Privacy Policy

What we collect

When you create a Dorado account, we collect:

• Account information — your email address and, if you sign in with Google or Apple, the basic profile information those providers share with us.
• Academic and planning data you enter— your course plan, career interests and My Plans notes, college list and application statuses, extracurricular activities, goals, and calendar events. This is the data that makes Dorado useful, and it’s yours: only your account can read it.
• Application profile details — if you fill out the Common-App-style profile in Applications, that can include your name, date of birth, home address, phone number, gender, and citizenship/nationality. This section is optional and only asks for what a real college application would ask for.
• Conversations with the assistant— questions you ask and the assistant’s responses, stored so your Advice threads persist between visits.
• Billing information— handled entirely by Stripe. Dorado never receives or stores your card number; we only store your subscription status (trialing, active, canceled, etc.) and Stripe’s customer/subscription IDs.

Who we share it with

We don’t sell your data, and we don’t share it with advertisers. A small number of vendors process data on our behalf to run the service at all:

• Supabase — hosts our database, so all the data above is stored on their infrastructure, physically located in the US West (Oregon) region.
• Vercel — hosts and runs the application itself. Your requests pass through their infrastructure to reach our code, though your data is stored with Supabase, not Vercel.
• Stripe — handles billing and holds your payment method; we never see or store your card details.

No other company — including no third-party AI vendor — receives your academic data or assistant conversations. See the AI assistant section below.

How your data is used

Your academic and planning data is used to power the parts of Dorado you’d expect: showing your course plan back to you, calculating rigor tallies, populating your calendars, and — when you ask the assistant a question — giving it enough context about your own record to answer well. We do not sell your data, and we do not use it to train any AI model.

The AI assistant, specifically

Dorado’s assistant runs on infrastructure we operate ourselves, not a third-party AI vendor. That means no outside AI company — not Anthropic, OpenAI, or any other provider — ever receives your prompts or your academic data. When you ask a question, we assemble only the context relevant to that question (not your entire record) from your own data and from a curated admissions-knowledge library, and send it to our own model.

Who can see your data

Your academic, application, and planning data is scoped at the database level so that only your authenticated account can read it — not other students, and not Dorado staff browsing casually. A small number of automated, trusted systems (like the Stripe billing webhook) can write specific fields like subscription status, but cannot read or modify your academic data.

Data retention and deletion

We keep your data for as long as your account is active. You can permanently delete your account and everything in it — courses, applications, plans, calendar events, and advice history — at any time from Account settings. Deletion removes your data from our live systems immediately and cannot be undone from within the app. Like most hosted databases, our infrastructure provider keeps short-lived backups for disaster recovery, which age out on their own retention schedule.

Cookies and sessions

We use cookies only to keep you signed in and to remember your session — not for advertising or third-party tracking.

Your rights over your data

Wherever you live, you can ask to know what data we hold on you, correct it, or delete it — in practice, the fastest way to do all three is to sign in and check the relevant page directly, since your data is always visible to you first. Account and data deletion is self-serve from Account settingsand takes effect immediately. If your state gives you additional rights (for example, California residents have specific rights under the CCPA), those apply too — we don’t sell personal information, so there’s nothing to opt out of on that front. Some of what you can enter in your Applications Profile — date of birth, address, gender, citizenship — falls under categories some states treat as sensitive; we don’t use it for anything beyond showing it back to you in your own application materials. For anything our self-serve tools don’t cover, reach out using the contact info below — we’ll respond within 45 days.

Children’s privacy

Dorado is built for high school students, most of whom are 13 or older, and we do not intend for children under 13 to use it. You have to confirm you’re 13 or older to create an account, and if you later enter a date of birth in your Applications Profile indicating you’re under 13, we won’t save it. Both of these rely on you telling us the truth — we don’t verify identity or age beyond that. If you believe a child under 13 has created an account or entered their information despite these checks, contact us using the details below and we’ll delete it immediately.

Security and breach notification

We take reasonable technical measures to protect your data, including scoping access at the database level so only your own account can read your academic and application data. If a security incident ever exposes your personal information, we’ll notify affected account holders without undue delay and take the steps required by applicable law.

Changes to this policy

If this policy changes in a way that materially affects how your data is handled, we’ll notify account holders before the change takes effect.

Contact

Questions about this policy or your data can be sent to the email address listed on your billing receipt.