Privacy

This policy explains what Chance Merchant (“we”) collects, why, who else handles it and how to delete it. The people who run Chance Merchant decide how your information is used; there is no separate company behind it yet. We store your information for one reason: so that your drafts and reports are still there when you come back, and so that we can run a read when you ask for one.

What we collect

Account details

When you sign in with Google, we receive your name, email address and profile picture. We never see your Google password.

Your application

Everything you type into the form: grades, test scores, courses, activities, honors, essays, recommenders, intended majors, your state and country, and any other context you add. Some of it is sensitive: your parents' education and occupation, and whether you are a first-generation or low-income applicant. Essays, activities and the additional information box can reveal more, such as your health, religion, sexual orientation, family circumstances or immigration status, if you write about them. Include only what you are comfortable with; nothing of that kind is required.

Your transcript

If you upload one: the file as you uploaded it, and the courses, grades, GPA and rank we extract from it. A transcript often shows more than that, such as a student ID number, your date of birth, your home address or part of a Social Security number. We don't need any of those: cover them before you upload.

Your results

For each run: a copy of the application as you submitted it, the reader notes, ratings, decision and report.

Usage records

Which features you used and when.

Payments

For each payment: the amount, the date and Stripe's reference for it, and your credit balance. Your card details go to Stripe; we never see or store your card number.

Your agreement

When you tick the box at sign-in: that you confirmed your age and accepted the Terms and this policy, which version, when, and the IP address.

Security records

When a request is refused, a data download is made or an account or run is deleted, we record what happened, when, the account involved and the IP address. These records hold nothing from your application.

Technical logs

Our hosting provider records requests to the site: IP address, browser type, the page requested and the time.

We don't ask for your race or ethnicity, your home address, your date of birth or a government ID number. Text you paste into autofill is used to fill in the form and is not kept separately.

Other people. An application mentions other people: your parents' work and education, and who is writing your letters. Give only what a college application asks for, and nothing private about anyone else.

How we use it

• To save your drafts and reports and show them to you again.
• To run the committee on your application and produce your report.
• To take payments and keep your credit balance.
• To track our costs, limit abuse, keep the service secure and fix problems.

Reads are produced by AI models with no person reviewing them. A read is an estimate for your own use: it decides nothing about you, and nobody else receives it.

We don't sell your information, share it for advertising, show ads or share your application with any college.

No AI training. We don't use your application, essays, transcript or reports to train or fine-tune AI models, and the AI providers we send them to don't either (see below). We don't read applications to tune the product. We do count things that hold no application content, such as how many runs were made and what they cost us.

Who on our side can see it. Only the people who run Chance Merchant, and only when it is needed: to answer a request you send us, to fix a fault, or to investigate abuse or a payment dispute. Nobody reads applications routinely.

Why we are allowed to. We handle your information because you asked us to (to run the service you signed up for), with the consent you give by ticking the box at sign-in (for anything sensitive you choose to include), to keep the service secure and stop abuse, and to keep the payment records the law requires.

Who else handles it

We use a small number of companies to run the service. They are listed on the Subprocessors page, and they handle your information only to provide their service to us.

• AI model providers. To produce a read, the text of your application, including essays and transcript text, is sent to Anthropic and OpenAI. An uploaded transcript file is sent to Anthropic once so its text can be extracted. Text pasted into autofill is sent to OpenAI. Under both providers' current terms for this kind of access, what we send is not used to train their models, and they keep it for a limited period (up to about 30 days) for safety and abuse monitoring before deleting it. Their own policies govern that handling.
• Database and hosting. Your account, drafts, transcript and reports are stored with our database provider, and the site runs on our hosting provider.
• Stripe. Payments. Stripe receives your email address and the card details you enter in its card form, and can save your card for next time if you choose that there. It also emails you the receipt.
• Google. Sign-in. Stripe's card form also loads a typeface from Google Fonts, so Google sees that request (your IP address and browser) on the payment page.

We may also disclose information if the law requires it, or to protect the safety of a person or the security of the service. If the service is ever transferred to another operator, your information would move with it under this policy, and we would tell you first.

How it is protected

Your information travels over encrypted connections (HTTPS) and is encrypted at rest by our storage provider. Uploaded transcripts sit in a private storage area, and database rules limit each account to its own drafts and reports. No system is perfectly secure, and we can't promise that yours will never be accessed without permission. If a security incident affects your information, we will notify you as the law requires.

How long we keep it

We keep your drafts, transcript and reports until you delete them or delete your account.

• Removing a transcript from the form deletes the file and takes its text out of your drafts. If the file can't be deleted, the form says so and keeps showing it. Uploading a new transcript deletes the one it replaces. Runs you already made keep the copy of the application they were run on, including transcript text, until you delete those runs.
• Deleting a run removes its saved application copy, reader notes and report.
• Deleting your account removes your drafts, runs, transcript files, usage records, payment records, credit balance and sign-in record from our systems, and your saved card from Stripe. Stripe keeps its own record of past payments, as payment law requires of it. Copies in our providers' backups and logs expire on their schedules, normally within about 30 days.
• Three records outlive a deleted account, and none holds application content. Security records (the account's internal ID and IP address) are kept for 12 months. The record of your agreement to the Terms (internal ID, version, time, IP address) is kept for 4 years, in case of a dispute. The record of what each run cost us to produce is kept without anything that identifies you.

Your choices

• Delete a run: open it from History and choose Delete this run.
• Delete everything: open Profile in the portal, then Advanced, and choose Delete account. This can't be undone.
• Get a copy: open Profile in the portal, then Advanced, and choose Download my data. You get one file with your account details, every draft, every run with its report and reader notes, your payments and credit history, links to your transcript files, and the agreement and security records about your account.
• Correct something: change your application in the form at any time. For anything you can't change there, write to vnevdev@gmail.com from the address you sign in with. We answer within 30 days.
• Withdraw your consent: delete the content, or the account. That stops any further use; it can't undo a read that has already been run.

We won't treat you differently for making any of these requests.

Cookies and tracking

There are no advertising or analytics trackers on this site, and we don't track you across other sites. The only cookies are ones the service can't work without, which is why there is no cookie banner:

• Ours: the cookies that keep you signed in, set when you sign in.
• Stripe's: on the payment page only, Stripe sets its own cookies to prevent card fraud. They are not used for advertising.
• Your browser also remembers two things that never leave your device: for the open tab, which page to send you back to; and, once you have signed in, that you ticked the agreement box, so the sign-in box is already ticked next time. Untick it, or clear this site's data in your browser, to forget it.

Because nothing is sold or shared for advertising, the site behaves the same whether or not your browser sends a “Do Not Track” or Global Privacy Control signal.

California and other US state rights

Some states give residents the right to know what personal information a service holds, to get a copy, to correct it, to delete it, and to opt out of its sale or sharing for advertising. We don't sell or share personal information in that sense, and we offer the access, correction and deletion choices above to everyone, wherever they live.

Students under 18

The service is meant for students applying to college. You must be at least 13 to use it, and we ask you to confirm that each time you sign in. If you are under 18 you need a parent or guardian's permission. We don't knowingly collect information from children under 13; if we learn that we have, we will delete it. A parent or guardian can write to vnevdev@gmail.com to ask what we hold about their child or to have the account deleted.

Outside the United States

The service is run from the United States for students applying to US colleges, and your information is processed there and wherever our providers operate. By using it from another country you understand that your information is transferred to the United States, whose privacy laws may protect it less than the laws where you live.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to see, correct, delete and receive a copy of your information, to object to or restrict how it is used, and to withdraw consent. The choices above cover each of these, and you can write to vnevdev@gmail.com for any of them. You can also complain to the data protection authority where you live. We have no office or representative in those places.

Changes

If this policy changes in a way that matters, we will update the date above and ask you to accept the new version the next time you open the portal.

Contact

Questions about privacy go to vnevdev@gmail.com.