Privacy Policy

To be clear about what we don't do:

• We don't require you to create an account
• We don't ask for your name, email, phone, address, or school
• We don't collect your date of birth or grade level
• We don't track you across other websites
• We don't run advertising networks
• We don't sell, rent, or share any personal data — because we don't have any

What we do collect:

• Saved programs — stored under an anonymous random ID (no account, email, or name). A copy lives in your browser's localStorage so your list loads instantly.
• Application status (saved / applied / accepted) — your browser's localStorage. Never leaves your device.
• Custom dates (exams, interviews) — your browser's localStorage. Never leaves your device.
• Program reviews you write (rating, text, optional name/grade) — sent to our server so we can review them before publishing. Approved reviews appear publicly with only the name you chose.
• Program flags you submit — via our flag form, into a private queue we use to fix listings. No account needed.
• Server logs (IP, user agent, timestamp) — retained for 30 days, then deleted.

When we talk about "Personal Information" in this Privacy Policy, we are talking about anything that could identify you. The only things that could identify you are your IP address (in our server logs for 30 days) and the name/grade you choose to include in a review we approve for public display. Reviews are tied to a random anonymous ID, never to your identity.

Third-party services that may collect data when you visit our site

• Mapbox — When you view the map, Mapbox may set its own cookies or localStorage items to remember your map preferences (zoom, pan, locale). Mapbox's privacy practices are governed by their own privacy policy. We do not have access to the data Mapbox collects.
• Unsplash — Cover images on this site are loaded from images.unsplash.com. Unsplash may log your IP address for the purpose of serving images. See Unsplash's privacy policy.
• Vercel — Our site is hosted on Vercel. Vercel collects server logs (IP, user agent) for the purpose of operating the service. See Vercel's privacy policy.

We use the limited information we collect to:

• Operate the service. Serve the website, run the map, load program data.
• Improve the service. Understand which programs are popular. Fix bugs. Respond to flagged content.
• Communicate with you (only if you reach out first). When you email us, we reply.
• Detect and prevent abuse. Identify bots, scraping, denial-of-service attacks.

We do NOT use your information to target you with advertising, build a profile of you, sell to data brokers, or share with third parties for any purpose.

We don't sell, trade, or otherwise transfer your Personal Information to third parties. Period.

We may share your Personal Information only in these limited circumstances:

• Service providers who help us run the site. Our hosting provider (Vercel) and our map provider (Mapbox) see technical data (IP, user agent) to deliver the service.
• When required by law. If a court orders us to disclose information. We've never received one.
• To protect our rights or safety. If we believe disclosure is necessary to investigate illegal activities or violations of our Terms.
• With your consent. If you explicitly authorize us to share something.

We do not use Google Analytics or any third-party analytics that follow you across the web.

Short version: We don't use cookies. We use localStorage, which is similar but stays on your device.

For the long version, see our Cookies Policy.

In summary:

• We do not set cookies
• We do not use third-party tracking pixels
• We do use browser localStorage as a fast local copy of your saved programs, application status, and custom dates. Saved programs also sync to our database under an anonymous random ID so they survive browser resets. Reviews and reports are stored on our server because they are shared or moderated content — never tied to your name or email
• You can clear localStorage at any time in your browser settings
• The map (powered by Mapbox) does not set tracking cookies on our site

We do not engage in behavioral advertising. There are no third-party advertising networks on this site. We do not share your data with advertisers. There are no ads.

We do not alter our Site's data collection and use practices when we see a Do Not Track signal from your browser. This is because we already collect almost nothing, and what we do collect is governed by the same minimal-data policy regardless of DNT.

You have the following rights with respect to your personal information:

For everyone, everywhere

• Right to access. See all the data we have about you by emailing us.
• Right to delete. Ask us to delete any data we have about you within 30 days.
• Right to correct. Ask us to correct inaccurate data.
• Right to export. Ask for a copy of any data in a portable format.

For users in the EU / UK / EEA / Switzerland

Under the GDPR and UK GDPR, you have additional rights:

• Right to restrict processing
• Right to object to certain types of processing
• Right to data portability
• Right to lodge a complaint with your local data protection authority
• Right to withdraw consent (if we ever rely on it)

For users in California

Under the CCPA and CPRA:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt out of the sale of personal information (we don't sell)
• Right to non-discrimination for exercising your rights

How to exercise your rights: Email contact@blueprintproject.app with the subject "PRIVACY REQUEST." We'll respond within 30 days.

Our audience includes minors, including children under 13. We are committed to protecting children's privacy.

We do not knowingly collect personal information from children under 13. We do not require accounts, do not use tracking cookies, and do not build advertising profiles of any user. The Blueprint Project is designed to be usable by children under 13 without providing personal information.

If you are a parent or guardian and believe your child has provided us with personal information (for example, a name in a public review), contact us at contact@blueprintproject.app with subject "COPPA" and we will delete that information within 5 business days. We will not knowingly retain such information.

We do not use any personal information collected from any user, child or adult, for behavioral advertising, profiling, or any commercial purpose unrelated to operating the Service.

The Blueprint Project is operated from the United States. If you are accessing the Service from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States.

We rely on Standard Contractual Clauses (SCCs) for transfers from the EEA, UK, and Switzerland. You can request a copy by emailing us.

We take reasonable measures to protect your information:

• HTTPS everywhere. All traffic is encrypted in transit.
• Minimal server-side data. Our database stores only anonymous saves, reviews, and reports keyed by random IDs — no names, emails, or account info. Server logs are access-controlled and deleted after 30 days.
• Regular security reviews. The codebase is open to public review.
• Vercel and Mapbox are SOC 2 compliant providers.

No method of transmission over the Internet is 100% secure. If you discover a security vulnerability, please email contact@blueprintproject.app with "SECURITY" in the subject. We will respond within 48 hours.

• Clear your localStorage data. Browser settings → Site settings → Clear data.
• Use the in-app Reset. Dashboard → Settings → Clear all saved programs.
• Block JavaScript. Our site requires JavaScript. Without it, the site won't work.
• Use a privacy-focused browser. We support any modern browser.
• Contact us. For anything else, email contact@blueprintproject.app.

We may update this Privacy Policy from time to time. We will note the "Last updated" date at the top. For material changes, we will post a notice on the homepage for at least 30 days.

Your continued use of the Service after changes constitutes acceptance of the revised Privacy Policy.

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us at:

The Blueprint Project
Email: contact@blueprintproject.app
Subject line: "PRIVACY"
Website: blueprintproject.app

We will respond within 30 days.

The Blueprint Project uses AI-assisted tools to assist with content creation (such as blog articles, resource guides, and program descriptions) and data verification. All AI-generated content is reviewed by a human before publication.

We do not sell, license, or share your data with third-party AI training providers. Aggregated, fully-anonymized usage statistics may be used to improve the product.

If you submit content (such as a program review or feedback) that is processed by AI tools to flag spam, detect issues, or summarize, the raw content is not retained beyond the immediate use case.