Privacy Policy

1. Who we are

College Shortlist ("we", "us") is operated by Arcpoint Advisory LLC, a North Carolina limited liability company. We are the controller of the personal information described here. Questions, requests, or complaints: privacy@shortlistcollege.com.

2. What we collect

Account information

Your email address and password (stored only as a salted hash by our authentication provider — we never see it). If you subscribe, our payment processor also holds a customer and subscription identifier. We never see or store your card number.

The student's college plan

Schools you track, application and scholarship deadlines, application status, notes, checklists, and essay drafts you enter. This is the product.

Academic profile (optional)

Graduation year, GPA and scale, SAT/ACT scores, intended major, activities, home state and ZIP. Used for school matching, cost and merit-aid estimates. You can leave any of it blank.

Background information (optional, and it stays on your device)

The app can ask about race/ethnicity, gender, religion, disability, LGBTQ status, citizenship, military connection, and organizational affiliations, because many scholarships are restricted to specific groups and we cannot match you to them without knowing.

These fields are treated differently from everything else on this page: they are stored only in your browser on your device. Our code removes them from the data before it is ever synced to our servers, so they are not in our database and not in any backup. They are used only if you tick "Use my background to find scholarships I'm eligible for", and then only to look up matching awards. Turning it off, or leaving the fields blank, costs you nothing except scholarship matches you may qualify for.

Email you forward to us

When you forward a message to your personal College Shortlist address ([random]@shortlistcollege.email), we receive that message: the sender, subject, date, and body text. We do not connect to your mailbox and cannot see any message you do not forward. If you set up an automatic forwarding filter, you choose the filter — you can change or delete it at any time and forwarding stops immediately.

Feedback you choose to send

If you answer one of our in-app questions or use "Share feedback", we store what you wrote, along with your plan and whether you were on a trial at the time, so we know what the answer refers to. It is used only to improve the service and is never published or shared. Every one of these prompts is optional and skippable — ignoring them changes nothing about your account. If you cancel a subscription, our payment processor also asks why; if you answer, we receive that reason.

Technical information

Standard server logs from our hosting provider (IP address, timestamp, request path), retained briefly for security and abuse prevention. We do not use advertising trackers, third-party analytics, or cross-site cookies.

3. How we use it

To run the product you paid for: sort forwarded email, identify which college it's from, extract deadlines, track your list, estimate costs and merit aid, and show parents the plan. To take payment. To keep the service secure. To fix things when they break.

We do not sell personal information, share it for advertising, or use it to build profiles for anyone else. We do not use your content to train AI models — see §5.

4. Who else touches the data

We are a small operation and rely on established providers. Each is contractually limited to processing data on our instructions.

We also read public reference data from the U.S. Department of Education College Scorecard and similar public sources. Those are one-way lookups — we send them school names, never anything about you.

5. How we use AI

When you triage an email or score an essay, that text is sent to Anthropic's API to produce a one-sentence summary, pull out dates, or give feedback. The AI call happens when you act on something — not automatically when mail arrives.

Under Anthropic's commercial API terms, your content is not used to train their models. We do not send your background fields (§2) to any AI provider.

AI gets things wrong. When our AI is unavailable the app falls back to simpler rule-based parsing and tells you it has done so. Either way, verify every deadline with the school — see the Terms.

6. What parents can and cannot see

Parent view is deliberately limited. Parents see: the target school list, deadlines, school metrics (cost, size, graduation rate), and a summary of recent activity.

Parents do not see: raw email contents, private student notes, or the student's background fields.

We think a student who believes they're being surveilled stops using the tool, and a tool nobody uses helps nobody. Be aware of the limits of this: the student owns the account and a parent or guardian is the consent and billing party. Account access is account access: this boundary is a product design, not a guarantee against anyone who has the login.

7. Students under 18

College Shortlist is built for high-school students, most of whom are minors. We take that seriously.

• Nobody under 13 may use College Shortlist. We do not knowingly collect information from children under 13. If we learn we have, we delete it.
• Students aged 13–17 create their own account, but a parent or guardian must give consent — which we verify by email — and act as the billing party.
• We minimise deliberately. Background fields never reach our servers. Forwarded email is kept only until you sort it, then the raw body is discarded. We ask for nothing we don't use.
• We are not a school vendor. College Shortlist is bought by families, not schools, so FERPA does not apply and we hold no education records from any district.

A parent or guardian can ask us to show, correct, or delete their student's information at privacy@shortlistcollege.com.

8. How long we keep things

9. Your choices and rights

• Stop the email flow at the source — delete your Gmail forwarding filter or turn off forwarding in your email settings, and no new email reaches us. Deleting your account removes your forwarding address entirely.
• Reset App Data in the app erases everything stored on that device, including all background fields.
• Access, correct, export, or delete — email privacy@shortlistcollege.com and we will action it within 30 days, free.
• Turn off scholarship background matching at any time in Profile.
• Depending on where you live, you may have additional statutory rights. We extend the rights above to everyone regardless of location.

10. Security

Everything runs over HTTPS. Database access is restricted per-account at the database level, so one family's data is not reachable from another family's session. Payment card data never touches our servers. Background fields never leave your device.

No system is perfectly secure, and we would rather say so than imply otherwise. If we discover a breach affecting your information, we will tell you and any required regulator without undue delay.

11. Changes to this policy

If we change this policy materially — particularly anything that would let us collect or share more than we do today — we will email you before it takes effect. The "last updated" date at the top always reflects the current version.