Privacy Statement

Last updated: October 6, 2026

Effective date: July 10, 2026

ClaimYourCollege (the "Service"), the free college funding guide at claimyourcollege.com, is a brand of Silk Creative Labs LLC, a California limited liability company ("Silk Creative Labs," "we," "us," or "our"), not a separate company. Silk Creative Labs LLC, a California limited liability company, is the data controller for ClaimYourCollege. Mailing address: 2108 N St #14571, Sacramento, CA 95816. Email: hello@claimyourcollege.com. This Privacy Statement explains what information the Service does and does not handle, and it should be read together with our Terms of Use.

The short version: the plan you create in the app, your scholarships, essays, financial figures, and notes, everything in Section 3, stays in your own web browser on your own device, and we never receive it. You can also choose to turn on cross-device sync, which saves an encrypted copy to your own Google Drive that we still cannot read; it is off unless you enable it. The app has no accounts and no logins. Apart from sync, there are two limited, privacy-conscious things we do handle, both described plainly below: if you choose to join our waitlist or Founding Beta, we store the contact details you give us (this is adult contact information, not a student's plan data), and we keep anonymous, aggregate counts of how the Service is used so we can improve it. The app itself runs no advertising or tracking tags. Our marketing pages count page views with Vercel Web Analytics, which uses no cookies (Section 6). We use no advertising tags or tracking pixels anywhere. We have nothing about your plan to sell. The sections below explain all of this in detail.

1. Our core commitment: no custody of your information

The Service is designed around a single principle: we do not take custody of the information you enter. There is no sign-up, no account, and no password. Everything you create in the Service (see Section 3) is written to your browser's local storage on the device you are using and stays there, unless you choose to turn on cross-device sync, which saves an encrypted copy to your own Google Drive (Section 6a). Either way it is not transmitted to us, and we do not store it on any server we control.

Because we never receive this information, we cannot read it, share it, sell it, or lose it in a breach of our systems. You remain in control of it, and you can delete it at any time (see Section 10).

This no-custody principle is about the plan information you create in the app (Section 3), which is the sensitive material: a student's scholarships, essays, financial figures, and notes. Two separate and limited things do reach us, and only these: the contact details you give us if you choose to join our waitlist or Founding Beta (Section 4), and anonymous, aggregate usage analytics (Section 6). Neither includes a student's plan data, and both are described plainly below.

2. Information we do not collect

To be explicit, in the ordinary use of the Service we do not collect, request, or store:

• your name, and we do not require your real name to use the Service;
• your email address, unless you choose to email us or to join our waitlist or Founding Beta (see Section 4);
• your address, phone number, date of birth, Social Security number, or government identifiers;
• your financial account numbers, income figures, or FAFSA inputs (any such figures you enter stay on your device);
• your essays, brag sheet, notes, or any other writing you create (these stay on your device);
• passwords or account credentials, because the Service has none;
• advertising identifiers, and we do not build advertising or behavioral profiles; and
• location data beyond the coarse, standard information any web server necessarily receives to deliver a page (see Section 5).

3. Information stored on your device (not sent to us)

When you use the Service, the following are saved in your browser's local storage on your device, under your control, and are not transmitted to us:

• your profile inputs, such as chosen interests, graduation year, home state, and self-selected background tags;
• the scholarships, grants, and programs you track, along with their statuses and your notes;
• any scholarships you add yourself;
• your FAFSA estimator inputs and results;
• your college cost worksheet entries;
• for paid users, your award letter comparisons, essay paragraph bank, and related worksheet entries;
• your brag sheet and essay draft content;
• your activity history within the Service;
• your display preferences (such as an avatar color or photo you add, which is stored on your device);
• your dismissal of one-time notices; and
• if you activate a paid plan, your license key and the information contained in it (such as the family name and term on the license), which is verified on your device.

You can export this information to a file you control (a backup) and restore it yourself. You can delete all of it at any time (see Section 10). By default this information does not sync between your devices, because it stays on the device it was entered on. If you choose to turn on cross-device sync (off unless you enable it), the app saves an encrypted copy to your own Google Drive so another of your devices can load it. We never receive that copy and cannot read it. See Section 6a.

Counselors and the caseload board. The optional Counselor Plan and the free counselor caseload board work the same way: the roster you build, any files students choose to share with you, and your own tags and notes are stored in your browser on your own device and are never transmitted to us. If you turn on cross-device sync, an encrypted copy is saved to your own Google Drive, which we cannot read (Section 6a). We never receive, store, or have access to any student's information through the board. As between you and us, the counselor (and the school or district, as applicable) is the custodian of that on-device caseload; we are not a custodian of student records and hold no student data on any server. The same on-device responsibilities described above (backups, device security, shared devices) apply.

4. Information you choose to give us (contacting us, and the waitlist)

There are limited situations where you may deliberately give information to us:

• Contacting us. If you email us, or use a link in the Service that opens a pre-addressed message in your own email program, and you send that message, we receive your email address and whatever you write. We use this only to respond and to follow up about the topic you raised.
• Support requests. If you contact us for help, we receive what you send us.
• The waitlist and Founding Beta. If you choose to join our waitlist or Founding Beta, you give us the details you enter on that form: your email address, the role you select (such as parent, counselor, or student), and, only if you choose to provide them, your state, class year, organization, and a short note about your goal. If you arrived from an ad or campaign link, we also store the campaign tags that were in that link (such as utm tags or an ad-click ID), so we can tell which campaigns bring people to us. You also check a box consenting to receive occasional beta and launch emails. We store this in our database (not on your device) and use it only to run the waitlist, to invite testers, and to send the updates you consented to. This is adult contact information provided by the person signing up; it is not a student's plan data, and it never includes the scholarships, essays, financial figures, or other plan content described in Section 3. Every email we send you includes a one-click unsubscribe.
• The Deadlines email. If you sign up for our monthly deadline email, we store your email address, the page you signed up on (and your state, if you signed up on a state page), when you confirmed, and whether you unsubscribed. We send nothing except one confirmation email until you click the link in it to confirm. Every email includes a one-click unsubscribe.
• Beta feedback. If you send feedback while using the Service, we store the message you write, and your email if you choose to include it, so we can improve the Service. As described in our Terms, feedback may be used to improve the Service.

We keep contact-us messages in our email inbox, and waitlist, newsletter and feedback records in our database (hosted by Neon, Inc.). Our emails are sent through Resend. We do not sell them, and we do not add you to unrelated marketing. Any commercial email we send will identify us, include our postal address, and offer a one-click way to opt out. We keep this information as described in Section 12, and you can ask us to delete it and remove your address at any time by emailing hello@claimyourcollege.com.

5. Hosting and server logs

The Service is delivered by our hosting and content delivery provider, Vercel Inc., which serves the website's files to your browser. Like essentially all web hosts, when your browser requests a page, the host automatically processes standard technical connection information needed to deliver the page and to keep the Service secure and reliable, which can include your IP address, browser type and user agent, referring page, and the date and time of the request. This is standard server log information, it is handled by Vercel as our service provider under its own terms and privacy commitments, and we do not use it to build advertising profiles or to identify you as an individual. Vercel's privacy commitments are described in its privacy policy at https://vercel.com/legal/privacy-policy, and these standard server logs are retained by Vercel in accordance with its own policies.

Unless you turn on optional cross-device sync, the Service does not send your plan information anywhere, and inside the app your browser does not call third-party servers during normal use. If you enable sync, your browser connects to Google to save an encrypted copy of your plan to your own Google Drive; that copy is encrypted on your device before it leaves, so neither Google nor we can read it (see Section 6a). Our marketing pages also count page views with Vercel Web Analytics (Section 6).

6. Analytics: anonymous, first-party, and aggregate

To understand how the Service is used and where people get stuck, we keep simple, anonymous usage counts. When you use the Service, it records the name of an event (for example, that a tool was opened or a results page was viewed), along with the page, a coarse role if you provided one, the ad source and campaign name if you arrived from an ad or campaign link, and a random session identifier that resets and is not tied to your identity. That is all. These records never include anything you type, no scholarships, essays, financial figures, GPA, names, or other plan content, and they cannot be used to identify you as an individual.

These in-app counts are first-party: they go only to our own database, not to any third-party analytics or advertising company.

Page-view counts on our marketing pages. Our marketing and information pages (for example the Family Plan, counselor, employer, state-aid, guide and newsletter pages, but not the app itself) use Vercel Web Analytics, a service of our host, Vercel Inc. It records the page, the referring site, and your browser, operating system, device type and country, without cookies, and gives us only aggregate numbers.

We do not use advertising tags, tracking pixels, web beacons, or cookies to track you across other websites or over time. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not engage in "targeted advertising" as those terms are used in United States privacy laws. In the app, your browser's local storage is used only to save the plan information described in Section 3 on your own device. On our marketing pages, your browser may remember the campaign link you arrived from, so that a later signup can be attributed to it (Section 4).

6a. Optional cross-device sync (off by default)

So you can pick up your plan on another device, you may turn on cross-device sync. It is off unless you switch it on, and your plan stays on your device as the primary copy. When it is on, the app signs you in to your own Google account (using Google's `drive.file` permission, which reaches only the single file the app creates in your Drive and nothing else) and saves an encrypted copy of your plan there. The copy is encrypted on your device with a passphrase you choose. That passphrase is never sent to us or to Google, so we never receive a readable copy and hold no key, and Google stores only scrambled data it cannot read. Because no one but you holds the passphrase, there is no way for us to reset it or recover the copy if you lose it. This is your data in your own Google account, not information in our custody. Google handles the encrypted file under its own terms (https://policies.google.com/privacy). You can turn sync off and delete the file from your Drive whenever you want.

7. Third parties we use; self-hosted fonts

To keep the promise that your information stays on your device, the app is built to avoid calling third-party servers from your browser during normal use. For example, the fonts are hosted by the Service itself rather than loaded from a third-party font network. The one exception inside the app is optional cross-device sync: if you turn it on, your browser contacts Google to read and write an encrypted copy of your plan in your own Google Drive. Sync is off unless you enable it, and the file is encrypted on your device so Google cannot read it (see Section 6a). Our marketing pages use Vercel Web Analytics, described in Section 6. If you click a link to an external site (such as a scholarship's official application page), you leave the Service and are subject to that site's own privacy practices, which we do not control.

These are the service providers that handle information for us:

• Vercel Inc.: hosts the website, keeps standard server logs (Section 5), and runs Web Analytics on our marketing pages (Section 6).
• Neon, Inc.: hosts our database (waitlist, Founding Beta, newsletter and feedback records, in-app usage counts, and employer-access records).
• Resend: sends our emails (license keys, confirmations, newsletters and replies).
• Stripe, Inc.: processes payments and employer invoices (Section 8).
• Google LLC: stores the encrypted sync file in your own Google Drive if you turn sync on (Section 6a).

8. Payments (paid plans)

Purchases of paid plans are processed by our payment processor, Stripe, Inc.; we sell the plans directly rather than through a third-party merchant of record. Stripe collects and processes your payment information (such as your card details and billing information) under its own terms and privacy policy and processes the charge. We do not receive or store your full payment card number. From Stripe we receive only the limited information needed to issue and support your license, such as confirmation that a purchase completed, your email address, and the family name and school year to place on the license. Stripe's privacy policy is available at https://stripe.com/privacy.

8a. Employer-sponsored access

Some employers pay for their employees to use the Family Plan. The employer gets an access code, and an employee enters it at https://claimyourcollege.com/employee-access/ to receive a Family Household license key on screen. We do not ask the employee for an email address, a name, or an account. The employee may type a family name to print on the key; that name goes into the key only and we do not store it.

To run the program we store, in our own database:

• for each employer: the employer's name, its access code, the most keys the code may issue, the date the code expires, whether it has been revoked, and a running count of keys issued;
• for each key issued: the access code it came from, the key's short random ID (six characters, not tied to any person), and the date it was issued;
• for each device that activates an employer key: the key's random ID, a random device ID that the browser generates for itself (not a hardware identifier and not linked to any person), and the date. We use this only to enforce the device limit on a Family Household license, and it is never included in any report.

To invoice the employer and run its order, we also keep the names and business email addresses of the employer's billing and benefits contacts and the employer's headcount, in our invoicing provider (Stripe) and our email. We do not store the employee's name, email address, or anything a family or student enters in the app, which stays on the family's own device as described in Section 3. The employer receives counts only: how many keys were issued under its code and how many devices activated them. We never tell an employer which employees used the code. Like every request to the Service, redeeming a code passes through our host's standard server logs (Section 5), and we keep a counter keyed to the requesting IP address to limit abuse; it resets after 10 minutes, and old counters are deleted periodically. Neither is linked to the key issued.

9. Children's privacy

The Service is intended to help students plan for college, but it is built so that it does not collect personal information, does not use accounts, and stores plan information only on the user's own device. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Purchases may be made only by adults. If a child under 13 sends us personal information (for example, by emailing us), we will delete it; if you believe this has happened, contact us at hello@claimyourcollege.com. This approach is designed to be consistent with the Children's Online Privacy Protection Act (COPPA).

10. How to review and delete your information

Because your plan information is stored on your device, you control it directly:

• You can view and edit it in the Service at any time.
• You can delete individual items in the Service.
• You can clear all of it by clearing this site's data in your browser's settings, or by using the Service's own delete or reset controls where provided.
• You can export a backup file and keep or delete your own copies.

For the limited information you may have sent us by email (Section 4), you can ask us to provide a copy of it or delete it by emailing hello@claimyourcollege.com. Because we hold so little, we may ask you to identify the message so we can locate it.

11. Your privacy rights

Depending on where you live, you may have rights over personal information, such as the rights to know or access, to correct, to delete, to obtain a portable copy, and to opt out of sale or of certain sharing or targeted advertising. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising or profiling.

For information stored on your device, you can exercise these rights yourself directly, as described in Section 10, without contacting us. For any information you have sent us by email, you may exercise your rights by contacting hello@claimyourcollege.com, and we will respond as required by applicable law. We will not discriminate against you for exercising your rights.

• California residents (CCPA/CPRA). The categories of personal information we collect are limited to: identifiers you choose to give us, specifically your email address and the details you provide when you contact us or join our waitlist or Founding Beta (Section 4); anonymous usage event records that are not tied to your identity (Section 6); aggregate page-view counts on our marketing pages from Vercel Web Analytics (Section 6); and the standard server log data described in Section 5, which is handled by our host. If you turn on optional cross-device sync, an encrypted copy of your on-device plan is stored in your own Google Drive; we do not receive or collect it, and Google processes only ciphertext it cannot read (see Section 6a). We collect these only to respond to you, to run the waitlist and beta, and to operate, improve, and secure the Service. We keep them as described in Sections 4, 6, and 12. We do not sell them or share them for cross-context behavioral advertising. You have the right to know or access, to correct, and to delete this information, and the right not to be discriminated against for exercising those rights. To exercise a right, email hello@claimyourcollege.com. If we deny a request, you may ask us to reconsider by replying to our response.
• Residents of other United States states with privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and others). You have similar rights to access, correct, delete, and obtain a portable copy of the limited personal information described above, and to opt out of sale or targeted advertising. We do not sell personal information and do not use it for targeted advertising or profiling. Exercise your rights the same way, by emailing hello@claimyourcollege.com.
• Individuals in the European Economic Area or the United Kingdom (GDPR/UK GDPR). The Service is directed to users in the United States and is not marketed or offered to individuals in the EEA or the UK. If you contact us from those regions, any email you send is handled in the United States, as described in Section 14.

12. Data retention

We do not retain your plan information, because we never receive it; it remains on your device until you delete it. If you turned on cross-device sync, an encrypted copy also stays in your own Google Drive until you delete it there or disconnect sync; because it never reaches us, we have nothing to retain or delete on our side. For information you send us by email, we retain it only as long as needed for the purpose you contacted us about and as described in Section 4 (up to 24 months), and then delete it, unless a longer period is required by law. Waitlist and Founding Beta records are kept while the beta and launch are active and for up to 24 months after, or until you unsubscribe and ask us to delete them, whichever is sooner. Employer-access records (Section 8a) are kept for the employer's term and for up to 24 months after it ends, so we can report counts to the employer and handle renewals, and then deleted. Anonymous usage event records (Section 6) contain no identifying information and are kept in aggregate to understand trends. Standard server logs held by Vercel are retained by Vercel in accordance with its policies.

13. Security

We take reasonable measures to operate the Service securely, including serving it over an encrypted connection and using a hosting provider that maintains its own security practices. Paid license verification is performed on your device using cryptographic signatures, and license keys cannot be forged by altering data on your device.

However, no method of storage or transmission is completely secure. Because your plan information is stored in your browser on your device, its security also depends on you: keep your device and browser secure, and remember that on a shared device, anyone who can use that device and browser can see information saved in it, since the Service has no password protection. If you use a public or shared computer, consider using the Service's export feature and then clearing the site's data when you finish.

14. International users

We operate the Service from the United States. If you access the Service from outside the United States, you understand that any information you choose to send us (such as an email) will be handled in the United States, where privacy laws may differ from those in your location. The Service is directed to users in the United States and is not targeted to individuals in the European Economic Area or the United Kingdom.

15. Do Not Track

The Service does not track users across websites or over time, so it does not need to respond to browser "Do Not Track" signals in a special way. We treat all users the same: we do not track any of them across sites.

16. Changes to this Privacy Statement

We may update this Privacy Statement from time to time. When we do, we will change the "Last updated" date and, for material changes, take reasonable steps to notify users, such as posting a notice in the Service. Changes are effective when posted unless stated otherwise.

17. Contact us

If you have questions about this Privacy Statement or your privacy when using the Service, contact:

Silk Creative Labs LLC, a California limited liability company

Mailing address: 2108 N St #14571, Sacramento, CA 95816, USA

hello@claimyourcollege.com