Privacy Policy (Beta)

Last updated: August 31, 2026

Introduction

Mascot AI is committed to protecting your privacy and being transparent about how we collect, use, and protect your personal information. This policy explains our practices while the platform is in private beta.

What data we collect

Account information: email address, name, password (stored hashed), and account type (student or parent).
Profile information: academic history (GPA, test scores, coursework), extracurricular activities, honors, hometown, graduation year, college preferences, and free-text responses about your goals and experiences.
Uploaded documents: transcripts and other files you choose to upload for parsing.
Voice conversations: your voice audio is processed in real time by Google's Gemini API to hold the conversation and generate a text transcript. We store the text transcript in your account. We do not store the audio recording ourselves. We currently use Gemini's free API tier, under which Google may retain the audio it processes and use it to improve its own products, see "Service providers and AI processing" below for details.
Essay content: drafts you write and the feedback conversations you have about them.
Usage data: features used, pages visited, and time spent, to operate and improve the service.
Device information: browser type, device type, IP address, and operating system, for support and security.
Billing information: subscription status and payment metadata. Card details are handled by Stripe and are not stored on our servers.

Why we collect this data

Account creation and authentication: to create and maintain your account and verify your identity.
Voice counseling and profile building: to hold conversations, remember what you've discussed, and build your profile.
College matching: to analyze your profile and produce personalized university recommendations with explanations.
Essay assistance: to analyze drafts and provide coaching feedback.
Product improvement: to understand how the platform is used and improve it.
Communication: to send important updates about your account and the service.
Security: to protect against fraud, abuse, and unauthorized access.

Before your first voice session, you'll be asked to confirm you understand that the conversation is processed in real time by Google's Gemini API and that Google may retain the audio under its free-tier terms, as described below.

Service providers and AI processing

We do not sell your personal data. We share data only with providers that help us run the platform, and only as needed to deliver the service:

MongoDB Atlas: database hosting and storage.
Google Cloud Platform: application hosting.
Stripe: subscription payments.
Anthropic (Claude): AI processing for university matching, essay analysis, and transcript parsing.
Google (Gemini): AI processing for real-time voice conversations. We currently use Gemini's free API tier. Under Google's terms for this tier, Google may retain voice audio it processes through the API and use it to improve its own products; this differs from Google's paid tier, which does not retain or use this audio. Google also handles optional "Sign in with Google" authentication.
Google Analytics: aggregate traffic and usage measurement for our public website.

When you use AI features, your relevant content is processed by these third-party AI services under their own privacy terms. We do not use your data to train AI models, and we do not share personally identifiable information with third parties for their own purposes without your consent. This commitment applies to Mascot AI directly. Google's own handling of voice audio processed through the Gemini API is governed by Google's terms, as described above.

Analytics and cookies

Our public website at mascot-ai.com uses Google Analytics 4 to understand how visitors find and use the site: pages viewed, referring source, approximate location, device type, and similar aggregate measures. Google Analytics sets cookies in your browser to do this. We have turned off Google Signals, so this data is not linked to your Google account or used for ad personalization, and we have set the shortest practical data retention.

You can block these cookies through your browser settings or with the Google Analytics opt-out browser add-on. The rest of the website works without them.

Data security

Passwords are stored using secure hashing algorithms.
Data is transmitted over HTTPS.
Access to personal data is restricted to authorized personnel.
We review and update our security practices regularly.

Data sharing

We do not sell your personal data to third parties. We may share information only:

with your explicit consent;
with the service providers listed above;
when required by law or to protect our legal rights;
in connection with a business transfer such as a merger or acquisition.

If parent linking is enabled for your account, a parent you approve can be granted read-only access to parts of your profile, matches, and essays. You control which sections are shared.

Your rights

Access: view and export your profile information from your account settings.
Correction: update your information at any time in your account.
Deletion: request deletion of your account and associated data by contacting us.
Data portability: request a copy of your data in a machine-readable format.
Opt-out: opt out of certain data collection and communications.

Data retention

We retain your personal information for as long as your account is active or as needed to provide the service. Deleted content is first marked inactive and then removed. If you request account deletion, we delete your personal information within 30 days, except where we are required to retain it for legal or regulatory purposes.

Voice recordings: we do not retain audio ourselves; only the text transcript is stored under the retention terms above. Audio processed through Google's Gemini API is retained or discarded according to Google's own terms for the free tier we currently use, as described in "Service providers and AI processing."

Children's privacy

Mascot AI is intended for students aged 13 and older, and for parents assisting students. For users under 18 we require parental or guardian consent, and for users under 13 we require verifiable parental consent before an account is activated. If you believe we have collected information from a child without the required consent, contact us and we will delete it.

Payments

Paid subscriptions are processed by Stripe. We receive subscription status and limited billing metadata, and we do not receive or store full card numbers.

Beta notice: Mascot AI is in private beta. Features, data retention policies, and service availability may change. We recommend not submitting highly sensitive personal information during the beta period, and we will notify users of significant changes to these practices.

International users

If you access the service from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the service, you consent to this transfer.

Changes to this policy

We may update this policy from time to time. We will post the updated policy on this page and change the "Last updated" date, and we will notify users of material changes.

Contact us

For questions or requests about this policy or your data, including account deletion, data access or portability, privacy complaints, and GDPR or CCPA requests, contact us at pranrosh@gmail.com. We respond to all requests within a reasonable time, usually within 30 days.