Privacy Policy

2. Information We Collect

We collect only the categories of information necessary to provide the admissions management, planning, and writing tools you utilize:

3. Sources of Information

We obtain information from the following sources:

• Direct User Input: When you complete onboarding, enter your profile details, build your college list, record Story Vault entries, or submit support tickets.
• Authentication Providers: When you authenticate via Google OAuth or Supabase Auth, we receive basic identity tokens (email and name).
• Public Institutional Data Sources: We ingest institutional benchmark data, admissions deadlines, and requirements from public resources such as the U.S. Department of Education College Scorecard API and verified university admissions websites.

4. How We Use Information

We use the information we collect solely for the following operational purposes:

• To operate and deliver your admissions command center, application pipeline, and deadline calendar.
• To provide deterministic heuristic task ranking and personalized daily action recommendations.
• To organize your Story Vault narratives and assist with supplemental essay prompt matrix mapping.
• To track deadlines and generate in-app schedule reminders.
• To enable self-service data portability (Download My Data) and account deletion.
• To detect, diagnose, and repair system defects, security anomalies, or performance bottlenecks.
• To communicate with you regarding security updates, legal terms updates, or customer support inquiries.

5. Student Application and Profile Information

Your admissions target lists, decision strategies, test scores, and profile context are isolated to your individual account using PostgreSQL Row-Level Security (RLS) policies designed to prevent other students or unauthenticated third parties from accessing your admissions planning records.

6. Student Writing and Story Vault Protection

We recognize that personal statements and brainstorming narratives involve deep personal reflection. IllumiU operates on a fundamental principle:

Your Story Vault entries, personal reflections, brainstorming notes, and draft prose are not transmitted to external foundation models during standard planning workflows. Story-to-prompt clustering and word-budget allocations are computed locally using deterministic heuristic logic.

7. AI-Assisted Features and Model Boundaries

When IllumiU utilizes cloud AI inference (such as the Google Gemini API) to generate high-level admissions planning recommendations or synthesize institutional requirements, the interaction is governed by strict boundaries:

• What AI Receives: High-level planning metadata, admissions deadlines, task types, estimated effort metrics, and verified institutional requirement snippets.
• What AI Does NOT Receive: Story Vault narrative text, personal statements, essay drafts, student transcripts, test scores, or personal identifiers (PII).
• No Model Training on Student Writing: IllumiU does not use student essays, Story Vault narratives, or student writing to train, fine-tune, or reinforce generalized AI foundation models.

8. Institutional and Public Source Information

IllumiU displays institutional data, application deadlines, essay prompts, and historical benchmark ranges compiled from publicly available university admissions materials and government datasets (such as College Scorecard). While we strive for accuracy, colleges may alter requirements or deadlines without notice. You remain responsible for verifying final application criteria on official university portals.

9. Third-Party Service Providers

We engage trusted service providers to assist in operating our infrastructure. These providers process data strictly on our behalf under contractual confidentiality and data security commitments:

• Cloud Hosting & Edge Routing: Cloudflare (hosting, SSL/TLS edge termination, DDoS mitigation).
• Database & Authentication: Supabase / PostgreSQL (user authentication, cryptographic JWTs, encrypted database storage with Row-Level Security).
• AI Inference APIs: Google Cloud / Gemini API (server-side planning specialist inference without student prose).
• Public Educational Data: U.S. Department of Education (College Scorecard API).

10. Future User-Authorized Connected Services

In the future, IllumiU may offer optional integrations with third-party education platforms or admissions portals. Any such integration will operate under strict governance:

• Integrations will be initiated solely upon your explicit instruction and authorization.
• Access will be limited to clearly disclosed and approved data scopes.
• Imported records will retain source provenance.
• You may disconnect authorized services at any time, halting future data exchange. Disconnection does not automatically delete records previously imported into IllumiU, which you may delete using our self-service tools.

11. When Information May Be Disclosed

We do not disclose your personal information except in the following limited circumstances:

• With Your Explicit Direction: For example, if you generate a temporary read-only sharing link to share your application timeline with a trusted advisor.
• To Our Service Providers: Solely as necessary to maintain, host, and deliver the Service.
• For Legal and Safety Compliance: When required by law, subpoena, or valid legal process, or to prevent imminent fraud, security threats, or harm.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, subject to standard confidentiality protections.

12. No Sale of Personal Information & No Third-Party Marketing

IllumiU does not sell, rent, broker, or trade student personal information.

We do not disclose your personal information to third parties for their independent marketing or targeted advertising purposes. We do not display third-party advertisements within IllumiU.

13. Parents, Guardians, and Minors

IllumiU is designed for high school students and applicants preparing for higher education:

• Under 13 Years of Age: Account registration is not permitted for individuals under 13. We do not knowingly collect personal information from children under 13. If we discover an account has been registered by a user under 13, it will be promptly restricted and deleted.
• Minors Ages 13 to 17: Permitted users who may create an account and manage their admissions planning workspace independently. IllumiU does not currently operate separate parent or guardian account management tools or direct guardian consent capture workflows.
• Adults 18+: Adult applicants possessing legal capacity to enter into agreements.

14. Browser Storage and Cookies

We use strictly necessary and functional browser storage mechanisms (such as session tokens and local storage preferences) to authenticate your account and preserve your interface state. We do not deploy third-party advertising cookies or cross-site tracking pixels. For detailed inventory, see our Cookie & Storage Notice.

15. Data Security Safeguards

We implement technical, administrative, and organizational safeguards designed to protect student data against unauthorized access, destruction, loss, or alteration. These safeguards include:

• PostgreSQL Single-Tenant Row-Level Security (RLS) enforcing strict tenant isolation.
• Cryptographic JSON Web Token (JWT) session authentication.
• Encryption in transit via modern TLS protocols across all public and API endpoints.
• Server-side authorization boundaries separating user actions from privileged administration.

No electronic transmission or storage system can be guaranteed completely secure. IllumiU uses technical and organizational safeguards designed to reduce the risk of unauthorized access, loss, misuse, alteration, or disclosure. We encourage you to maintain strong, unique passwords for your account.

16. Data Retention

We retain your active admissions records, profile, and Story Vault entries for as long as your account remains open, enabling you to manage multi-year college planning cycles. When you delete your account, active database records are purged from production systems. Routine infrastructure backup snapshots age out in accordance with standard provider retention schedules.

17. Self-Service Account Deletion

You possess the right to delete your IllumiU account at any time via your Account Management settings.

Executing account deletion permanently erases your profile, authentication credentials, applications, Story Vault assets, essay matrix bindings, scholarships, reminder schedules, and support history from active databases.

18. Access and Correction

You have the right to access and correct your profile information, academic records, target college selections, and story entries directly within the application at any time.

19. Download My Data & Portability

IllumiU provides self-service data portability. You can download a structured JSON export containing your applications, essay matrices, Story Vault entries, profile data, and consent history directly from your Account Management settings without service fees.

20. Consent and Withdrawal

We capture your explicit agreement to our Terms and Privacy Policy at signup and maintain an immutable consent log. You may withdraw your consent at any time by deleting your account.

21. U.S. State Privacy Rights

Depending on your state of residence (such as California, Virginia, Colorado, Connecticut, or Utah), you may have statutory rights under state consumer privacy laws to know, access, delete, correct, or obtain a portable copy of your personal information. IllumiU satisfies these rights through self-service settings and direct privacy requests. We do not discriminate against users who exercise their privacy rights.

22. International Users

IllumiU is operated from the United States and is tailored primarily for undergraduate admissions planning. If you access the Service from outside the United States, your information will be transferred to, processed, and stored in the United States in accordance with this Privacy Policy and U.S. law.

23. Changes to this Privacy Policy

We may periodically update this Privacy Policy to reflect enhancements in our service or changes in applicable legal standards. When material changes occur, we will update the version number and effective date, provide notice on the platform, and, where appropriate, request renewed consent upon login.

24. Contact Information

For questions, concerns, or formal privacy rights inquiries, please contact our team: