Privacy Policy

This Privacy Policy describes how Cohorted (“Cohorted,” “we,” “us”) collects, uses, and shares information when you use the Cohorted platform (the “Service”). It is written to reflect what the Service actually does as of the date above — an attorney should confirm it also satisfies the specific privacy laws that apply to Cohorted’s users and jurisdiction(s) before this is published for a public launch.

1. Information we collect

Account information

When you create an account, we collect your email address and password (stored securely by our authentication provider, never in plain text), or, if you sign in with Google, the basic profile information Google provides for that purpose.

Profile and application information you provide

• Basics: name, institution, degree/major, graduation date, GPA(s), journey stage.
• GRE status: whether you’ve taken it, your score, and any planned test date.
• City and state, if you choose to add them — used only to show Opportunities near you.
• Clinical, research, volunteer, employment, and leadership experiences you log, and individual courses you add.
• Schools you save as targets, and your engagement status with Opportunities listings (e.g. “interested,” “contacted”).
• Essay Hub content: stories, themes, essay prompts, and draft versions you write.
• Reports you submit about an Opportunities listing (e.g. flagging outdated information).

Documents you upload for import

If you use the resume or transcript import feature, the PDF you upload is sent to our AI extraction pipeline to identify structured information (like your education, experience, or coursework) for you to review. The uploaded file itself is processed in memory and is not stored in our database or file storage after extraction completes — only the specific fields you review and confirm are saved to your profile.

Technical information

We use session cookies to keep you signed in, and we use an error-monitoring tool that may capture technical details (like a stack trace or the page you were on) when something goes wrong, to help us fix it.

2. How we use your information

We use the information above to:

• Operate your account and the Service’s core features (profile, target schools, timeline, Opportunities, Essay Hub).
• Generate your personalized recommendations and priorities from your own profile, experience, and saved-program data — this logic runs on our own servers, not a third-party AI model.
• Power the resume/transcript import and essay-feedback features, which use Anthropic’s Claude AI (see Section 3).
• Maintain the security, integrity, and reliability of the Service, including detecting and fixing errors.
• Communicate with you about your account (e.g. email verification, password reset).

We do not sell your personal information.

3. AI features and third-party processors

Cohorted uses the following third-party service providers to operate the Service. Each processes data on our behalf, subject to their own terms and security practices:

• Supabase — hosts our database, handles authentication, and stores the account and profile data described above.
• Anthropic (Claude API) — when you use resume or transcript import, the document content is sent to Anthropic’s API to extract structured information; when you request essay feedback, your prompt and current draft text are sent to generate coaching feedback. Anthropic processes this data under its own API terms. Cohorted’s AI features never write or generate your essay content for you, and never make program admissions decisions or requirement determinations — every AI-assisted result is reviewed and confirmed by you (for imports) or presented as coaching commentary you can accept or ignore (for essay feedback), and program requirement/deadline data shown to students is always admin-reviewed before publication, never AI-generated directly to students.
• Google — provides optional OAuth sign-in, if you choose to use it.
• [Error monitoring / hosting providers] — [name each subprocessor actually in production use, e.g. Sentry for error monitoring and Netlify for hosting, and confirm their own data-handling terms with counsel].

4. Data retention and deletion

We retain your account and profile information for as long as your account is active. You may request deletion of your account and associated data by contacting [support/legal contact email]. [Confirm with counsel whether a self-service deletion flow is required for the jurisdictions Cohorted serves, and whether any data must be retained longer for legal or security reasons.]

5. Your choices and rights

You can review and update most of your profile information directly within the Service at any time. [This section should be expanded with the specific rights that apply to Cohorted’s users — e.g. access, correction, portability, and deletion rights under applicable law such as the GDPR or state privacy laws — once Cohorted’s user base and jurisdictions are confirmed with counsel.]

6. Children’s privacy

Cohorted is intended for pre-PT applicants who are generally college-age or older and is not directed at children under 13. We do not knowingly collect personal information from children under 13. [Confirm age-related requirements, including any additional protections for minors under 18, with counsel.]

7. Security

We use technical measures including row-level database access controls, encrypted connections (HTTPS/TLS), and multi-factor authentication for administrator accounts to help protect your information. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

8. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above when we do, and, for material changes, provide additional notice as appropriate.

9. Contact

Questions about this Privacy Policy can be directed to [support/legal contact email].