Privacy Policy · ApplyAI

ApplyAI is an AI-powered college application co-pilot operated by Vanessa Pinsky in Toronto, Ontario, Canada (“ApplyAI,” “we,” “us”). This page explains what information we collect, why we collect it, and what rights you have.

Plain English: we collect the minimum we need to run the product, we never sell your data, and you can delete your account and data at any time.

1. What we collect

Account information

Your name and email address (used to create your account and send login links).
Hashed password (we never see the plain-text version).

Application data you enter

Academic profile: grades, test scores, intended major, target schools.
Essay drafts, resume bullets, activities, interview answers you paste into our tools.
Anything else you voluntarily type into the app.

Payment information

We do not store your credit card. Payments are processed entirely by Stripe, Inc., which is PCI-DSS Level 1 certified. We only receive a subscription status and a Stripe customer ID from Stripe.

Usage data

Pages visited, features used, and anonymous product analytics via PostHog.
Basic server logs (IP address, browser, timestamp) kept for security and debugging.

2. How we use your information

To run the product.When you use an AI tool (essay coach, resume builder, etc.), the text you enter is sent to Google’s Gemini API so it can generate a response. Google processes it per their API terms and does not use it to train their models for paid API calls.
To maintain your account.Log you in, save your drafts, track your usage against your plan’s quota.
To improve the product.Aggregate, anonymized usage patterns (e.g. “50% of users use the essay tool first”).
To communicate with you.Account emails (confirmation, password reset, billing receipts). We don’t send marketing emails without your consent.

3. Who we share it with

We share data only with the service providers needed to run ApplyAI:

Supabase — hosts our database and handles authentication. SOC 2 Type II compliant.
Stripe — processes subscription payments. PCI-DSS Level 1.
Google (Gemini API) — generates AI responses from the text you submit to an AI tool.
Vercel — hosts the website.
PostHog — anonymous product analytics.

We do not sell, rent, or trade your personal information to anyone. Ever. We may disclose data if legally required (e.g. a valid court order) — but we’ll push back on anything overreaching.

4. Your rights

You can, at any time:

View and edit your profile and drafts inside the app.
Export your data by emailing us.
Delete your account and all associated data by emailing us.
Cancel your subscription from the billing page — effect is immediate.

Under PIPEDA (Canada), GDPR (EU), and CCPA (California), you also have the right to access, correct, or delete the personal data we hold about you. We respond to all requests within 30 days.

5. Data retention

Account data: kept while your account is active. Deleted within 30 days of account deletion.
Payment records: Stripe keeps transaction records for 7 years as required by tax and AML law. We can’t override that.
Server logs: kept for 30 days, then automatically purged.

6. Security

All traffic is encrypted over HTTPS. Passwords are hashed with bcrypt. Database access is restricted with row-level security so one user can never read another user’s data. If we ever detect a breach affecting your account, we’ll notify you within 72 hours.

7. Minors

ApplyAI is intended for high-school students applying to college, including those under 18. We do not knowingly collect more personal information than is needed to run the product. If you are under 13, please do not create an account. If you are a parent and believe your child under 13 has signed up, email us and we will delete the account.

8. Changes to this policy

If we change this policy materially, we’ll email active users at least 7 days before the change takes effect. Small fixes (typos, clarifications) we may make without notice.

9. Contact

Questions, requests, or complaints? Email aidan.sugarman@gmail.com.