Your information belongs to you.

Shineward (“Shineward,” “we,” “us,” or “our”) operates the Service from the United States. This Policy applies when you create an account, use the Service, share a portfolio, connect with a parent, guardian, counselor, or advisor, or contact us. It does not govern third-party sites linked from the Service.

If a school or district uses Shineward under a separate written agreement, that agreement may provide additional privacy commitments. Where we process education records for a school, we act only for the authorized educational purpose and subject to the school’s direction and applicable law.

Account and eligibility data: email, name, authentication identifiers, account role, date of birth or age-status result, school, graduation year, and guardian contact and consent details when applicable.

Student content: academic history, courses, grades or GPA, plans, target schools, activities, skills, awards, work and volunteer hours, portfolio text, uploaded photos and documents, links and sources, résumés, and AI prompts or outputs you choose to create.

Support and verification data: invitations, connection requests, consent scopes, counselor or advisor identity and contact information, organization and school affiliations, state association or credential evidence, verification decisions, connection changes, notes, tasks, and limited audit records.

Technical and usage data: device/browser class, cookies and authentication tokens, approximate network information such as a one-way IP hash for security and rate limiting, interactions, error and security logs, and aggregated Vercel Analytics measurements. Public portfolio visitors may provide a share token and create limited access events.

Communications: contact-form messages and the name, email, topic, and account identifier associated with them.

We use information to provide accounts, portfolios, documents, path planning, recommendations, counselor/advisor collaboration, guardian authorization, account deletion and data-rights tools; authenticate users and enforce permissions; verify schools, organizations, and support professionals; send requested transactional messages; answer inquiries; prevent abuse and investigate safety or security incidents; debug and improve the Service; comply with law and enforce agreements; and protect users, Shineward, and the public.

We do not use sensitive student content to build advertising profiles. We do not make decisions about admission, credit, employment, housing, insurance, or other legally significant eligibility.

At your direction: to people who receive a portfolio link or to a counselor/advisor you invite or approve, limited to the consent scopes shown to you. Students can revoke support connections and disable sharing.

Service providers: Supabase supports database, file storage, and authentication; Vercel hosts the application and provides operational analytics; Resend may deliver transactional email; and configured AI/search providers may include Groq, Anthropic, OpenRouter, Tavily, Brave Search, and official public education sources. Providers receive only information reasonably needed for their function and are subject to their own contractual and legal obligations.

Legal and safety: when reasonably necessary to comply with valid legal process, protect rights and safety, investigate fraud or abuse, or respond to an emergency. We may disclose information in a merger, financing, reorganization, or transfer of the Service, subject to this Policy and legally required notice.

Shineward does not sell personal information and does not share it for cross-context behavioral advertising. We do not disclose personal information to data brokers.

When you choose an AI-assisted feature, the text, images, or document excerpts needed to fulfill that request may be sent to the configured AI provider. Do not submit information you do not need in the result. AI output can be incomplete or inaccurate; review it before relying on or publishing it. Shineward is designed to organize information supplied by the user and not invent achievements.

School document and counselor-finder tools may retrieve public pages from official schools, districts, government datasets, and search providers. Verified source URLs and excerpts may be cached to show provenance and reduce repeated requests.

Under 13: the Service is not available to children under 13, and the age gate is designed to stop their registration. We do not knowingly collect personal information directly from a child under 13. If you believe this occurred, contact us so we can investigate and delete it. Shineward’s guardian-consent workflow for teenagers is not a substitute for verifiable parental consent where COPPA applies.

Ages 13–17: accounts are private by default. Guardian authorization is required for designated minor sharing and support features. The student still chooses the information categories available to a connected counselor or advisor, and connections can be revoked.

Schools and FERPA: Shineward does not claim that every user-provided record is a FERPA education record. If a school discloses education records under FERPA’s school-official exception, the school must determine that Shineward performs an institutional service, is under the school’s direct control regarding the records, uses them only for the authorized purpose, and is subject to applicable use and redisclosure restrictions. A written school agreement should define those duties before school-directed use.

You may edit account and student content; manage portfolio visibility; choose support-connection scopes; revoke a counselor/advisor connection; download available records; or delete your account through account settings. A parent or guardian may use the authorization-management link provided to review or revoke an authorization.

You may also request access, correction, portability, deletion, restriction, or an explanation of our practices through the contact form. Select “Privacy or data-rights request.” We will verify requests proportionately and may deny or limit a request where law permits, including to protect another person, security, legal claims, or records we must retain. Authorized agents must provide proof of authority.

Browser “Do Not Track” signals are not standardized. Because Shineward does not sell data or use cross-context behavioral advertising, we do not provide a sale/sharing opt-out. Where required, we will honor legally recognized universal opt-out signals for covered processing.

We keep account and student content while the account is active and delete it when requested, subject to limited backup cycles, security needs, unresolved disputes, valid legal obligations, and records that must be preserved. Revoked connection records are minimized and retained for their configured audit period; consent, verification, safety, and authorization audit events are generally retained for up to two years. Expired invitation and queue records are generally removed after 90 days. Contact submissions are scheduled for deletion after 24 months unless an earlier verified deletion request applies or a legal, safety, or dispute need requires longer retention.

We periodically review retention needs and use reasonable deletion or de-identification measures when information is no longer required for its stated purpose.

We use measures appropriate to the information and Service, including encrypted transport, managed authentication, row-level database authorization, private storage paths, least-privilege database functions, scoped consent, audit events, rate limits, and access revocation. No internet service is completely secure, and we cannot guarantee absolute security. Keep credentials and private share links confidential and tell us promptly if you suspect unauthorized access.

If a security incident affects legally protected information, we will investigate, mitigate, preserve appropriate evidence, and provide legally required notices.

Depending on your state and whether its law applies to Shineward, you may have rights to know or access personal data, correct inaccuracies, delete data, obtain a portable copy, opt out of sale, targeted advertising, or certain profiling, limit certain sensitive-data uses, and appeal a denied request. Shineward will not discriminate against you for exercising an applicable privacy right.

California notice: the categories collected during the preceding 12 months are identifiers; customer records; protected-class/age information; internet or electronic activity; education-related information; professional or employment-related information; user-created media and documents; inferences generated to provide requested planning features; and potentially sensitive personal information such as account credentials, precise educational records, or guardian communications when you provide them. The sources, purposes, recipients, and retention criteria are described in Sections 2–8. We do not sell or share personal information as those terms are defined by the CCPA, and we do not knowingly sell or share personal information of people under 16. Applicable California rights may be submitted through our contact form and may be appealed by replying through the same channel.

State-law coverage and exemptions vary, including for nonprofit entities and education records governed by other laws. We will honor rights that apply and may voluntarily honor comparable requests where practical.

We may update this Policy to reflect changes in the Service, law, or our practices. We will post the new date and provide additional notice when legally required. We will not use previously collected personal information in a materially different way without the notice or consent required by law.

Operator: Shineward, United States. Submit privacy questions, rights requests, complaints, legal notices, or school inquiries through the Shineward contact form. Choose the matching topic so the request can be routed correctly. If you are dissatisfied with our response, you may appeal through the form and may contact your state attorney general or applicable privacy regulator.