Privacy Policy

Last updated: October 6, 2026

Notice of a change to our Privacy Policy, effective October 6, 2026

We connect what you do in the product to your account, to understand how the product is used and to follow up with customers. Our policy did not say this clearly, and now it does. From October 6, 2026 we do two new things. We use that activity to decide which reminders to send you. And when we send you product news or a reminder, we record, against your email address, whether it was opened and which link was clicked. We do both so we can send you reminders you can use and stop sending email that people do not read. None of this is sold or shared with advertisers, and what you write and read in the product is still never captured. To stop the emails, use the unsubscribe link in any of them. The details are in Section 8.

Our Privacy Commitment

We do not sell your personal data. We do not use your data to train AI models. Your academic information is used solely to provide our services to you. Privacy is built into how Stratia works: every request is verified against your signed-in identity, your data is reachable only by you, and nothing is shared with an AI assistant unless you explicitly connect one.

1. Introduction

Stratia Admissions ("Company," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Service").

You agree to this Privacy Policy through an explicit confirmation screen at first use of the Service (recorded with its version and time). If you do not agree with any part of this Privacy Policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when using our Service:

  • Your Agreement: the record of your click-through agreement to the Terms and this Policy (its version and time, and that you confirmed being 13 or older)
  • Account Information: Name, email address, and profile photo from your Google account when you sign in.
  • Student Profile Data: Academic information you provide, including:
    • GPA (weighted and unweighted)
    • Standardized test scores (SAT, ACT)
    • High school name, grade level, and location
    • Extracurricular activities and awards
    • Intended majors and career interests
    • College preferences (size, location, setting)
  • Uploaded Documents: Documents you choose to upload — transcripts, résumés, certificates, awards, activities lists — which we read only to build and enrich your profile.
  • Essay Content: Any essays or writing samples you upload for analysis or assistance.
  • Application Outcomes: Admission decisions and applied majors you choose to record (used to show you how our predictions compared to your real results).
  • Communications: Messages you send through our AI chat features or customer support.
  • Payment Information: Payment is processed by Stripe; we do not store your credit card numbers. We receive transaction confirmation and subscription status from Stripe.

2.2 Information Collected Automatically

When you use the Service, we automatically collect:

  • Device Information: Browser type, operating system, device type
  • Log Data: IP address, access times, pages viewed, referring URL
  • Usage Data: Features used, actions taken, time spent on pages
  • Cookies: We use cookies and similar technologies for authentication and analytics (see Section 8)
  • Email Activity: When we send you product news or a reminder about your account, we record whether the email was delivered, whether it was opened, and which link in it was clicked. This is recorded against your email address. Emails about the account itself are not measured this way: receipts, sign-in messages, invitations to a shared plan, and replies to a message you sent us.

3. How We Use Your Information

We use the information we collect to:

  • Provide Our Services: Generate fit analyses, provide AI-powered recommendations, and deliver personalized content
  • Manage Your Account: Authenticate your identity, maintain your profile, and process payments
  • Improve Our Services: Analyze how the Service is used to enhance features and user experience, through the privacy-configured product analytics described in Section 8
  • Communicate With You: Send service-related notifications, product news and reminders about your account, respond to inquiries, and provide customer support.
  • Send Email You Will Use: Decide which product news and reminders to send you, and stop sending the ones you do not read. For this we use your email activity and what you have done in the product, for example that you ran a fit analysis, looked at the pricing page, or have not yet built a college list.
  • Ensure Security: Detect and prevent fraud, abuse, and unauthorized access
  • Legal Compliance: Comply with applicable laws and legal obligations

4. AI and Data Privacy

We prioritize your privacy when using AI technologies:

  • No Training on Your Data: We do not use your personal data or content to train any AI or machine learning models. Your data is used only to provide services to you.
  • Privacy-Preserving AI: When sending data to AI providers (such as Google's Gemini API), we minimize the personal information transmitted and do not include unnecessary identifying information.
  • Third-Party AI Providers: Stratia's own AI features run on Google's Gemini API, governed by Google's API data-use terms, under which the data is not used to train Google's models.
  • Your Documents: When you upload a transcript or other document, AI reads it for one purpose — building your profile. The extracted information lives in your account, under your control.
  • AI Assistants You Connect: If you choose to connect an AI assistant (Claude, ChatGPT, Glean, or GitHub Copilot), data it reads is handled under its provider's own privacy terms — see Section 5. Nothing is shared with them unless and until you connect.

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

  • Service Providers: With trusted third-party vendors who assist us in operating the Service:
    • Google Cloud Platform: Cloud hosting and AI services
    • Firebase: Authentication and database services
    • Stripe: Payment processing
    • Mailgun: Email delivery, and the email measurement described in Section 8
    • PostHog and Google Analytics: Product analytics, as described in Section 8
  • AI Assistants You Connect (at your direction): Stratia lets you connect the AI assistant you already use (Claude by Anthropic, or ChatGPT by OpenAI). If you do, that assistant can read your Stratia data and save work back to your account — but only after you explicitly connect it with your own sign-in, only for your own account, and only while the connection is active. Data your assistant processes is governed by its provider's privacy policy. You can disconnect at any time from your assistant's settings, and if you never connect one, no data is ever shared with these providers.
  • Legal Requirements: When required by law, court order, or governmental authority
  • Safety and Rights: To protect our rights, safety, or property, or that of our users or others
  • Business Transfers: In connection with a merger, acquisition, or sale of assets (you will be notified)
  • With Your Consent: When you explicitly authorize us to share specific information

6. Data Retention

We retain your personal information for as long as necessary to:

  • Provide you with the Service
  • Comply with legal obligations
  • Resolve disputes and enforce our agreements

Account Data: Retained while your account is active. You can delete your account and its data yourself, at any time, in Settings (see Section 9).

Payment Records: Retained for 7 years as required for accounting and tax purposes.

Chat History: Retained while your account is active; deleted upon account deletion — including when you delete the account yourself in Settings.

Questions Asked Before You Sign In: When you ask Astra a question on our home page without signing in, we keep the question and Astra's answer for up to 90 days so we can check and improve the quality of answers. Before anything is stored we remove the names, email addresses, phone numbers, street addresses, social media handles and high school names we can detect; detection is not perfect, so please don't include your name. They are never used for advertising or to profile anyone, and only our own team can read them. Nothing is kept if your browser sends a Do Not Track or Global Privacy Control signal, for a conversation where someone asked for crisis support, or for any conversation where someone says they are under 13 (everything from that conversation is deleted). A question our team saves as a test of answer quality is kept no longer than the 90 days either.

After deletion: a do-not-email marker is retained so a deleted account can never be emailed again, together with a record of which emails were sent to the address. The records we hold of what was opened or clicked, and of product activity we connected to the account, are removed. Our email provider keeps its own delivery logs for a limited time. Payment records are retained as described above. Product-analytics records held by the analytics services expire on those services' retention schedules.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

  • Per-user access enforcement: every request to our systems is verified against your signed-in identity — there is no way for one user (or their AI assistant) to reach another user's data
  • Encryption of data in transit (TLS/HTTPS) and at rest
  • Secure authentication via Google OAuth 2.0
  • Access controls limiting employee access to personal data
  • Regular security assessments and monitoring
  • Use of enterprise-grade cloud infrastructure (Google Cloud)

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Cookies, Local Storage and Email Measurement

We keep this minimal by design:

  • Essential Sign-In State: Google/Firebase authentication stores what it needs in your browser to keep you signed in securely.
  • Astra Before You Sign In: The conversation you have with Astra on our home page stays in that browser tab until you close it, and if you sign in from the same tab, it is saved to your account as an Astra conversation. Separately, we keep each question and answer for up to 90 days, after removing the names and contact details we can detect, to check answer quality (see Section 6). Please don't include your name. They are never used for advertising or to profile anyone.
  • Preferences: We use your browser's local storage to remember small settings — like which explainers you've dismissed — on your device.
  • Product Analytics: We use analytics services (PostHog and Google Analytics) to understand how the Service is used and to improve it. They are configured for privacy: session recordings and page analytics mask every input and every rendered word, so what you write and read on the Service (essays, transcripts, chat) is never captured; anonymous visitors are never profiled; the analytics services receive a pseudonymous identifier for signed-in activity rather than your email address; and we honor your browser's Do Not Track setting. Google Analytics additionally receives only page views and purchase/sign-up confirmations, never the substance of what you do on the Service.
  • Activity Connected to Your Account: We can match the pseudonymous identifier back to your account ourselves, and we do. We use it to understand how each account uses the product and how people found us, and to follow up with customers. From October 6, 2026 we also use it to decide which reminders to send you. The analytics services still never receive your email address.
  • Email Measurement: Product news and reminders we send carry a small image and links that pass through our email provider, Mailgun. That tells us an email was opened and which link was clicked. This is recorded against your email address. It is never sold and never shared with advertisers. Every one of these emails has an unsubscribe link. Once you unsubscribe we send no more of them, so nothing more is measured. Most mail apps can also block remote images, which stops open measurement. This begins on October 6, 2026.
  • No Advertising Cookies: We do not run advertising or retargeting cookies on the Service, and student information is never used to target advertising.

You can clear this data through your browser settings; doing so signs you out and resets your on-device preferences.

9. Your Rights and Choices

Depending on your location, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate personal data
  • Deletion: Request deletion of your personal data and account
  • Portability: Request a copy of your data in a structured, machine-readable format
  • Restriction: Request restriction of processing in certain circumstances
  • Objection: Object to processing based on legitimate interests
  • Withdraw Consent: Where processing is based on consent, you may withdraw it at any time
  • Email: Unsubscribe from product news and reminders with the link in any of them. Emails about the account itself still reach you.

Access, Deletion, and Portability are self-service: in the app, open Settings → Privacy & data. "Download my data" returns everything we hold about your account as one file, immediately. "Delete my account" permanently removes your data and your sign-in, immediately — no request, no waiting. For the other rights, or any question, contact us at support@stratiaadmissions.com and we will respond within 30 days.

10. Children's Privacy

The Service is intended for users who are at least 13 years of age. At first use, every user is asked to confirm that they are 13 or older; anyone who indicates they are younger is signed out. We do not knowingly collect personal information from children under 13, and if we learn that we have collected personal information from a child under 13, we will promptly delete it.

Users between 13 and 18 years of age should use the Service only with the involvement of a parent or guardian.

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to Know: You may request information about the categories and specific pieces of personal information we have collected
  • Right to Delete: You may request deletion of your personal information
  • Right to Opt-Out of Sale: We do not sell personal information
  • Right to Non-Discrimination: We will not discriminate against you for exercising your rights

The Right to Know and the Right to Delete are self-service: Settings → Privacy & data provides both a full data download and immediate account deletion. You may also exercise any CCPA right by contacting us at support@stratiaadmissions.com.

12. International Data Transfers

Your information may be transferred to and processed in the United States, where our servers are located. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in a jurisdiction with different data protection laws.

Your agreement to this Policy (Section 1) covers such transfers. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy.

13. Our YouTube Channel and YouTube API Services

Stratia Admissions publishes its own educational videos on our YouTube channel. We use YouTube API Services to upload those videos to our own channel, add their captions and place them in our own playlists. Every video is reviewed by a person on our team before it is published.

  • What we access: Only our own channel, through an authorization that we granted to ourselves. We do not use YouTube API Services to access, collect, store or share any information about you, your YouTube account or your viewing activity, and our Service never asks you to connect a YouTube account.
  • YouTube's own terms: When you watch our videos on YouTube, YouTube's Terms of Service and the Google Privacy Policy apply.
  • Revoking access: The authorization for our channel can be revoked at any time through the Google security settings page.
  • Deletion: The only data we keep from YouTube API Services is our own channel's authorization (refresh) token and the links and view counts of our own videos. We delete that token within 7 days of the authorization being revoked or of our stopping use of YouTube API Services, and we delete any data obtained from YouTube API Services within 30 days if we can no longer refresh it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on our website at least 30 days before the changes take effect.

Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Stratia Admissions

Email: support@stratiaadmissions.com

Website: https://stratiaadmissions.com

For EU residents, you also have the right to lodge a complaint with your local data protection authority.