Privacy, in plain English

What we collect

If you just roast a list: the school names you paste. That's it — no account, no name, nothing else. We scrub anything that looks like an email or phone number before it goes anywhere.

If you sign up, your account can hold: your first name, email, and graduation year; your school list and notes; your activities and awards; your class schedule; student stats you enter or confirm (GPA, test scores, class rank, course counts, rec-letter tracking); documents you chooseto keep in School documents; and the optional background questions below. Everything past name, email, and grad year is optional — the product works fine with blanks. When essay feedback ships, your drafts join this list — see below for how they're treated.

The background questions

Onboarding asks about your first-generation status, gender, and race or ethnicity. Every one is optional, every one has a "prefer not to say," and here is exactly what happens to the answers:

• Your first-generation status, gender, and race or ethnicity are never sent to any AI model. Not in any feature, not as "context," not ever.
• They are never sold or shared with anyone.
• They never appear in analytics events.
• You can edit or clear any of them anytime in settings → About you.
• They're hard-deleted with your account, like everything else.

Your state isn't in this bucket — it travels with your academic context for reads, exactly as listed below.

Why ask at all? It helps us build fairer guidance. That's the whole use.

Scans

When you scan a transcript, score report, or resume, the file is processed in memory and sent to OpenAI's API for extraction only — pulling out the printed numbers and entries so you don't retype them. The file itself is not stored anywhere unless you tick "keep a copy in School documents." The extracted numbers and entries are saved only after you review and confirm them — nothing lands in your account silently. OpenAI does not use API data to train its models by default.

What reaches the AI — and what never does

Exactly four things ever go to OpenAI, each only when you ask for the feature:

• Your school list, for the roast.
• An activity's text plus your academic context (your other activities, awards, classes, stats, grad year, and state), for its smart read.
• Your stats and activities together, for the focus read.
• A document you scan, for extraction.

Never sent: your first-generation status, gender, or race or ethnicity — in any payload, for any feature. And essays don't go anywhere until essay feedback ships and you ask for feedback on a draft.

Essays are private. Full stop.

Essay drafts are locked to your account with row-level security, encrypted at rest, never included in analytics, never used to train any AI model, and never visible to anyone but you. You can delete any draft, or all of them, in one click.

When you ask for feedback, the draft is sent to OpenAI's API to generate that feedback. OpenAI does not use API data to train its models by default — we're stating that here instead of burying it.

What we never do

• Sell your data. Ever.
• Run ads. Ever.
• Write your essays or any application content.
• Predict your admission odds.
• Share your list, notes, stats, documents, demographics, or essays with parents, counselors, or schools.

Deleting everything

Settings → "Delete my account + all data." It's an immediate hard delete: profile, list, notes, activities, awards, class schedule, stats, background answers, essays, and every uploaded file are gone the moment you confirm. No grace period, no retention window, no "we'll process your request."

Age

Apto is for people 13 and older. If you're under 13, we can't offer you an account (COPPA).

The tools we run on

Supabase (database + sign-in), Vercel (hosting), OpenAI (the roast, smart reads, and document extraction), Resend (deadline emails you can turn off in settings, separately per type), PostHog (product analytics — which never see essay text or demographics), and Upstash (rate limiting). Each gets the minimum it needs to do its job.

One more honest thing

The roast and the reach/target/safety bands are a data-grounded read, not admissions advice or a prediction. And always verify deadlines on each school's official page — we source and re-check ours, but the official page is the law.

Questions

Email hello@tryapto.com— you'll get the founder, not a ticket queue.