Privacy Policy

1. Who we are

GradFetch ("we", "us") is operated by GradFetch, reachable at privacy@gradfetch.com. For the purposes of data protection law, including the EU General Data Protection Regulation (GDPR), we are the data controller for personal data processed through gradfetch.com.

2. Data we collect

Account data. When you create an account or join the waitlist, we collect your email address and (for accounts) your name if you provide it. We store a salted, hashed version of your password; we never store passwords in plain text.

Application data. Information you enter into the app: your tracked schools and programs, deadlines, checklists, notes, and statement of purpose drafts. This is the core of the service and is only used to provide it to you.

Recommender data. If you use recommender features, we store the names and email addresses of recommenders you provide, solely to manage your recommendation requests.

Technical data. Basic request logs (IP address, browser type, pages visited) processed by our hosting provider for security and reliability. We do not use third-party advertising trackers.

Program directory data. Our database of programs, faculty, deadlines, and fees is compiled from official public university sources. It contains no private personal data beyond faculty professional contact information published by universities.

3. How we use your data and lawful bases (GDPR)

• Provide the service (account management, tracker, SOP studio): necessary to perform our contract with you.
• Send transactional email (verification, password resets): necessary to perform our contract with you.
• Security and abuse prevention (rate limiting, fraud detection): our legitimate interests in keeping the service safe.
• Improve the service (aggregate, de-identified usage statistics): our legitimate interests. We never sell personal data.
• Waitlist and product updates: your consent, which you can withdraw at any time.

4. Sharing and processors

We share data only with the processors needed to run the service:

• Cloudflare, Inc. Hosting, database (D1), and content delivery.
• Resend. Transactional email delivery.

We do not sell, rent, or share personal data with advertisers or data brokers. We disclose data only if required by law or to protect the security of the service.

5. International transfers

Our infrastructure is hosted in the United States. If you access GradFetch from the EU/EEA, UK, or elsewhere, your data is transferred to and processed in the US. Where GDPR applies, we rely on appropriate safeguards for such transfers, including the EU Standard Contractual Clauses with our processors.

6. Retention

Account and application data is kept while your account is active. If you delete your account from the Account panel in the app, your account and all associated data (tracked applications, checklists, SOP drafts, recommenders) is deleted immediately, except where we must retain limited records for legal or security reasons. Waitlist emails are kept until you unsubscribe or request deletion.

7. Your rights

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten"). You can delete your account and data from inside the app.
• Portability: receive your data in a structured, machine-readable format.
• Restrict or object to certain processing.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, email privacy@gradfetch.com. We respond within 30 days (one month under GDPR). If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection supervisory authority.

8. Cookies and local storage

GradFetch uses a strictly necessary, HttpOnly session cookie to keep you signed in. We do not use third-party advertising or cross-site tracking cookies. Because only strictly necessary storage is used, no cookie consent banner is required.

9. Security

We use encrypted connections (HTTPS), salted password hashing, and scoped access controls. No system is perfectly secure, and we cannot guarantee absolute security, but we apply industry-standard measures appropriate to the data we hold.

10. Children

GradFetch is intended for users aged 16 and older. We do not knowingly collect data from children under 16.

11. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced in the app or by email at least 14 days before taking effect. Continued use after the effective date constitutes acceptance.

12. Contact

For privacy questions or requests: privacy@gradfetch.com.