Privacy policy

Last updated 25 August 2026. Written to be read by the students it applies to.

The short version. We collect the least we can: your email address, your date of birth, and what you tell us about where you are applying. We never sell or share it. There is no advertising and no third-party analytics on this site. You can ask us to delete everything, and we will.

Counsellor is operated by TODO_LEGAL_ENTITY (TODO_POSTAL_ADDRESS). This policy explains what we collect, why, who else can see it, and how to make us delete it. It covers counsellor.education and counsellor.school.

What we collect

What you give us

Email address. This is your account. We verify it, because it is how you get back in.
Date of birth. Required by law before we can collect anything else from a young person, so we ask for it first and refuse anyone under 13.
A parent or guardian's email address, if you are under 18. If you are 18 or over and a form offers the field anyway, we discard it rather than store it.
What you tell us about your search — your graduation year, your school's name, your state, and the colleges you save to a list. All optional.

What we collect automatically

Sign-in records. When a session starts we store a one-way hash of your IP address and your browser's user-agent string. We keep the hash rather than the address because it is enough to spot an attack and not enough to track you.
Sign-up signals. At sign-up we keep hashed network details and the minute you registered, to detect bulk automated sign-ups. Fake accounts are the main threat to a service like this one, and this is how we find them without profiling real students.
Nothing else. There is no analytics SDK, no advertising pixel, no session recorder, and no fingerprinting script.

If you sign in with Google or Apple

We receive a permanent identifier for your account with them, your email address, and — from Google only — whether the account belongs to a school domain. We ask for the minimum each offers ("openid email profile" from Google, "name email" from Apple) and can read nothing else. If you use Apple's Hide My Email we see only the relay address, and we ask for a real address before creating an account so that losing the relay cannot lock you out.

We also subscribe to Google's Cross-Account Protection feed, which tells us if Google disables an account that has signed in here — including when Google concludes an account was created in bulk by a bot.

Cookies

One cookie: your session. It is marked HttpOnly, Secure and SameSite, it lasts up to 180 days, and it does nothing except keep you signed in. There are no advertising or analytics cookies to decline, which is why you are not being shown a cookie banner.

How we use it

To sign you in and keep you signed in.
To show you college information relevant to what you told us.
To email you sign-in codes, and — if you are under 18 — to notify your parent or guardian that an account was created.
To keep bots and abuse out.
To understand, in aggregate, which parts of the service people use.

We do not use your information to train advertising models, and we do not build profiles for anyone else's benefit.

Who else sees it

We do not sell, rent, or share student information. There is no exception for "partners", "affiliates", or "preferred colleges". The only third parties involved are the ones needed to run the service:

Amazon Web Services — hosting and encrypted backups, in the United States (Oregon).
Google Workspace — delivering our email.
Cloudflare Turnstile — the "are you human" check on sign-up. It sees your IP address and browser characteristics.
Google or Apple — only if you choose to sign in with them.

We will disclose information if the law compels us to, and we will tell you unless we are legally prohibited from doing so.

If you are under 18

We ask for a parent or guardian's email address and notify them that the account exists. Your account defaults to the most private settings we offer, and nothing you save is visible to other students. A parent or guardian can email us to see what we hold about you, or to have it deleted.

If you are under 13

We cannot create an account for you, and we keep no record of the attempt — not even that it happened. That is deliberate: a list of children who tried to sign up would itself be personal information about children.

How long we keep it

Your account — until you ask us to delete it.
Sign-in sessions — a maximum of 180 days, usually less.
Sign-in codes — minutes. They are stored hashed and are unusable once redeemed.
Security and audit records — kept longer, and deliberately unmodifiable, because a log an attacker can edit is not a log. They hold identifiers and hashes, not the contents of your account.

Your choices

Wherever you live, you can ask us to show you what we hold, correct it, delete it, or send you a copy. Email help@counsellor.education from the address on your account and we will act within 30 days. We will not make the service worse for you because you asked.

Deleting your account removes your profile, your lists and your sessions. A record that an account existed and was deleted stays in the audit log, which is what lets us prove the deletion happened.

Security

Everything travels over TLS. We store no passwords at all — there is nothing to leak or reuse. Sign-in codes and session tokens are stored as one-way hashes. Backups are encrypted and cannot be altered or deleted for two years. Administrative access is logged, including reads.

No system is perfectly secure. If we discover a breach affecting your information, we will tell you and the relevant regulators as the law requires.

Where we operate

Counsellor is built for students in the United States and hosted there. We do not target the service at the EU or UK.

Changes

If we change this policy in a way that matters, we will say so here and email account holders before it takes effect. The date at the top always reflects the current version.

Contact

TODO_LEGAL_ENTITY, TODO_POSTAL_ADDRESS. Email help@counsellor.education.