Legal
How NDS handles the information students and families trust us with.
Draft for privacy counsel review. We will identify the final operator, jurisdiction, and required legal disclosures before this policy is presented as final.
NDS is open to the public. High school students 13 or older and parents or guardians 18 or older can create accounts. This policy and our terms of use are still drafts. Neither has been reviewed by a lawyer yet, and we expect to revise them as that review happens.
You can delete your account and everything in it at any time from account settings.
This Privacy Policy explains how NDS collects, uses, protects, shares, and retains information when you use our website, dashboards, and related services (the “Service”). NDS is an organizational tool for high-school students preparing college applications, with limited read-only access for a parent or guardian a student chooses to invite.
This policy is written for a service used by students, including many minors. It describes our current practices and is a draft pending qualified privacy counsel review. It is not a substitute for the legal disclosures that will be completed when NDS confirms its legal operator, jurisdiction, and final compliance program.
NDS is an organizational tool for high school students preparing college applications. Students can share progress with a parent or guardian they invite. Student accounts are for people 13 and older, parent and guardian accounts are for adults 18 and older, and many of our users are minors, so this policy is written with that in mind.
To create an account, we collect your email address and authentication information. We collect the information you choose to enter into the Service, which may include your name, school, profile details, activities, awards, academic and test records, college lists, applications, tasks, deadlines, opportunities, feedback, and essay-planning details.
We collect only information the Service needs to provide its student-planning workflows. Optional fields are identified as optional; leaving them blank does not prevent you from using the Service. We also receive limited technical information necessary to operate and secure the Service, such as session information, security logs, and information used by our anti-abuse service when you use protected forms.
We use information to provide and secure the Service; display your records to you; honor the parent-access choices you make; create, link, and manage the Service features you request; respond to support requests; prevent misuse; comply with legal obligations; and maintain the Service. We use administrator-maintained reference content to power factual planning tools, but we do not use student data to generate admissions predictions, applicant scores, rankings, or personalized recommendations.
We do not sell personal information, show advertising, or use student data for behavioral advertising. We do not create public student profiles. We do not use student data to train generative-AI models or infer sensitive traits.
You can optionally connect your own Google account so NDS can create essay documents in your Drive. We request only Google's drive.file scope, which gives us access solely to the files this app creates. It does not give us access to the rest of your Drive or files you didn't create through NDS.
The connection is entirely optional, and you can disconnect it at any time. The access token we store for this connection is encrypted.
Your records are private to your account by default. Other students cannot access them. Pages containing student information are not intended to be indexed by search engines.
A parent or guardian receives access only after accepting a student-initiated invitation. That access is read-only and limited to the supported parent dashboard. It does not include essays, private records, academic or test details, or other information the Service does not expressly make available. A student can revoke parent access at any time, and revocation takes effect immediately in the Service.
Administrators maintain public reference content, such as university and opportunity listings. That role does not include routine access to student records. Any exceptional support access requires a specific purpose, narrow scope, separate authorization, and an audit trail.
We do not sell your data. We do not show advertising or share your information with advertisers. We do not create public student profiles, and pages that contain student data are not indexable by search engines.
Your content is used only to run the product for you.
We use a limited set of providers to operate the Service. Supabase provides database hosting and authentication. Vercel hosts the application. Resend delivers transactional emails, such as account confirmations, password-recovery messages, and parent invitations. Cloudflare helps protect sign-up, sign-in, password-reset, and contact forms from automated abuse. Google Drive and Google Docs are used only when you choose to connect Google Drive for essay documents.
Each provider receives information only as necessary to provide its service to NDS. We may also disclose information where required by law, legal process, or a valid governmental request, or when reasonably necessary to protect users, the Service, or the public.
You. Your records are private to your account by default.
A parent or guardian you invite. After they accept the secure invitation with their own account, their dashboard shows the progress you chose to share, such as deadlines, your college list, and opportunity statuses. They can follow along but cannot edit your work. Essays, files, and private records are not included. You can stop sharing at any time, effective immediately.
Administrators maintain public reference content such as university and opportunity listings. That role does not include browsing student data; any exceptional support access requires an explicit purpose, narrow scope, and an audit trail.
You may choose to connect your own Google account so NDS can create essay documents in your Google Drive. This connection is optional. NDS requests Google’s limited drive.file permission, which is restricted to files the Service creates and does not provide access to the rest of your Drive.
NDS stores the encrypted connection credential and the identifiers and links needed to connect the Service to those documents. It does not ingest the contents of your Google documents after creation. You can disconnect Google Drive at any time. Documents in your Drive remain yours: deleting an NDS account or disconnecting Google Drive removes NDS’s connection and local links, not the documents from Google Drive.
You can access, correct, and delete the information you've entered, and revoke any sharing you've set up.
You can download a copy of your data at any time as a JSON file from /api/account/export. You can also delete your account yourself from account settings. This removes your account and all of its data, including activities, awards, records, applications, essays, and any invited-parent access.
You can access and update the information you have entered, manage parent access, and control your in-app notification preferences. You can download an authenticated JSON export of your account and student-owned records from account settings. The export excludes credentials, sessions, encrypted connection credentials, token hashes, audit logs, and the contents of Google documents that NDS does not store.
You can delete your student account from account settings. This requires an authenticated request, a clear acknowledgement, a confirmation phrase, and a final confirmation. Deletion removes the account and its student-owned records, and revokes active parent access and pending invitations. Some minimal, non-identifying operational audit information may remain where necessary for security and accountability.
We use a small number of other companies to run NDS, and each only sees the data it needs to do its job:
Supabase stores our database and handles account authentication. Vercel hosts the application. Resend delivers the transactional emails the product sends, including sign-up confirmations, password recovery, and parent invitations. Google's Drive and Docs services handle essay documents, but only for students who choose to connect Google Drive. Cloudflare provides the anti-abuse check on our sign-up, sign-in, password-reset, and contact forms; when you use one of those forms Cloudflare receives your IP address and basic information about your browser in order to tell a person apart from an automated script, and it does not use that information to build an advertising profile of you.
NDS account data is stored and processed in AWS’s us-west-2 region in Oregon, United States. We keep account data while the account remains active. When you delete your account, we remove the account and associated student-owned records as described above.
We maintain periodic logical backups for operational recovery. Backups are not deleted on the same schedule as a live account, so information removed from the Service may persist in an older backup until that backup ages out. Google documents created in your Drive follow Google’s retention controls and are not deleted by NDS.
NDS uses the cookies necessary to keep you signed in, maintain your session, and protect the Service. We do not use analytics cookies, advertising cookies, or third-party tracking scripts. Cloudflare receives your IP address and limited browser information when you use a protected form so it can distinguish a person from an automated request; it is not used by NDS to build an advertising profile.
We keep your data for as long as your account exists. Deleting your account removes it. We also keep periodic backups, which are logical database dumps held by the operators. Those backups are not deleted on the same schedule as your account, so a deleted account's data can persist in an older backup for some time before it ages out.
We use technical and organizational measures designed to protect information, including authentication safeguards, database row-level security, least-privilege access controls, encrypted Google Drive connection credentials, secure invitation controls, and audit logging for sensitive operations. There is no administrator path to student essays.
No system is perfectly secure. If we discover an exposure of personal information that requires notice, we will provide notice consistent with applicable law and explain the steps we are taking.
Student accounts are for users who are at least 13 years old. We do not knowingly maintain accounts for children under 13. If we learn that an account belongs to a child under 13, we will close it and delete its data. The student’s parent-access invitation is optional, student-initiated, and read-only; it is not a substitute for any consent required by applicable law.
Every student's records are isolated at the database level by row-level security, so one student's data is not reachable by another student's account. OAuth tokens for connected services, like Google Drive, are stored encrypted. There is no administrator path to student essays. Administrator actions on the platform are logged and auditable.
No security measure is perfect, but these are real, enforced controls, not aspirations.
If we discover that your data has been exposed in a way it shouldn't have been, we will tell you promptly, explain what happened, and describe what we're doing about it.
NDS is operated by three individual co-founders. There is no incorporated company behind it yet. For any question about this policy or your data, email privacy@ndscholars.com.
If this policy changes in a way that affects you, we will say so plainly on this page. Questions about it are welcome at privacy@ndscholars.com.
NDS is currently operated by three individual co-founders; there is not yet an incorporated company operating the Service. We may update this policy as the Service, its legal operator, or applicable law changes. If an update is material, we will post the revised policy and its new version, and ask for fresh consent when appropriate.
Questions, requests, or concerns about this policy or your information can be sent to privacy@ndscholars.com.
