Privacy Policy

1. Scope of This Policy

This policy applies to information collected through Astrai's public website, guest search experience, sign-in flows, onboarding, profile features, and scholarship-matching product experience.

It does not apply to third-party sites, applications, scholarship providers, or services that you may visit through links from Astrai.

2. Information We Collect

Depending on how you use Astrai, we may collect the following categories of information:

• Account and authentication data — Email address, sign-in method, and basic profile details received from authentication providers such as Google or LinkedIn, including your display name and profile image when provided.
• Profile and matching data — Information you choose to provide for scholarship matching, such as full name, age, grade, GPA, ZIP code, city, county, state, country, high school, high school place ID, interests, goals, gender, ethnicity, religion, citizenship status, first-generation status, financial-need indicator, and military-family indicator.
• Profile image data — If you upload an avatar, we store the image and the associated public URL in our storage system.
• Search and product activity — Search queries, saved preferences, scope selection, filters, page views, feature interactions, onboarding progress, and related usage events.
• School lookup inputs — Text you type into the school autocomplete feature and related lookup context needed to return school suggestions.
• Technical and device data — Information such as IP address, browser type, device data, operating system, referral URL, and similar usage or diagnostic information that may be collected automatically by us or our service providers when you use the service.
• Browser-stored data — We use cookies, local storage, and session storage to maintain sessions, preserve onboarding drafts, remember filters and preferences, support cross-tab sign-in handoff, and improve product performance.
• Communications — Information you provide when you email us or contact us for support, legal requests, or deletion requests.

3. Sources of Information

We collect information:

• Directly from you when you search, sign up, complete onboarding, edit your profile, upload an avatar, or contact us.
• From authentication providers when you choose to sign in with them.
• From browser and device interactions with Astrai.
• From service providers that help us host, authenticate, analyze, and operate the service.

4. How We Use Information

• To create and secure your account and authenticate you.
• To build and maintain your profile.
• To personalize scholarship and opportunity matching.
• To support location-aware and school-aware matching features.
• To operate guest search, onboarding, and continuity features across tabs or sessions.
• To analyze product usage, debug issues, improve performance, and understand how Astrai is used.
• To communicate with you about sign-in, support, legal requests, service updates, or policy changes.
• To prevent misuse, enforce our terms, and protect Astrai, our users, and the public.
• To comply with legal obligations and respond to lawful requests.

5. Cookies, Local Storage, and Analytics

Astrai uses browser storage and similar technologies for core product functionality and analytics.

• Authentication — Session-related cookies and similar storage may be used to keep you signed in and complete authentication flows.
• Product functionality — We use local storage and session storage to preserve onboarding drafts, search state, filters, scope settings, temporary guest-search context, and sign-in handoff state.
• Analytics — We use PostHog and Vercel Analytics to understand traffic and product usage. These tools may use cookies, local storage, or similar identifiers to help us analyze how the service is used.

If you block certain cookies or browser storage features, parts of Astrai may not function correctly.

6. Third-Party Services and APIs

Astrai relies on third-party providers to operate the service. Based on the current product implementation, these include:

• Supabase — Authentication, database, and storage infrastructure.
• Vercel — Hosting, deployment, and analytics infrastructure.
• PostHog — Product analytics and event measurement.
• Google — Google Sign-In and Google Places school autocomplete/search support.
• LinkedIn — LinkedIn sign-in support.

When you use Google Places-backed autocomplete, the text you enter may be sent through Astrai's server-side proxy to Google to return school suggestions. When you use Google or LinkedIn sign-in, Astrai receives only the data made available through those sign-in flows.

These third parties operate under their own terms and privacy practices. We encourage you to review them before using those features.

7. When We Share Information

We do not sell or rent your personal information. We also do not use your information for third-party advertising.

We may disclose information only in the following circumstances:

• Service providers — To vendors and infrastructure providers that help us host, authenticate, store, analyze, and operate Astrai.
• At your direction — When you intentionally use features that rely on third-party providers, such as social sign-in or school lookup.
• Legal and safety reasons — If required by law, subpoena, court order, or if reasonably necessary to protect rights, safety, security, or investigate misuse.
• Business transfers — In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction.

8. Public Profile Images

If you upload a profile photo, Astrai stores that image in its avatar storage system and associates it with your profile.

Based on Astrai's current storage configuration, uploaded avatar files are treated as publicly accessible profile images. Do not upload an image you do not want associated with your profile or potentially reachable through its direct URL.

9. Children's Privacy and COPPA

Astrai is intended for users who are at least 13 years old. We do not knowingly allow children under 13 to create accounts or provide personal information through Astrai.

If we learn that we have collected personal information from a child under 13 without the legally required authorization, we will take steps to delete that information and disable the associated account or access as appropriate.

If you believe a child under 13 has provided personal information to Astrai, contact us at sanjith@tryastrai.com so we can investigate and act.

10. FERPA-Related Note

Astrai currently operates as a direct-to-user service. In the current product flow, Astrai generally collects information directly from users rather than receiving school-maintained education records from a school, district, or institution acting under the Family Educational Rights and Privacy Act ("FERPA").

Because FERPA generally applies to education records maintained by an educational agency or institution, or by a party acting for one, information a user provides directly to Astrai is generally not treated by us as a FERPA-governed education record in the current consumer product model.

If Astrai later offers school, district, or institution-facing deployments, data-sharing arrangements, or integrations involving school-maintained student records, we may update this policy, our contracts, and our product controls to address FERPA-specific obligations.

11. Data Retention

We retain information for as long as reasonably necessary to provide the service, maintain accounts, support matching functionality, investigate misuse, comply with legal obligations, resolve disputes, and enforce agreements.

• Account and profile data may be retained while your account remains active and for a reasonable period afterward.
• Browser-stored data may remain on your device until it expires or you clear it.
• Analytics and logs may be retained according to operational and security needs.
• De-identified or aggregated information may be retained longer where it no longer reasonably identifies you.

12. Deletion Requests

You may request deletion of your account-related personal information by emailing sanjith@tryastrai.com from the email address associated with your account or by otherwise providing enough information for us to verify the request.

We may need to retain certain information where required or permitted by law, for security purposes, to complete transactions you requested, to resolve disputes, or to enforce our agreements.

Deleting browser storage on your device may also remove locally saved Astrai preferences, drafts, and session-related information.

13. Security

We use administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, or alteration. These measures include HTTPS/TLS in transit, access controls, and reliance on third-party infrastructure providers with their own security programs.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

14. Your Rights and Choices

Depending on where you live, you may have rights regarding access, correction, deletion, or portability of your personal information, and you may be able to object to or limit certain processing activities.

You may also:

• Edit profile information inside Astrai where features are available.
• Delete or replace your avatar.
• Clear local browser storage through your browser settings.
• Contact us to request account or data review, correction, or deletion.

To exercise legal rights that may apply to you, email sanjith@tryastrai.com.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we may provide additional notice as appropriate. The revised version will be posted here with an updated "Last updated" date.

16. Contact

If you have questions about this Privacy Policy or Astrai's data practices, contact us at sanjith@tryastrai.com or visit our contact page.

This policy is intended to describe Astrai's current product practices. It is not a substitute for advice from qualified counsel about your specific legal obligations.