ColBuddy

Privacy Policy

Overview

ColBuddy is committed to protecting the privacy of all users, especially minors. This policy describes what data we collect, how we use it, and your rights regarding that data.

Data We Collect

  • Account information: Name, email, date of birth, role (student/parent)
  • Academic profile: GPA, test scores, courses, intended major, extracurriculars
  • College preferences: Saved colleges, search history, application status
  • Chat conversations: Messages exchanged with our AI college advisor
  • Career interests: Survey responses and career exploration data
  • Transcript data: Uploaded transcripts and AI-generated analysis
  • Financial information: Family income bracket (self-reported), FAFSA progress
  • Payment data: Processed securely through Stripe; we do not store card numbers

How We Use Your Data

  • Provide personalized college planning guidance via AI
  • Match students with colleges based on academic profile and preferences
  • Generate merit aid estimates and financial fit analysis
  • Track application progress and send deadline reminders
  • Improve our AI models and service quality

Children's Privacy (COPPA Compliance)

ColBuddy complies with the Children's Online Privacy Protection Act (COPPA).

For users under 13:

ColBuddy does not knowingly collect personal information from children under 13. Account creation is blocked for users who indicate they are under 13 years old.

For users aged 13–17:

  • A parent or guardian must provide verifiable consent before the account is activated
  • We send a consent email to the parent/guardian email provided during registration
  • The student cannot access any features until consent is granted
  • Parents can review, correct, or delete their child's data at any time

Parent/Guardian Rights:

  • Access: Request a copy of your child's data
  • Correction: Request changes to inaccurate information
  • Deletion: Request complete deletion of your child's account and all data
  • Revoke consent: Withdraw consent at any time, which will deactivate the account

To exercise any of these rights, contact us at privacy@colbuddy.com or through the Family Workspace settings in your account.

Sharing With School Counselors

Students can connect a school counselor to ColBuddy so the counselor can support their college planning. Counselor access is OFF by default and never happens without explicit consent.

How a connection starts

  • A counselor sends the student an invitation by email.
  • The student must accept the invitation while signed in. A plain-English summary of what the counselor will see is shown before acceptance.
  • For students under 18, a parent or guardian must also approve before access begins. Both consents must remain in place.

What counselors see by default

  • Name, school, graduation year
  • Saved-colleges list and the student's own categorization
  • FAFSA completion progress (counts only, not financial answers)
  • Readiness-hub task status (status counts only — no task titles or linked colleges)
  • Career-survey results

What counselors never see unless the student explicitly opts in

  • Essay drafts
  • AI chat history
  • Test scores
  • Family financial information (locked off for minors regardless of toggle)

Audit and revocation

  • Every counselor read of student data is recorded in an append-only audit log. Students can see this log under Settings → Counselors → "Recent activity by your counselors."
  • A student can revoke a counselor's access at any time from Settings → Counselors.
  • A parent can revoke their minor child's counselor link at any time using the same email link they used to approve it.
  • When a student turns 18, parent-granted links auto-suspend on the next counselor read and the student is asked to re-consent on their own.
  • If a counselor leaves their school, all their links are suspended. School license expiry is currently handled by ColBuddy operators (not yet automated).
  • When an account is deleted, all counselor relationships are first recorded in the audit log and then removed; the audit row outlives the link for FERPA legal-hold purposes.

Data Security

We use industry-standard security measures including encryption in transit (TLS), encryption at rest (AES-256), and role-based access controls. Data is stored on AWS infrastructure with SOC 2 compliance.

Data Retention and Deletion

You can delete your account and all associated data at any time from the Settings page. For minor users, parents/guardians can also request deletion. When an account is deleted, all personal data is permanently removed from our systems.

Contact Us

For questions specifically about this privacy policy or our data practices, email privacy@colbuddy.com. For everything else, use the contact form or email support@colbuddy.com.

Last updated: July 28, 2026