Privacy is part of the product.
Northstar helps people organize college-planning information. That information can be personal, sensitive, and connected to a student’s future. We will collect only what is reasonably needed to provide the service, explain how it is used, and avoid using private student information as an advertising product.
Only the information needed to make the planning experience useful.
Depending on which features a person uses, Northstar may store an account email, display name, academic details voluntarily entered into a profile, college-list selections, application-planning details, and saved essay drafts or reviews.
We may also receive technical information needed to operate the service, such as browser type, device information, approximate event timing, error logs, and security signals. We should not collect precise location, contacts, unrelated browsing history, or sensitive identity information unless a future feature clearly explains why it is needed and receives appropriate consent.
Information we do not need
- Passwords are handled by the authentication provider and are not visible to Northstar staff.
- We do not require a student to provide a Social Security number, government ID, financial account number, or precise home address.
- Students should not paste recommendation letters, medical information, disciplinary records, or another person’s confidential information into an essay review.
Private writing deserves a higher bar.
Essay drafts and essay feedback are stored for the account that created them so the student can return to earlier versions. They are not public by default, are not used for advertising, and are not sold.
The private essay studio is a coaching tool. It may identify patterns in clarity, structure, specificity, reflection, and prompt alignment. It should not claim to know whether a college will admit a student, and it should not replace a trusted teacher, counselor, or the student’s own judgment.
Users can delete individual reviews. Account deletion should remove the associated drafts and reviews from the active product database, subject to limited backups and security records that may expire on a separate schedule.
Northstar is designed with young users in mind.
Northstar may be used by U.S. high-school students, including minors. We will not knowingly require a minor to accept targeted advertising, sell personal data, or provide more information than the service needs. Features involving public sharing, counselor access, parent access, payments, or external communications should use age-appropriate notices and consent flows.
Where applicable law requires a parent or guardian to consent, Northstar should obtain and document that consent before collecting or using the relevant information. A parent or guardian may contact the product team to ask about a child’s information, request correction, or request deletion, subject to reasonable verification of the requestor’s authority.
This page is a product draft, not a statement that every required youth-privacy process has been completed. Counsel should confirm the final age gates, consent method, notices, retention rules, and jurisdictional coverage before launch.
Keep information only while it has a purpose.
Active account information is kept while the account is open so the product can provide saved planning work. Essay reviews remain until the user deletes them or deletes the account. Security logs and backups may persist for a limited operational period before rotation.
Deletion requests should be clear, accessible, and completed within the period required by applicable law. Deletion may be delayed where information must be retained for security, fraud prevention, legal compliance, payment disputes, or an already-open support investigation; the product should explain that exception rather than silently ignoring a request.
People should be able to control their information.
- View and update profile details.
- Delete saved college selections and essay reviews.
- Delete the account and request removal of associated personal information.
- Decline optional analytics.
- Ask what information is held, where it came from, and which vendors process it.
- Request correction of inaccurate information.
- Ask a parent or guardian to contact Northstar about a minor’s account where appropriate.
Requests should be sent through the product’s designated privacy contact after that contact is established. The production version should publish a real contact address, response time, identity-verification process, and appeal process.
Security is an ongoing practice.
Northstar should use authenticated access controls, row-level database security, encrypted connections, least-privilege vendor access, secure secret handling, dependency updates, audit logging, and a process for responding to incidents. No online service can promise perfect security. If a material incident occurs, affected people should receive a clear notice consistent with applicable law.
Tell people when the promise changes.
If Northstar changes how personal information is collected or used, it should update this notice, identify the effective date, and provide additional notice or consent when the change is material. A new purpose should not be hidden in a routine wording update.
This is a product and policy draft for review. It is not legal advice and should be reviewed by qualified counsel before Northstar accepts public users, charges for subscriptions, processes minors’ data at scale, or enables any research or analytics program.
See Northstar Plus →