Privacy Policy

Effective date: October 21, 2026

This Privacy Policy (this “Policy”) describes how CollegeForge (“CollegeForge,” “we,” “us,” or “our”) collects, uses, discloses, retains and protects personal information in connection with the collegeforge.ai website, the CollegeForge application, and any related services (collectively, the “Service”). It also describes the rights and choices available to you and how to exercise them. By using the Service, you acknowledge that you have read and understood this Policy.

1. Definitions

• “Personal Information” means information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual or household.
• “Student” means a user of the Service who is enrolled in, or preparing to apply to, a secondary or postsecondary educational program.
• “Student Data” means Personal Information about a Student that is created or provided by the Student, a Parent, or a School in the course of using the Service, or that is gathered by us through the operation of the Service, including “covered information” and “education records” as those terms are defined under applicable law.
• “Parent” means a parent or legal guardian of a Student.
• “School” means a school, school district, local education agency, or other educational institution or organization that makes the Service available to its Students or staff under an agreement with us.
• “De-identified Information” means information that cannot reasonably be used to identify, or be linked to, a particular individual, and that we maintain and use only in de-identified form.

2. Information We Collect

2.1 Information you provide

• Account information — username, email address, and login credentials.
• Academic information — courses, grades, activities, and deadlines you choose to record.
• Questionnaire responses — answers you provide to our guidance tools, and the results generated from them.
• Uploaded materials — documents or text you submit, and content generated from them.
• Practice results — your answers and scores on practice activities.
• Tutor conversations — messages you exchange with our AI tutor.
• Communications — information you provide when you contact us through our web form or by email.

2.2 Information collected automatically

When you access the Service, our hosting provider’s servers automatically receive standard technical information, such as your IP address, browser type, device type, and the pages requested, and record it in server logs. We use this information solely to operate, secure, and troubleshoot the Service.

2.3 Information from Schools and linked users

If a School makes the Service available to you, the School may provide us with information needed to establish and administer your account, such as your name, School email address, and grade level. A linked Parent or counselor may also provide information in connection with linking to your account.

3. How We Use Information

We use Personal Information only for the following purposes:

• To provide, maintain, and personalize the Service, including adaptive practice and guidance features you request.
• To make your information available to you across your devices.
• To display aggregate, de-identified comparisons against other users, which never identify another user or disclose another user’s results.
• To respond to your inquiries and provide customer support.
• To send you administrative communications about your account and the Service, such as notices of changes to this Policy.
• To protect the security and integrity of the Service and to detect, prevent, and respond to fraud, misuse, or unlawful activity.
• To comply with legal obligations and to enforce our agreements.

We may use De-identified Information to maintain, develop, evaluate, and improve the Service and for other educational purposes. We will not attempt to re-identify De-identified Information.

4. Our Student Data Commitments

CollegeForge is designed and marketed for use by high school Students. Consistent with the California Student Online Personal Information Protection Act and the comparable student privacy laws of other states described in Section 12, we make the following commitments for all Student Data, regardless of where a Student resides:

• No sale. We do not sell, rent, or trade Student Data.
• No targeted advertising. We do not use Student Data, or any information we acquire through the Service, to serve targeted advertising on the Service or on any other website or service, and we do not display third-party advertising on the Service.
• No non-educational profiling. We do not use Student Data to build a profile of a Student for any purpose other than providing the Service and furthering the Student’s educational and postsecondary planning goals.
• Limited disclosure. We disclose Student Data only as described in Section 6.
• No model training. We do not use Student Data, and do not permit our service providers to use Student Data, to train artificial intelligence models.
• Security. We maintain reasonable security procedures and practices appropriate to the nature of Student Data, as described in Section 10.
• Deletion. We delete Student Data upon the request of the Student, the Student’s Parent, or the School that provided it, as described in Section 9, subject only to retention required by law.

These commitments do not prevent us from recommending additional content or features within the Service to a Student, provided that the recommendation is not determined in whole or in part by payment or other consideration from a third party. Where a Student directs us to share their information with a third party, such as a postsecondary institution or scholarship program, we will do so only at the Student’s affirmative direction and, if the Student is under 18, with the consent of a Parent where applicable law requires it.

5. The AI Tutor

The AI tutor is powered by a third-party artificial intelligence provider. When you use the tutor, your message and related context are transmitted to that provider for the sole purpose of generating a response. The provider processes this information on our behalf under a written agreement that prohibits it from using the information for its own purposes, including training its models. Responses generated by the AI tutor and our guidance tools are informational only. We do not use automated processing to make decisions that produce legal or similarly significant effects concerning you.

6. How We Disclose Information

We disclose Personal Information only in the following circumstances:

• Linked users, at your direction. On any account, a linked Parent or counselor can view only the information you choose to share with them.
• Your School, for School-provided accounts. If your account is provided by a School, the School administers it. Authorized School personnel may access the information in that account, including information you have not chosen to share with a linked user, to the extent provided in the School’s agreement with us and permitted by FERPA and applicable state law. A School has no access to an account you create yourself, other than information you choose to share with a linked counselor.
• Service providers. We engage service providers that perform services on our behalf, including our hosting provider, GoDaddy, and our AI provider. Service providers are contractually bound to use Personal Information only to perform services for us, to protect it, and not to sell it or use it for advertising.
• Legal requirements. We may disclose information where we believe in good faith that disclosure is required to comply with applicable law, regulation, legal process, or enforceable governmental request, or to protect the safety of any person.
• Business transfers. If CollegeForge is involved in a merger, acquisition, or sale of all or a portion of its assets, Personal Information may be transferred to the successor entity, which will be bound by the commitments in this Policy with respect to previously collected Student Data. We will notify affected users before their information becomes subject to a different privacy policy.

We do not sell Personal Information, and we do not “share” Personal Information for cross-context behavioral advertising, as those terms are defined under applicable state law.

7. School Use of the Service

7.1 FERPA

Where a School provides Student Data that constitutes education records under the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations, 34 C.F.R. Part 99 (“FERPA”), we act as a “school official” with a “legitimate educational interest” under 34 C.F.R. § 99.31(a)(1)(i)(B). In that capacity, we perform an institutional service or function for which the School would otherwise use its own employees, we are under the direct control of the School with respect to the use and maintenance of education records, and we use and redisclose education records only as FERPA and our agreement with the School permit. The School retains ownership and control of those records.

7.2 Requests concerning School-provided records

Parents and eligible Students who wish to inspect, review, or request correction of education records held in the Service should contact their School. We will assist the School in responding to such requests. If we receive a request directly, we will refer it to the School unless our agreement with the School provides otherwise.

7.3 Protection of Pupil Rights Amendment

Where a School directs Students to complete questionnaires through the Service, the School is responsible for providing any notice and obtaining any consent required by the Protection of Pupil Rights Amendment, 20 U.S.C. § 1232h.

7.4 Data privacy agreements

We will enter into data privacy agreements with Schools as required by applicable state law. Where the terms of such an agreement conflict with this Policy, the agreement governs with respect to the Student Data provided by that School.

8. Children and Minors

8.1 Children under 13

The Service is not directed to children under the age of 13, and users must be at least 13 years old to create an account. We do not knowingly collect Personal Information from children under 13 in a manner that would require parental consent under the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and its implementing rule, 16 C.F.R. Part 312 (“COPPA”). If we learn that we have collected Personal Information from a child under 13 without the consent required by COPPA, we will delete it promptly. If you believe a child under 13 has provided us with Personal Information, please contact us as set out in Section 18.

8.2 Students aged 13 to 17

Students aged 13 to 17 may create their own accounts, and a Parent may link to a Student’s account. A Parent may request to review, correct, or delete their child’s Personal Information by contacting us as set out in Section 18. We will take reasonable steps to verify that the requester is the Student’s Parent before acting on the request.

9. Data Retention and Deletion

We retain Personal Information, including uploaded materials, for as long as your account remains active or as needed to provide the Service. When you delete your account, or when a Student, Parent, or School submits a verified deletion request, we delete the associated Personal Information, except to the extent we are required to retain it to comply with a legal obligation. Communications submitted through our web forms are retained for up to 180 days. Server logs are retained only for as long as necessary for security and troubleshooting purposes. Upon termination of an agreement with a School, we will return or delete the Student Data provided by that School in accordance with the agreement and applicable law.

10. Data Security and Incident Notification

We maintain reasonable administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, use, disclosure, alteration, or destruction, including protection of account credentials and optional additional account security features. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a security incident involving unauthorized access to or acquisition of Personal Information, we will notify affected individuals, and, where the incident involves Student Data provided by a School, the affected School, without unreasonable delay and within the time periods required by applicable federal and state law, and will notify regulators where required.

11. Your Privacy Rights

11.1 Your rights

Subject to applicable law, you may have the right to: (a) confirm whether we process your Personal Information and access it; (b) obtain a copy of your Personal Information in a portable format; (c) correct inaccurate Personal Information; (d) delete your Personal Information; and (e) opt out of the sale of Personal Information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in these last activities. Many of these rights can be exercised directly in your account settings.

11.2 How to submit a request

To submit a request, email privacy@collegeforge.ai or use our contact form. We will verify your identity before fulfilling a request, generally by confirming control of the email address associated with your account. You may designate an authorized agent to submit a request on your behalf; we may require proof of the agent’s authority and may ask you to verify your identity directly. We will respond within 30 days, or within any shorter period required by applicable law. Where permitted by law, we may extend this period once by an additional 45 days, and we will notify you if we do so.

11.3 Appeals

If we decline to take action on your request, you may appeal our decision by replying to our response or emailing privacy@collegeforge.ai with the subject line “Privacy Appeal.” We will respond to an appeal in writing within 60 days, explaining any action taken and the reasons for our decision. If your appeal is denied, you may contact the attorney general of your state.

11.4 Non-discrimination

We will not deny you the Service, charge you a different price, or provide a different quality of service because you exercised any of your privacy rights.

11.5 Opt-out preference signals

Because we do not sell or share Personal Information or engage in targeted advertising, there is nothing to opt out of. We nonetheless treat a Global Privacy Control signal as a valid request to opt out of any such activity. The Service does not respond differently to browser “Do Not Track” signals, because we do not track users across third-party websites over time.

12. State Student Privacy Laws

Many states have enacted laws governing operators of online services designed and marketed for K-12 school purposes, and governing vendors that receive Student Data from Schools. We comply with the laws applicable to us, including the following:

• Arizona — A.R.S. § 15-1046.
• California — the Student Online Personal Information Protection Act, Cal. Bus. & Prof. Code § 22584 et seq.; and Cal. Educ. Code § 49073.1, governing contracts between local educational agencies and third-party providers. See also Section 13.
• Colorado — the Student Data Transparency and Security Act, C.R.S. § 22-16-101 et seq.
• Connecticut — Conn. Gen. Stat. §§ 10-234aa to 10-234dd.
• Delaware — the Student Data Privacy Protection Act, 14 Del. C. § 8101A et seq.
• Georgia — the Student Data Privacy, Accessibility, and Transparency Act, O.C.G.A. § 20-2-660 et seq.
• Illinois — the Student Online Personal Protection Act, 105 ILCS 85/. At a School’s request, we will provide the School with a description of the Student Data we collect and how it is used, and we will notify the School of any breach involving its Students’ data as the Act requires.
• Maryland — the Student Data Privacy Act, Md. Code, Educ. § 4-131.
• Nevada — NRS 388.281 to 388.296.
• New York — N.Y. Educ. Law § 2-d and 8 NYCRR Part 121. Where we receive Student Data from a New York educational agency, we will comply with that agency’s Parents’ Bill of Rights for Data Privacy and Security and its data security and privacy plan requirements, and will notify the agency of any unauthorized release of Student Data within the period the regulations require.
• Oregon — the Oregon Student Information Protection Act, ORS 336.184.
• Texas — Tex. Educ. Code § 32.151 et seq.
• Utah — the Student Data Protection Act, Utah Code § 53E-9-301 et seq.
• Virginia — Va. Code § 22.1-289.01.
• Washington — the Student User Privacy in Education Rights Act, RCW 28A.604.

Where a state law imposes requirements beyond those described in this Policy, we comply with that law for Students and Schools located in that state. The commitments in Section 4 apply to all Students regardless of location.

13. Additional Information for California Residents

13.1 California Consumer Privacy Act

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”), applies to us, California residents have the rights described in Section 11. In the preceding 12 months we have collected the following categories of Personal Information, from the sources and for the business purposes described in Sections 2 and 3: identifiers (such as name, username, email address, and IP address); education information; internet or other electronic network activity information; and inferences drawn to personalize the Service. We disclose these categories for business purposes only to the recipients described in Section 6. We do not sell or share Personal Information, including the Personal Information of consumers under 16 years of age. We use sensitive Personal Information, such as account login credentials, only for purposes permitted by Cal. Code Regs. tit. 11, § 7027(m).

13.2 Removal of content posted by minors

Under Cal. Bus. & Prof. Code § 22581, California residents under 18 who are registered users may request removal of content or information they have posted on the Service. Most content can be deleted directly in the app. You may also submit a request as described in Section 11.2. Removal may not ensure complete or comprehensive removal of the content where, for example, it has been shared by a third party.

13.3 Shine the Light

We do not disclose Personal Information to third parties for their own direct marketing purposes, as described in Cal. Civ. Code § 1798.83.

14. Additional Information for Residents of Other States

Residents of states with comprehensive consumer privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, may have the rights described in Section 11, to the extent those laws apply to us. Several of these laws impose heightened protections for the Personal Information of minors, including restrictions on targeted advertising, sale, and profiling. We do not engage in any of these activities with respect to any user.

15. Cookies and Similar Technologies

The CollegeForge application uses strictly necessary cookies and browser storage to keep you signed in and maintain your session. We do not use advertising, analytics, or cross-site tracking cookies. Our marketing website does not set cookies. Our website loads typefaces from Google Fonts, and in doing so your browser transmits your IP address to Google. You may configure your browser to block cookies, but doing so may prevent you from signing in to the application.

16. International Users

The Service is intended for users in the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States, where data protection laws may differ from those in your jurisdiction.

17. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will update the effective date above and notify account holders by email or through the Service before the changes take effect. We will not make a material change to how we use or disclose previously collected Student Data without providing notice and, where required by law or our agreement with a School, obtaining consent.

18. Contact Us

If you have questions about this Policy or wish to exercise your rights, please contact us by email at privacy@collegeforge.ai or through our contact form.