Privacy Policy

This Privacy Policy describes how Cohorted (“Cohorted,” “we,” “us”) collects, uses, and shares information when you use the Cohorted platform (the “Service”). It is written to reflect what the Service actually does as of the date above — an attorney should confirm it also satisfies the specific privacy laws that apply to Cohorted’s users and jurisdiction(s) before this is published for a public launch.

1. Information we collect

Account information

When you create an account, we collect your email address and password (stored securely by our authentication provider, never in plain text), or, if you sign in with Google, the basic profile information Google provides for that purpose.

Profile and application information you provide

• Basics: name, institution, degree/major, graduation date, GPA(s), journey stage.
• GRE status: whether you’ve taken it, your score, and any planned test date.
• City and state, if you choose to add them — used only to show Opportunities near you.
• Clinical, research, volunteer, employment, and leadership experiences you log, and individual courses you add.
• Schools you save as targets, and your engagement status with Opportunities listings (e.g. “interested,” “contacted”).
• Essay Hub content: stories, themes, essay prompts, and draft versions you write.
• Reports you submit about an Opportunities listing (e.g. flagging outdated information).
• AI feedback you request on an essay draft or a saved interview answer, which we store so you can see it again.
• Your conversations with the Advisor (the questions you ask and the answers you receive), which we store so you can continue and review them.

Subscription and billing information

When you subscribe, you are sent to Stripe’s checkout page to enter your payment details. Those details are collected and processed by Stripe; we do not receive or store your full card number. We share your email address with Stripe so it can create your customer record, and we keep a record of your subscription: the plan and billing period you chose, the subscription’s status, when the current period ends, whether it is set to cancel, and identifiers that link your Cohorted account to your Stripe customer and subscription. We also keep a log of the notifications Stripe sends us about subscriptions, which does not include your payment details.

Networking

Networking is optional, and you must be 18 or older and confirm this to use it. When you set it up, we collect and store:

• A display name, the path you are on, and the school you select from a directory. Your school is self-reported and is not verified.
• Your visibility choice (hidden, visible to your school, or visible to your school and nearby schools), and your confirmations that you are 18 or older and accept the conduct rules.
• Requests, offers, and opportunity reports you post, including the details, topic, audience, and whether you posted anonymously.
• Connection requests, introductions, and your responses to other people’s reports, as well as people you block.
• A contact method you type in when you ask for or accept an introduction.
• Reports you file about other users or posts, and records of moderation actions.

Who can see it. Other Networking users can see your display name, path, and school according to your visibility choice, and your posts according to the audience you pick: your connections, your school, or all Networking users. Networking users are signed-in Cohorted students, not the public. Anonymous posts hide your name and school from other students, but Cohorted administrators who moderate Networking can see who posted them. A contact method is shown only to the other person in an introduction, only after both of you agree, and is removed after a limited period or if the introduction ends. Your email address is never shown to other users. Your school’s advisors do not see your Networking profile or activity, and Networking information is not included in advising cohort summaries.

Moderation. We use automated checks, such as limits on posting and detection of posts that contain contact information, and administrators review reports and flagged activity.

University code and advising

If you join your school’s advising group with a university code, we record that you belong to that group and, through it, to that school. We do not otherwise verify your enrollment. See Section 2 for how this information may be used and shared with advisors.

Documents you upload for import

If you use the resume or transcript import feature, the PDF you upload is sent to our AI extraction pipeline to identify structured information (like your education, experience, or coursework) for you to review. The uploaded file itself is processed in memory and is not stored in our database or file storage after extraction completes — only the specific fields you review and confirm are saved to your profile.

Cohorted browser extension

If you use the Cohorted browser extension for Chrome:

• You sign in to the extension with your Cohorted account. The extension keeps its own sign-in tokens in Chrome’s storage for the extension on your device. Signing out of the extension ends that sign-in.
• The extension only looks at a page when you click it. It then sends that tab’s address and title to Cohorted, which checks whether the address matches a program or opportunity already in Cohorted. We use them to answer that check and do not save them.
• If you choose “Save for review,” we store the page’s address and title, when you saved it, and whether you have marked it reviewed, linked to your account. You can remove saved pages from your research inbox, and they are deleted if you delete your account.
• The extension does not read the content of pages, collect your browsing history, or track the pages you visit.

Interview practice

If you use Interview Prep, we store what you choose to save: interview records you add (such as the program, date, format, and your own notes and checklist), practice answers you save, and reflection notes. A saved typed answer is stored as you wrote it. Practice you run without saving is not saved as an attempt; its text stays on your page and is gone when you leave.

Spoken practice answers

When you choose to speak an answer instead of typing it:

• Your browser records the answer in memory and sends it to our server, which sends it to Deepgram to be turned into text. Cohorted does not store the audio.
• We ask Deepgram, on each transcription request, not to use the recording to improve its models. Deepgram handles the recording under its own terms and privacy practices, and we do not control how it processes or retains it.
• You review and can edit the transcript before saving. A saved spoken answer stores the text you reviewed, plus the original machine transcript with the timing of each word, so we can show descriptive measurements such as pace and pauses. It does not store the audio.
• Practice without saving still sends your recording for transcription and uses part of your daily transcription allowance. The resulting text stays on your page and is not saved as an attempt.
• To limit cost and abuse, we keep a separate usage record of each transcription request. It holds operational information only (when the request was made, the size of the recording, the provider and model, the outcome, the recording length the provider reported, and the provider’s request reference) and never the audio, the transcript, or the question. If you delete your account, the link to your account is removed from these records.

[Counsel to confirm, before this section is published: how voice recordings are treated under applicable biometric-privacy and consumer-health-data laws, any age requirements, and Deepgram’s written data-processing and retention terms. This policy does not state a Deepgram retention period.]

Technical information

We use session cookies to keep you signed in, and we use an error-monitoring service (Sentry) that may capture technical details (like a stack trace or the page you were on) when something goes wrong, to help us fix it.

2. How we use your information

We use the information above to:

• Operate your account and the Service’s core features (profile, target schools, timeline, Opportunities, Essay Hub).
• Generate your personalized recommendations and priorities from your own profile, experience, and saved-program data — this logic runs on our own servers, not a third-party AI model (the Advisor, described in Section 3, is a separate AI feature).
• Power the resume/transcript import and essay-feedback features, which use Anthropic’s Claude AI (see Section 3).
• Maintain the security, integrity, and reliability of the Service, including detecting and fixing errors.
• Communicate with you about your account (e.g. email verification, password reset).
• If you use Networking, show your profile and posts to other users as described above, and keep Networking safe through limits, reports, and moderation.
• Process your subscription: set up and renew your plan, determine whether you currently have access, and respond to billing questions.
• If you joined with a university code, provide your school’s advisors with anonymous cohort-level summaries (see below).

Advising groups. If you join a school’s advising group with a university code, some of your planning information, such as journey stage, saved programs, and relevant course or experience information, may contribute to anonymous cohort-level summaries for that school’s advisors. Advisors do not see your name or personal account details in these summaries. You can leave the group at any time from your Profile; leaving removes you from future summaries, but summaries already generated are not rewritten. Your school’s sponsorship of your access, if any, does not itself give the school access to your account. Your interview practice answers and AI coaching are private to you and are not part of these summaries.

We do not sell your personal information.

3. AI features and third-party processors

Cohorted uses the following third-party service providers to operate the Service. Each processes data on our behalf, subject to their own terms and security practices:

• Supabase — hosts our database, handles authentication, and stores the account and profile data described above.
• Anthropic (Claude API) — when you use resume or transcript import, the document content is sent to Anthropic’s API to extract structured information; when you request essay feedback, your prompt and current draft text are sent to generate coaching feedback; when you use the Advisor, your question, the recent messages in your conversation, and relevant parts of your profile, saved schools, and reviewed program information are sent to generate an answer; and when you request coaching on a saved interview answer, that answer and the question it responds to are sent to generate feedback. Anthropic processes this data under its own API terms. Cohorted’s AI features never write or generate your essay content for you, and never make program admissions decisions or requirement determinations — every AI-assisted result is reviewed and confirmed by you (for imports) or presented as coaching commentary you can accept or ignore (for essay feedback), and program requirement/deadline data shown to students is always admin-reviewed before publication, never AI-generated directly to students.
• Deepgram — if you choose to speak a practice answer in Interview Prep, the recording is sent to Deepgram to be transcribed (see “Spoken practice answers” in Section 1). Deepgram processes it under its own terms and privacy practices.
• Stripe — processes subscription payments. It collects your payment details on its own checkout page and receives your email address and the plan you select. Stripe handles that information under its own terms and privacy practices, and we do not control how it processes or retains it.
• Google — provides optional OAuth sign-in, if you choose to use it.
• Netlify — hosts the Service, so your requests pass through its infrastructure.
• Sentry — receives technical error reports. We configure it not to send your identity, cookies, or the content of your requests.
• Mapping and place-search providers — if you use Opportunities, the location you search for is sent to place-search providers to find nearby organizations, and your browser loads map tiles from a map provider (OpenFreeMap), which can see your IP address as with any website.
• [Counsel to confirm each provider’s data-handling terms before this is published.]

4. Data retention and deletion

In Practice history you can delete any saved practice answer, or all of them at once. Saved practice answers, including spoken ones, are also removed when your account is deleted.

We retain your account and profile information for as long as your account is active. If your subscription or other access ends, we do not delete your account or content for that reason alone. We keep subscription records for as long as needed to operate subscriptions and meet our accounting and legal obligations. Stripe retains payment information under its own policies.

In Networking, you can delete any post you made. Its text is removed unless it is the subject of a report or moderation, in which case we keep it for administrators. You can also leave Networking at any time without closing your account: your posts are deleted in the same way, your connections end, pending introductions are cancelled, shared contact details are removed, and your Networking profile is deleted. We keep reports, moderation records, and safety-related history, and an active restriction carries over if you rejoin. Contact details revealed in an accepted introduction are removed after a limited period. You may request deletion of your account and associated data by contacting [support/legal contact email]. [Confirm with counsel whether a self-service deletion flow is required for the jurisdictions Cohorted serves, and whether any data must be retained longer for legal or security reasons. Account deletion currently requires any active subscription to be cancelled first.]

5. Your choices and rights

You can review and update most of your profile information directly within the Service at any time. [This section should be expanded with the specific rights that apply to Cohorted’s users — e.g. access, correction, portability, and deletion rights under applicable law such as the GDPR or state privacy laws — once Cohorted’s user base and jurisdictions are confirmed with counsel.]

6. Children’s privacy

Cohorted is intended for pre-PT applicants who are generally college-age or older and is not directed at children under 13. We do not knowingly collect personal information from children under 13. [Confirm age-related requirements, including any additional protections for minors under 18, with counsel.]

7. Security

We use technical measures including row-level database access controls, encrypted connections (HTTPS/TLS), and multi-factor authentication for administrator accounts to help protect your information. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

8. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above when we do, and, for material changes, provide additional notice as appropriate.

9. Contact

Questions about this Privacy Policy can be directed to [support/legal contact email].