Privacy Policy

Your account. An email address, a password, and a display name. We never see your password in readable form — sign-in is handled by Supabase, which stores it hashed.

What you write. Essays, comments, likes, and reports you submit, along with when you posted them.

Verification details, if you ask to be verified. Either a school email address you confirm with a code, or the school name, expected graduation year and any note you send for manual review. Professionals submit an organisation, role, supporting note and at least one link to a public page showing their work.

A LinkedIn account, only if a professional connects one. Connecting is optional and it is the alternative to confirming a work email, not an addition to it. If you connect one we keep the name on it, the domain of its email address, the photo and LinkedIn's id for you. We do not keep the address itself, and we do not read anything else from your LinkedIn: no connections, no posts, no history. It is shown to an administrator reviewing your request so they can see the account matches the person and the profile link you gave. Students and past students are never asked for this.

Moderation state. Whether a comment of yours was flagged or hidden, a count of confirmed violations, whether your commenting is suspended, and any appeal you write.

Technical. Cookies that keep you signed in. Our host keeps ordinary server logs. We do not use advertising trackers; the page counting we do use is described under Analytics below.

To run the site: show your work to the readers you chose, attribute comments, keep you signed in, let people report problems, and let administrators act on those reports. The verification details exist to support the badges. The moderation state exists so that repeat problems can be handled consistently and appealed.

We are a small project built on other people's infrastructure:

• Supabase — stores the database and runs sign-in. Effectively everything above lives there.
• Vercel — hosts and serves the site, and sees ordinary request traffic.
• OpenAI — receives text so it can be screened for abuse: every comment when it is posted, and the title, focus questions and body of every essay when it is posted or edited. It also receives the name on your account when you set it, and what you write in a verification request. Its moderation service returns category scores only; it is not used to write, rate or rank anything.
• Resend — sends account emails such as confirmation, password reset and verification codes, a note when someone comments on your essay, and one reminder a couple of days after you sign up. It therefore handles your email address.

If you choose to support CREX financially, the payment happens entirely on the payment provider’s own site under their privacy policy. CREX never receives your card details, and never learns who gave or how much.

We do not sell your data or share it for advertising.

Posting anonymously hides your name from other readers. It does not hide it from site administrators, who can see the real author when handling reports and abuse.

Because that is a genuine privacy exception, it is logged: each time an administrator views the real author of an anonymous essay, an entry is written to an internal admin log, along with removals, verification decisions, moderation decisions and appeal outcomes. The log is visible to administrators only.

The only cookies are the ones that keep you signed in. Clearing them signs you out. There are no advertising or cross-site tracking cookies.

We use Vercel Web Analytics to see how many people visit and roughly where they come from. It sets no cookies, follows nobody across other websites, and nothing it records is tied to your account — we cannot look up what any particular person read.

Rather than say "anonymous" and leave it there, here is what it actually records:

• the page you were on — but an essay's address is reduced to its shape before it is sent, so it arrives as /essays/[id]. We can see how many essay pages were read; we cannot see which, and neither can anyone looking at the dashboard. This matters most for a private-link essay, where the address is the only thing keeping it private.
• the site you came from, if any, and campaign tags on the link you followed. Nothing else from the address bar is kept. Essay pages work the other way round too: they send no referrer at all, so an essay's address — including a private link — is never passed on to another site you click through to, or to the analytics service.
• a rough location — country, region, city — worked out from the connection
• device type, operating system and browser

Vercel does not store your IP address and does not use a cookie to recognise you; it derives a temporary hash from the request and discards it within 24 hours. We do not use advertising trackers, and we do not send anything to advertising networks.

• Change your display name, email address or password in account settings.
• Turn comment emails and the sign-up reminder off in account settings, or use the link in the email.
• Change an essay's visibility, or delete the essay, at any time.
• Block another user.
• Appeal a suspension or a hidden comment.
• Delete your account.

Deleting your account removes your essays and the comments on them. Comments you left on other people's essays are kept but reattributed to a placeholder "Deleted User" account with your name removed, so that other people's conversations stay readable. If you want those removed too, contact us and say which.

Content stays until you delete it or an administrator removes it. While your account exists, we keep the account data described above.

When you delete your account:

• Your essays and your personal details are removed straight away.
• Comments you left on other people's essays stay, shown as “Deleted User”. They sit inside someone else's conversation, and removing them would tear holes in threads other people are still reading.
• A message you sent us through the contact form is kept with the address you gave, so a report about somebody else's conduct doesn't vanish when you close your account.
• Moderation records and the administrator log are kept for up to 12 months. These exist so that decisions about people — including decisions about you — stay reviewable, and so that someone who was removed for harming others can't clear the record by deleting their account. That includes anything a professional gave to be verified, such as a connected LinkedIn account or a confirmed work email domain.

Database backups roll off within 30 days, so deleted content can persist in a backup for up to that long before it is gone for good. Server and access logs are kept for 30 days.

You must be at least 13 to have an account. If you are under 18, please go through this page with a parent or guardian before posting, and remember that a public or anonymous essay can be read by anyone.

We do not knowingly allow accounts for anyone under 13. If we learn that an account belongs to someone under 13, we remove the account and the data that came with it — their essays and the personal details on the account — rather than keeping it while we look into it. To report one, tell us at the contact form or contact@collegecrex.org. You do not need to prove anything to report it, and we would rather check a report that turns out to be wrong than miss one.

If you are a parent or guardian and want an account or a piece of writing removed, contact us and we will act on it.

TBD — for a lawyer. This section is a good-faith draft of the rights California law gives residents, written so the page is not silent about them. It has not been reviewed, and a lawyer may find it incomplete or wrong about which of these laws apply to a site this size.

If you live in California, you have the right to:

• Know what personal information we collect about you and what we do with it. The "What we collect" and "Who else your data reaches" sections above are our answer; ask us if something is missing.
• Delete your personal information. You can do this yourself from your account settings, and "How long we keep things" above says exactly what goes and what stays.
• Correct personal information that is wrong. Your name and account details are editable in account settings; ask us about anything else.
• Opt out of the sale or sharing of your personal information. We do not sell or share personal information, and we do not share it for advertising, so there is nothing here to opt out of. If that ever changes, this page changes first.
• Not be treated differently for exercising any of these. We will not remove features, degrade the site, or close your account because you asked.

To exercise any of them, write to contact@collegecrex.org or use the contact form. We may need to confirm you are the person the account belongs to — usually by asking you to write from the address on it — because handing someone else's data to whoever asks would be its own privacy failure.

Sign-in and password storage are handled by Supabase. Access to the site's data is limited to administrators, and sensitive administrator actions are logged.

We cannot promise perfect security, and we would rather say that plainly than imply otherwise. Please don't put anything in an essay that would seriously harm you if it became public.

If we change this policy in a way that matters, we will say so on the site rather than quietly editing this page.

Questions, removal requests, or anything involving a child under 13: the contact form or contact@collegecrex.org.

TBD — for a lawyer. Still to be settled: which data-protection laws apply to this audience and region, what rights follow from them, and whether a formal data processing agreement is needed with any of the providers above.