legal

Privacy policy

This explains what ace collects, why we collect it, who else processes it, and how to get it back or get it deleted. It is written to be read, not to be survived.

effective 2 august 2026 · last updated 2 august 2026

1. Who we are

ace is an academic navigation service for university students, operated by the ace team. For anything in this policy, and for any request about your data, the contact is privacy@acecollege.app.

ace is an independent product. It is not affiliated with, endorsed by, or sponsored by The Pennsylvania State University or any other institution.

2. What we collect

Category	What it is	When
Waitlist details	Your email address, and a referral tag if you arrived through a shared link.	When you join the waitlist.
Account details	Email address and display name, held through our authentication provider. We never see or store your password.	When you create an account.
Your selected major	The programme you tell us you are studying.	When you set it.
Documents you upload	Degree Audit or What-If reports, and the text extracted from them: courses taken, grades, credits, requirements outstanding.	Only when you choose to upload one.
Conversations	The questions you ask, the answers ace gives, and any rating you leave on an answer.	Each time you use the chat.
Basic technical data	Aggregate page analytics. See cookies and analytics.	While you browse.

We do not ask for, and do not want, your student ID number, government ID, payment details, or any special category data such as health or biometric information. Please do not put those into a chat message.

3. Why we collect it

To answer your questions accurately. Knowing your major, catalog year and completed courses is the only way ace can tell you what applies to you rather than to students in general.
To keep your account and history working across sessions and devices.
To improve answer quality. We review down-rated answers and answers that could not be grounded in a source, so we can fix the underlying gap.
To operate and secure the service, including preventing abuse.

We do not sell your personal information, and we do not share it with advertisers. We do not use your uploaded documents or conversations to train our own models.

4. Documents, questions and AI processing

Read this part properly. To answer a question, ace sends the text of your question, along with relevant context, to OpenAI, which generates the answer. Where your question relates to your own progress, that context can include information taken from a degree audit you uploaded, such as courses, grades and outstanding requirements.

In plain terms: your academic information leaves our systems and is processed by a third party in order to produce an answer. If you would rather that did not happen, do not upload a document, and avoid putting personal academic detail into your questions. ace still works for general questions without any of it.

OpenAI processes this data as our service provider under their API terms, which at the time of writing state that data submitted through the API is not used to train their models. We do not control their terms and they may change.

PDF text extraction and parsing happen on our own servers. The file itself is not sent to OpenAI, only the relevant extracted text needed to answer a question.

5. Who else processes your data

We use a small number of service providers. They act on our instructions and handle only what they need to.

Provider	What they do	What they handle
Clerk	Accounts and sign-in	Email, display name, session data. Passwords are held by them, never by us.
OpenAI	Generates answers	Question text and the context needed to answer it. See section 4.
Railway	Hosts the backend and database	Everything stored: account records, uploaded document data, conversations.
Vercel	Hosts the website and provides analytics	Aggregate page views. See section 6.

We may also disclose information if we are legally required to, or where it is necessary to protect someone's safety or our legal rights. If ace is ever acquired or merged, data may transfer as part of that, and this policy would continue to apply until you are told otherwise.

These providers may process data in the United States and elsewhere. If you are in the UK or EEA, that means your data may be transferred outside your region, under the transfer safeguards those providers put in place.

6. Cookies and analytics

We keep this deliberately small.

Essential cookies. Our authentication provider sets a session cookie so you stay signed in. Without it, the product cannot work.
Local storage. Your browser stores your chat history and layout preferences on your own device. That stays with you and is not sent to us.
Analytics. We use Vercel Web Analytics on the marketing site. It is privacy-oriented, does not use cookies for tracking, and does not build a profile of you or follow you across other websites.

We do not run advertising trackers or third-party marketing pixels. You can clear local storage at any time in your browser settings.

7. How long we keep it

Account details are kept while your account exists.
Uploaded documents and their parsed data are kept until you replace them or delete your account. Deleting your account deletes them.
Conversations are kept while your account exists, so your history is there when you return.
Waitlist emails are kept until we launch and you either take up a place or ask to be removed.

When you delete your account, associated records are removed from our live database. Backups may hold copies for a short period before rotating out.

8. Your rights and how to use them

Wherever you live, you can ask us to:

Show you what we hold about you.
Correct anything that is wrong.
Delete your account and the data attached to it.
Export your data in a portable format.
Stop a particular use, or withdraw consent you previously gave.

If you are in the UK or EEA, these are your rights under the UK GDPR and the GDPR, and our legal bases are contract (to run the service you asked for), legitimate interests (to keep it working and improve it), and consent where you chose to upload a document. You may complain to your local data protection authority.

If you are in California, you have rights under the CCPA and CPRA to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of. We will not discriminate against you for exercising any right.

Email privacy@acecollege.app and we will respond within 30 days. We may need to confirm it is really you before acting on a request.

9. A note on FERPA

FERPA is the US law covering education records held by schools. It applies to educational institutions, not to us: ace is not a school, and is not acting as a school official on any university's behalf.

When you upload your degree audit, you are sharing your own record with a service you chose. That is your decision to make, and you can undo it by deleting the document or your account.

10. Security

Traffic is encrypted in transit. Access to production data is limited to people who need it. Authentication is handled by a specialist provider so we never hold your password.

No service can promise perfect security, and we will not pretend otherwise. If we ever become aware of a breach affecting your personal data, we will tell affected users and any regulator we are required to notify, without undue delay.

11. Children

ace is built for university students and is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, email us and we will delete it.

12. Changes

If we change this policy we will update the date at the top. If a change materially affects how we handle your data, we will tell registered users directly rather than relying on you to notice.

13. Contact

Privacy and data requests: privacy@acecollege.app
Anything else: hello@acecollege.app

See also our Terms of use and Accessibility statement.