Privacy policy
SummerTrack holds records about high-school students on behalf of the counselors, schools and families who put them there. This page describes what we collect and what happens to it, and the rights you can exercise yourself, today, from inside the product.
Controller, processor, and which one we are
It depends on whose records they are, and the distinction decides who you should ask for what.
- For student records entered by a school or district, that school is the controller: it decides what may be collected and who may see it. We are its processor, and we act on its instructions. If you are a student or a parent asking about a record your school maintains, the school is the right first stop, and we will work through it rather than around it.
- For your own account — your profile, your login, your billing, your collections and your private annotations — we are the controller, and this policy is the full account of it.
- For a record a parent or a student created themselves, with no school attached, we are the controller and the person who created it holds the rights over it.
What we collect
Account and profile. Your name, email address, optional phone number, password (stored hashed), the role your account holds, the institute you belong to if any, when you accepted these terms, and — for a self-registered student — the age attestation. Plus account timestamps: created, last signed in, email confirmed.
Student records. The name, grade, GPA, intended majors, activities, target colleges, budget, geographic preference and format preference that a counselor, a parent or the student themselves enters. This is the most sensitive category here and it is usually about a minor.
Work product about a student. Shortlisted programs and the counselor’s reasoning attached to each one; counselor notes; the application tracker’s checklist, status and custom steps; and the sharing settings that decide who can see any of it.
Your own material. Collections you build, programs you author, private program notes and tags, your email branding (logo, sender name, accent colour, signature), and the theme and interface preferences your browser remembers.
Relationships. Which counselor is attached to which student, guardian links and how each was verified, institute membership, and the pending requests between them — counselor handover asks, guardian invitations, institute access requests.
Billing. Your billing account, subscription status and plan, the full credit ledger of every grant, spend and refund, and a Stripe customer reference. We never receive or store card numbers.
Security and abuse signals. A ledger of link attempts and access requests, used for rate limiting and to detect credential stuffing against students’ accounts. Email addresses in that ledger are stored salted-hashed rather than in the clear, so the ledger cannot be read back as a list of addresses.
Operational records. Server and request logs from our hosting provider, and error reports when a page fails to render. An error report carries the error type, a truncated message and stack, the browser user agent, and the path only — never the query string, because a query string here carries search terms and filter values. No record content is included.
Feedback you send through the in-app widget: your ratings, the features you ticked, your message, and the page you were on.
What we do not collect: we have no advertising network, no data broker, and no third-party analytics or tracking on any part of this product — including the marketing pages. We do not build advertising profiles, and student names and contact details are never used for marketing.
Where it comes from
Almost all of it is typed in by you, or imported by you from your own CSV. Records about a student are entered by their counselor, by a parent, or by the student. A small amount is generated by the service itself — timestamps, credit ledger entries, sharing state — or returned to us by Stripe about a payment you made. We do not buy data, and we do not enrich a student record from outside sources.
Why we process it
Where we are the controller, we rely on the following bases. Where a school is the controller, the basis for processing its student records is the school’s to determine, and we process on its instructions.
- To provide the service you asked for
- Running your account, storing your roster and your work, sharing what you choose to share, sending the emails you send, producing recommendations you spend credits on. This is performance of our contract with you.
- To take payment
- Subscriptions, top-ups, and keeping a billing record. Contract, plus the legal obligation to retain financial records.
- To keep the service secure
- Rate limiting, the bot check, abuse ledgers, lockouts on the guardian credential path, and error monitoring. Our legitimate interest in protecting the service and, more to the point, in protecting minors’ accounts from being probed.
- To support you and improve the product
- Answering your emails, and reading the feedback you choose to send. Legitimate interest — and the feedback widget is entirely optional.
- To meet a legal obligation
- Retaining financial records, and responding to a lawful request we are required to answer.
We do not use your data, or your students’, to train AI models, and we do not sell personal data to anyone, under any definition of “sell”.
Who else touches it
These are the companies that process data on our behalf in order for the service to run. Each is bound to process it only on our instructions. We keep this list current; if we add one we update this page and the date at the top.
- Supabase — Database, authentication and file storage
- Everything stored in the product: accounts, student records, shortlists, notes, collections, trackers, and uploaded branding logos. This is where the data lives.
- Vercel — Application hosting and content delivery
- Requests as they are served, and the operational logs that go with them — IP address, path, user agent, timing. Record content is not written to those logs.
- Resend — Transactional email
- The recipient address and the contents of the message — a shortlist you sent a family, an invitation, a link notification. Account confirmations and password resets are sent through Supabase.
- Stripe — Payments
- Your billing email and the card details you enter directly into Stripe’s own hosted pages. Card numbers never reach our servers; we hold a customer reference and a subscription status.
- Anthropic — AI recommendations
- For each run: an academic profile — grade, GPA, intended majors, activities, target colleges, budget, geography, format — and summaries of the candidate programs. No name, no email address, no contact detail, no counselor note.
- Cloudflare — Bot check on signup, sign-in and the access-request form
- The signal the challenge needs to tell a person from a script, including your IP address. It does not receive record content.
The Data protection page describes the technical controls around each of these, including exactly what the AI provider does and does not receive.
International transfers
We and our subprocessors are based in the United States, and data you put into SummerTrack is stored and processed there. If you are in the United Kingdom, the European Economic Area or another region with transfer restrictions, that is an international transfer.
Where such a transfer needs a safeguard, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where it applies), which our subprocessors offer as part of their terms. If your school needs the transfer documentation for its own records, write to privacy@summertrack.app and we will send what we have.
How long we keep it
- Your account and everything under it
- Until you delete it. There is no automatic expiry and no inactivity purge — a counselor coming back after a summer should find their caseload where they left it. Deletion is immediate and is described in full below.
- Student records
- For as long as the account they are attached to exists. What happens to each one when that account is deleted depends on who else is attached — see Your rights. Where a school is the controller, its retention schedule governs, and we will action a deletion on its instruction.
- Billing records and the credit ledger
- Deleted with your account, except where we are required to retain a financial record for tax and accounting purposes — typically seven years — in which case we keep the transaction record and not the working data around it.
- Security and abuse ledgers
- Short-lived by design. Rate-limit windows are measured in minutes to hours; pending link and handover requests expire after 30 days and are cleared on the next attempt. Entries are salted-hashed, not readable addresses.
- Error reports and server logs
- Retained for a limited operational period by our hosting provider and then rotated out. They carry no record content.
- Feedback
- Kept while it is useful for product decisions, and deleted with your account. You can ask us to remove a specific submission sooner.
- Backups
- Deleted data is removed from the live service immediately, but a copy persists in a backup until that backup ages out of its retention window and is overwritten. It is not restored into the live service. This is the one place where “deleted” is not instantly absolute, and we would rather say so.
- Catalog programs you authored
- Kept indefinitely, with your name removed when your account goes. They are reference material other counselors rely on, not personal data about you.
Cookies and browser storage
We use no advertising or analytics cookies. What we set is:
- A session cookie holding your authentication token, so you stay signed in. Strictly necessary — the product cannot work without it — and it is cleared when you sign out.
- Local storage in your own browser for interface preferences: your light/dark choice, which student you last had open, and an unsent draft of a program form. This never leaves your device and is never sent to us.
Children
A student must be at least 13 to register an account themselves, and the student signup form asks for that attestation. We do not knowingly create accounts for children under 13.
A record about a student under 13 can exist, because a counselor or a parent can create one — but only they can, and by doing so they take on responsibility for having the basis to do so, whether that is the school’s own authority or their own parental relationship. If you believe a record has been created about a child without a proper basis, write to privacy@summertrack.app and we will act on it.
Your rights over your data
You have the usual rights over personal data we hold about you — access, correction, deletion, restriction, objection, and portability. Two of them are wired into the product and need no request at all.
Download a copy
Settings → Your data → Download my data produces a single JSON file, immediately, with no request queue. It contains your profile and account timestamps, your institute if you belong to one, every student record your account is attached to — with its shortlist, application tracker and sharing state — plus your collections, the programs you authored, your private program notes and tags, your guardian links, any feedback you sent, and your billing account, subscriptions and full credit ledger.
The file names its own exclusions. The significant one: notes a counselor wrote about a student are the school’s record, not the student’s or the parent’s, and are not in their export. Only the author’s own export contains them. If you are a student or a parent and you want those notes, ask the school — they are the ones who decide, and we will support them either way.
Delete your account
Settings → Your data → Delete my account. It asks for your password and your email address typed out, then deletes the account immediately — there is no grace period and no way to restore it. Your login, profile, collections, private program notes and tags, feedback and billing history go with it.
What happens to student records depends on who else is attached to them, because they are rarely one person’s alone. Before you confirm, the dialog lists each record by name under the outcome it will get:
- A counselor’s private record — one with no student login and no parent attached — is deleted with the account. Nobody else can reach it, so keeping it would be retention with no purpose.
- A counselor’s record that a student or parent also uses blocks the deletion until you transfer it to another counselor. Deleting it would take away a shortlist and an application tracker that family built; quietly detaching it would widen who can read your notes. Neither is ours to do on your behalf.
- A child you are the only guardian of, with no counselor and no login of their own, is deleted with your account — otherwise it would survive as a record about a minor that nobody on earth can open. A child who has a counselor, their own login, or a second guardian keeps their record; you are simply detached from it.
- A student’s own record is deleted if they registered themselves and no counselor or parent is attached. If a school manages it, the record stays with the school and the login is removed from it, along with the sharing that login was granted.
Three other things stop a deletion, each with a fix in your own hands: being the only platform admin, being the only admin of an institute, and holding a live subscription that would keep billing after the account is gone. The dialog says which, and what to do.
Programs you contributed to the shared catalog stay in it, with your name removed from them. They are reference material other counselors rely on, not personal data about you.
Anything else
Write to privacy@summertrack.app for a correction, a restriction on processing, an objection, a deletion you cannot complete yourself, or a request made on behalf of a student by their school. Tell us the email address on the account so we can find it. We answer within 30 days, and sooner where the law requires it. We will not charge you for a reasonable request, and we will not make you create an account to make one.
Schools and districts acting as the data controller for their students should use the same address; we will handle a pupil-record request through the school rather than around it, and we can supply a data processing agreement on request.
If you are in the UK or the EEA and you think we have handled your data badly, you can complain to your national data protection authority. We would appreciate the chance to put it right first.
Changes to this policy
When this policy changes substantively we update the date at the top and, where the change affects your rights, tell account holders by email. The summary on the homepage and the help centre guide are informal restatements of this page; where they differ, this page governs.