, and deleting it is the honest action instead.

Moving a record between counselors

Transfer

Counselor to counselor, by email address. The record, its shortlist, its notes and its institute move together, and the sending counselor loses access the instant it commits.

Handover request

The other direction, for a record with no counselor. A parent or a self-registered student names a counselor by email; it lands in a Connection requests panel at the top of that counselor’s student list to accept or decline. It is a queue rather than a one-click link in an email, because a link in an inbox would make a minor’s record transferable by anyone who read it.

Adoption

When a counselor invites a student who already registered themselves, the two records merge: the counselor’s roster row survives and the student’s own shortlist and tracked applications move onto it. Where both had a note on the same program, the counselor’s is kept — the invite says so before you confirm.

Institutes

An institute admin sees every one of their counselors’ students, shortlists and notes. A plain member does not — a counselor’s roster stays private to that counselor. Private program notes and tags are outside the institute’s reach entirely, even the admin’s.

A student is stamped with an institute by their counselor of record, so a record with no counselor belongs to no institute. That is what keeps a parent-created child invisible to every institute admin.

Email is a copy, not access

Send a copy by email — the last section of the same dialog — mails a snapshot: the shortlist and its counselor notes, rendered with your branding. It grants nothing and expires nothing. Student-level notes are never in it. Recipients never see each other.

For what leaves the product at your own request, see Your data and the privacy policy.