Your privacy, explained plainly

Information you give us

• Account details: your name, email address, and password (stored as a one-way hash) when you register. Accounts are for people aged 13 and older, and registration asks you to confirm that.
• What you save in your account: saved colleges, scholarships, careers and searches, your student profile (such as grades, test scores, budget and interests if you choose to enter them), checklists, and your email and notification preferences.
• Questions you ask the Ask CollegesRef advisor, and the answers it gives.
• Messages: your name, email address, and message when you use the contact form.
• Newsletter and guide requests: your email address when you subscribe or request a free guide.
• Tool inputs: your quiz answers, saved colleges (backpack), and comparison lists.
• Financial calculator inputs: the Pell Grant, loan limit, repayment, and affordability calculators run entirely in your browser. What you type there (such as a Student Aid Index, loan balance, or income) is not sent to us and is not saved in your browser. It is placed only in the page address so you can copy or share a result; anyone you send that link to can see those inputs.
• Partner inquiries: your name and email address when you explicitly ask us to pass an inquiry to a college or partner, together with a record of the consent text you accepted.
• Report orders: order details and the email you pay with when you buy a premium report. Payments are processed by Dodo Payments, our merchant of record; we never receive or store your full card details.
• Where you signed up: with each of the requests above we store the page you used and which form on it (for example, the newsletter box on an article or the guide offer on a college profile), and the college, article, or tool that page is about. We use this to see which pages are useful and to follow up on the topic you asked about. It is no extra cookie; it is saved with the request.

Information collected automatically

• Device and log data: IP address, browser type, operating system, referring page, pages viewed, and the date and time of each request.
• Cookies, local storage, and similar technologies, described in the Cookies section below.
• Approximate location derived from your IP address (country or region). We do not collect precise GPS location.

Information from service providers

Cloudflare Turnstile tells us whether a form submission is likely automated. We use it only to block spam and abuse.

• Provide the site: run search, matching, comparisons, saved lists, and your account.
• Answer messages and fulfill requests you make, such as guides, reports, or partner inquiries.
• Send newsletters you subscribed to. You can stop them at any time, as described under Your choices.
• Understand usage and improve pages, data quality, and performance.
• Show advertising that funds free access to the site, as described below.
• Protect the site against spam, fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms of Service.

At the time of this update, CollegesRef shows no display ads. This section describes what will apply once we add Google AdSense; we will update the date at the top of this policy when ads start.

CollegesRef may display ads served by Google AdSense. Ads are always labeled as advertising and are kept separate from verified college data and editorial content. Advertisers cannot change college data, fit scores, or editorial assessments.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to CollegesRef and/or other sites on the internet.
• Other certified ad technology providers that Google works with may also place cookies or read identifiers to serve and measure ads. In the EEA, UK, and Switzerland, these vendors are listed in our consent message, where you can review them individually.

How to opt out of personalized advertising

• Opt out of personalized advertising from Google by visiting Google Ads Settings (also available at My Ad Center).
• Opt out of some third-party vendors' use of cookies for personalized advertising at www.aboutads.info/choices or the Network Advertising Initiative opt-out page.
• In Europe, you can also use Your Online Choices.

Opting out does not remove ads. You will still see ads, but they will be less relevant to you. Learn more about how Google uses information from sites or apps that use its services and how Google uses cookies in advertising.

We do not pass names, email addresses, or other information that directly identifies you to Google for advertising, and we do not use sensitive information such as health, financial status, religion, or ethnicity to target ads.

• Google Analytics 4 helps us understand how the site is used. Google processes this data under the Google Privacy Policy. You can block it with the Google Analytics opt-out browser add-on.
• CollegesRef also runs its own first-party analytics. It stores no IP address and no name or email, uses a random identifier kept in your browser, and deletes raw events after 13 months; only aggregated counts are kept longer. If you give us your email (newsletter, checkout, or account), we may link it, stored only as a one-way hash, to that identifier to tailor the suggestions and emails you agreed to receive. If you decline storage in the consent message, visits are counted without any identifier.
• Our first-party analytics also record the country a visit comes from, looked up from your IP address at the moment of the visit (the address itself is not stored), and technical errors: when a page or form fails, the error type, a shortened message without web-address parameters, the script file name and line, or the server status code. IP geolocation by DB-IP, used under the CC BY 4.0 license.
• On the free tools, our analytics record which tool you opened, which field you changed (its name, never what you typed), a rough result range (for example, a Pell Grant at the maximum, or a loan balance between $10,000 and $25,000), the college you picked, and whether you shared a result, followed a link, or opened the email form. These events follow the same consent and opt-out choices as the rest of our analytics and set no additional cookies.
• Cloudflare Turnstile protects our sign-in, registration, contact, and newsletter forms from automated abuse. It does not use advertising cookies. See the Cloudflare cookie policy.
• Cloudflare delivers and secures the site and may set security cookies. See the Cloudflare cookie policy.
• Ask CollegesRef advisor: your question, and your quiz result if you took the quiz, is sent to our AI model provider to write the answer. We do not send your name or email with it. To prevent abuse, each advisor request is logged with a one-way keyed hash of your IP address and browser identifier (never the address itself), and these logs are deleted after 30 days.
• Student videos are embedded from YouTube. When you play a video, YouTube (Google) may set cookies and collect viewing data under its own policies.

You can turn analytics off for this browser below. A Do Not Track or Global Privacy Control signal turns it off automatically.

Cookies are small files a website stores in your browser. Local storage is similar browser storage that stays on your device. We group them by purpose:

Most browsers let you block or delete cookies. If you block strictly necessary cookies or local storage, sign-in and saved lists may stop working. Cookie names set by third parties can change without notice.

If you visit from the European Economic Area, the United Kingdom, or Switzerland, we show a consent message provided through Google's certified consent management platform, which follows the IAB Europe Transparency and Consent Framework. Advertising and analytics cookies that require consent are used only after you agree. If you decline, you may still see non-personalized or limited ads.

You can change or withdraw your choice at any time using the privacy and cookie settings link provided by the consent message on the site. Withdrawing consent does not affect processing that happened before.

Legal bases we rely on

• Contract: to provide your account and the tools you request.
• Consent: for advertising and analytics cookies, newsletters, and partner inquiries.
• Legitimate interests: to secure the site, prevent abuse, and improve our service, balanced against your rights.
• Legal obligation: where the law requires us to keep or disclose information.

You have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to complain to your local data protection authority.

The California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and similar laws in other U.S. states, give residents rights over their personal information.

Categories we collect

• Identifiers, such as name, email address, IP address, and cookie or device identifiers.
• Internet or network activity, such as pages viewed and interactions with ads.
• Inferences, such as college preferences derived from your quiz answers.
• Approximate geolocation derived from IP address.

We do not sell personal information for money. Advertising cookies placed by Google and its partners may count as "selling" or "sharing" personal information for cross-context behavioral advertising under these laws. We do not collect sensitive personal information for the purpose of inferring characteristics about you, and we do not knowingly sell or share personal information of consumers under 16.

Your rights

• Know what personal information we collect, use, and disclose.
• Delete personal information we collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information and of targeted advertising.
• Not be discriminated against for exercising these rights.

We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of sale and sharing: our analytics stop, and advertising storage and ad personalization are denied for your browser. To opt out without GPC, use Your Privacy Choices, adjust Google Ads Settings, or email us. To make any other request, email [email protected] with the subject "Privacy request". We will verify your request using the email address associated with your information and respond within 45 days. An authorized agent may submit a request on your behalf with your written permission.

• Service providers that host the site (Google Cloud and our server host), deliver email (Brevo), provide analytics (Google Analytics), protect and deliver the site (Cloudflare), process payments (Dodo Payments), or generate advisor answers (our AI model provider), under terms that limit their use of the data.
• Google and its advertising partners, as described in the Advertising section.
• A college or partner you choose, only after you explicitly consent on the inquiry form. You can withdraw consent for future sharing at any time.
• Authorities or other parties when required by law, or to protect the rights, safety, and property of our users and the site.
• A buyer or successor if CollegesRef is sold or reorganized, subject to this policy.

CollegesRef is built for high school students, families, and counselors, and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it.

We keep personal information only as long as needed for the purposes above. Account data is kept while your account is active and deleted after you delete your account, except where we must keep records by law. Contact messages and inquiry records are kept only as long as needed to respond and to demonstrate consent.

Questions and answers in the Ask CollegesRef advisor are stored to improve our content and are deleted 12 months after your last message in that conversation.

We use encryption in transit, access controls, and hashed passwords. No system is completely secure, so we cannot guarantee absolute security. Our service providers may process data in the United States and other countries, with safeguards required by applicable law.

• Stop newsletters and guide emails at any time using the unsubscribe link included in every email we send. You can also contact [email protected] if you need help.
• Update or delete your account from your account settings or the delete account page.
• Control cookies in your browser and through our consent message where it is shown.
• Opt out of personalized ads using the links in the Advertising section.

We update this policy when our practices or the law change. The date at the top shows the latest version. For significant changes, we will post a notice on the site.

Questions or requests: email [email protected] or use our contact form. Postal mail: 8 The Green, Dover, DE 19901, United States.