Privacy Policy

1. Overview

This Privacy Policy explains what personal data Shortlisted ("we," "us") collects when you use shortlisted.space, why we collect it, how it's used, who it's shared with, and the choices you have. It applies to every way of signing in, including signing in with Google. See our Terms of Service for the rules of using the product itself.

2. What data we collect

• Account data: the name and email you sign up with, and a securely hashed password (we never store your password in plain text) — or, if you sign in with Google, the name, email address, and profile picture Google shares with us for that purpose.
• Academic profile data: whatever you choose to enter — curriculum, grades/scores, extracurriculars, intended field of study, and target countries.
• Usage & abuse-prevention data: your IP address and a coarse device fingerprint (derived from your browser's user-agent and language, not a tracking cookie) are logged on sign-up and on AI requests, solely to detect spam accounts and enforce fair-use rate limits.
• Session data: a single secure session cookie that keeps you signed in. We don't use third-party advertising or analytics trackers.

3. Data from "Sign in with Google"

What Google user data we access: if you choose to sign in with Google, we request only the standard OAuth openid, email, and profile scopes. Through these, Google shares your name, email address, and profile picture with us. We never request, and are never given, access to your Gmail, Google Drive, Google Contacts, Calendar, or any other Google product or data beyond that basic profile information.

How we use it: that name, email address, and profile picture are used solely to create and authenticate your Shortlisted account (i.e. to know who you are when you sign in) and to display your name/picture back to you inside the product. It is never used for advertising, never used to train any AI model, and never analyzed for any purpose beyond running your own account.

Who we share it with: your Google account data (name, email, profile picture) is stored only in our own database (hosted by Neon, see Section 5) and is not sent to OpenAI, not sent to any analytics or advertising service, and not sold, rented, or disclosed to any third party — with the sole exception of a legal obligation (e.g. a valid court order) or the infrastructure providers strictly necessary to operate the account itself (Section 5).

Your use of Google Sign-In is also subject to Google's own Privacy Policy. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How your data is used

Your academic profile is sent to an AI model (OpenAI) to generate match results and analyses. That request is deliberately stripped of your name and any signal of ethnicity, nationality, or gender before it's sent — the AI only ever sees academic and preference data, specifically so it can't factor identity into your results. We do not sell your data, and we do not share it with advertisers. The only outside parties that ever touch your data are the infrastructure providers that run the service (below), each acting strictly on our instructions.

5. Who we share data with

Shortlisted is built on a small number of infrastructure providers, each processing only what's necessary for their role:

• Google — provides Sign in with Google, if you choose to use it. Google user data (name, email, profile picture) is used only for this purpose and is not forwarded by us to any of the other providers below (see Section 3).
• OpenAI — generates match/analysis results from your de-identified academic profile data only — never your name, email, or any Google account data.
• Neon — hosts our database (your account and profile data, including any data received from Google).
• Vercel — hosts the application itself.
• Resend — sends transactional emails (e.g. password resets, verification codes) on our behalf, using only your email address.
• Cloudflare (Turnstile) — verifies you're not a bot at sign-up/sign-in; subject to Cloudflare's own privacy policy.

We do not sell, rent, or trade any personal data — including Google user data — to third parties for their own marketing or advertising purposes, and we do not use it for any purpose beyond providing and improving Shortlisted itself.

6. Data security

Passwords are never stored in plain text — they're one-way hashed before being saved, so we ourselves cannot read them back. Data in transit between your browser and our servers is encrypted (HTTPS/TLS). Sign-in and sign-up are protected against automated bot and brute-force attacks (rate limiting plus Cloudflare Turnstile). Your database is hosted by Neon behind access controls that restrict it to our own application's servers. No method of transmission or storage is 100% secure, but these are the concrete measures in place to protect your account data, including any data received from Google.

7. Cookies

We use a single, strictly-necessary session cookie to keep you signed in. It is not used for advertising, cross-site tracking, or analytics, and we do not use any third-party advertising or analytics cookies.

8. Data retention & deletion

We keep your account and profile data for as long as your account exists. There isn't yet a self-service "delete my account" button — to request access to, correction of, or deletion of your account and all associated data, email adkadam70@gmail.com and we'll process it promptly.

9. Children's privacy

Shortlisted is intended for prospective students, typically of high-school age. If you are under 18, you should have a parent or guardian's permission to use the service. We do not knowingly collect more data from a minor than is described in this policy, and a parent or guardian may contact us at the email above to review or request deletion of a minor's data.

10. International users

Shortlisted serves students applying to universities across multiple countries. Your data may be processed by the infrastructure providers listed above in countries other than your own; each is contractually bound to process it only for the purposes described here.

11. Changes to this policy

We may update this page as the product changes. Material changes will be reflected here with an updated date at the top.

12. Contact

Questions about this policy or your data? Email adkadam70@gmail.com.