Privacy Policy

1. Introduction

Your privacy is important to us. We created this Privacy Policy to let you know how we collect, use, share, and process your data. Paperclipt, LLC d/b/a AppApp strives to ensure that your information is handled appropriately and in line with this policy. This Privacy Policy covers your use of the AppApp mobile and web applications, websites, and related services (together the “Service”).

This Privacy Policy is incorporated into our Terms of Use and governs your use of AppApp’s Service. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. When We Collect Information

When you use the Service, AppApp may collect personal information and data about you, most of which you provide to us. We may also automatically record information when you visit our website. We also may receive information about you from our marketing partners when they provide the information to us and from social media websites.

3. Information We Collect

When you use the Service, we may collect various types of data including the following.

A. Information you provide to us.

• Account and identity information: your first and last name, email address, account role and relationship (student, parent, or counselor), and a password (or, if you sign in with Google, your Google account identifier). Students may also provide their current grade level (grades 9-12).
• Student application data: standardized test scores (such as SAT, ACT, AP, and PSAT), extracurricular activities, honors and awards, your college list (including college names, personal ratings, notes, deadlines, and application status), essays and essay ideas or prompts, and any photos or files you upload.
• Feedback and collaboration data: comments and feedback that parents or counselors provide on a linked student’s essays and other shared items.
• Payment information: if you purchase a service, our payment processor (Stripe) collects and processes your payment details. We do not store full card numbers; we retain only limited billing identifiers such as your customer reference and purchase information, including tier, linking, and transaction history.
• Communications, marketing, and support data: information you provide when you contact us, respond to emails, or participate in referrals, and marketing preferences.
• Other data not specifically listed here, which we will use as described in this policy or as otherwise disclosed at the time of collection.

B. Information from linked accounts. Student accounts and parent/counselor accounts can be linked. When accounts are linked, information is shared between them as described in this policy. If you invite or link another person, you confirm you have the authority or consent to do so.

C. Information collected automatically.

• Device information and unique identifiers, such as your IP address, login or account information, device and browser type, operating system, app version, approximate location, and how you interact with marketing messages and the Service. On the mobile app, if you enable notifications, we collect a device push token so we can send you reminders and updates.
• Geolocation Data, such as information that relates to your location, or the location from which you access our site.
• Data on use, such as how you interact with the Service, including how you interact with specific web pages, to improve your user experience, to track page response times and download errors.
• Cookies and other technologies, such as some of our automatic data collection facilitated by cookies and other technologies. We may use cookies, web beacons, pixels, and other similar online technologies (collectively referred to as “Cookies”) to store your preferences, analyze and improve your experience with AppApp, to authenticate and secure your account, to gather demographic information about our user base, to maintain quality assurance, to target content and advertisements that are relevant to you, to analyze trends, maintain the website, to gather demographic information about visitors to the website, and to validate third party advertising and affiliate marketing links. We will also store a record of your preferences in respect of the use of these technologies in connection with the Service.
• Chat and other artificial intelligence (“AI”) technologies, such as those provided by Google that employ cookies and software code to operate the features that we use to tailor your study plan, provide college recommendations, assist in essay brainstorming, provide insights on application status and preparation, and participate in college advising chats. Google and other third parties may access and use information about webpages visited on our website, your IP address, your general geographic information (e.g., city, state), and other personal information you share through online chats or within inputs to facilitate the provision of the Service.

To the extent that Cookies are deemed to be a “sale” or “sharing” under applicable U.S. laws, you can opt out of these tracking technologies by submitting an opt-out request, and/or adjusting your cookie settings in your browser preferences. For information concerning your choices with respect to the use of tracking technologies, see our Do Not Sell or Share My Personal Information page, adjust your browser cookie settings, or use a Global Privacy Control signal.

Note that some Cookies are essential for the operation and function of our website, and opting out of such cookies will impact your ability to use and access the basic functions of our website. Opting out of some Cookies may have an effect on your browsing experience. If you don’t opt out of Cookies, AppApp will issue Cookies when you interact with our website.

D. Information we do not collect. The Service is designed, operated, and intended for individuals who are at least 13 years of age and located in the United States. As such, we do not collect the following types of information:

• Children’s data. Our Service is intended for use only by individuals who are at least 13 years of age. We do not target AppApp to children under 13 years of age and we do not intentionally or knowingly collect personal information from any person under the age of 13. If you believe that we have collected personal information from a child under the age of 13, please contact us at legal@goappapp.com.
• Data belonging to citizens of the European Union, European Economic Area, United Kingdom, and other locations outside of the United States. Our Service is designed, developed, and intended for use by individuals in the United States. We do not intentionally or knowingly collect any data from any person who is a citizen or resident of the European Union, European Economic Area, United Kingdom, or any other location outside of the United States.

4. Why We Use Your Information

We may use your personal information for the following purposes, or as otherwise described at the time of collection:

Service delivery and operations. We may use your personal information to provide the Service and operate our business; enable security features of the Service; establish and maintain your user profile on the Service; facilitate your referral codes to friends who you want to invite to join the Service; communicate with you about the Service, including by sending Service-related announcements, updates, security alerts, and support and administrative messages; and provide support for the Service, and respond to your requests, questions and feedback.

Service improvement and analytics. We may use your personal information to analyze your usage of the Service, improve the Service, improve the rest of our business, help us understand user activity on the Service, including which pages are most and least visited and how visitors move around the Service, as well as user interactions with our emails, and to develop new products and services. For example, we use Google Analytics for this purpose. You can learn more about Google Analytics and how to prevent the use of Google Analytics relating to your use of our sites here: https://tools.google.com/dlpage/gaoptout.

Marketing and advertising. We, our service providers and our third-party advertising partners may collect and use your personal information for marketing and advertising purposes:

• Direct marketing. We may send you direct marketing communications and may personalize these messages based on your needs and interests. You may opt-out of marketing communications by unsubscribing from any email.
• Interest-based advertising. We, our service providers, and third-party advertising partners may use cookies and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other online services over time, and use that information to serve online ads that we or they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. You can learn more about your choices on our Do Not Sell or Share My Personal Information page, or adjust your browser cookie settings, or use a Global Privacy Control signal.
• Events, promotions, and contests. We may use your personal information to administer promotions and contests; communicate with you about promotions or contests in which you participate; and contact or market to you after collecting your personal information at an event.

Compliance and protection. We may use your personal information to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas, investigations or requests from government authorities; protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); audit our internal processes for compliance with legal and contractual requirements or our internal policies; enforce the terms and conditions that govern the Service; and prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

Data sharing in the context of business transfers. We may share certain personal information in the context of actual or prospective corporate events—for more information, see How We Share Your Information, below.

To create aggregated, de-identified or anonymized data. We may create aggregated, de-identified or anonymized data from your personal information and other individuals whose personal information we collect. We make personal information into de-identified or anonymized data by removing information that makes the data identifiable to you and we will not attempt to reidentify any such data. We may use this aggregated, de-identified or anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Service and promote our business, and to train our AI models and for other machine learning purposes.

Further uses. In some cases, we may use your personal information for further uses, in which case we will ask for your consent to use your personal information for those further purposes if they are not compatible with the initial purpose for which information was collected.

5. How We Share Your Information

We may share your personal information in the following circumstances with the following parties:

Affiliates, such as our corporate parent and affiliates.

Service Providers, such as third parties or vendors, which may include their subcontractors, that help us provide or improve the Service or our business, including web hosting, mobile application distribution, authentication and verification services, database and file storage systems, AI providers, email delivery, marketing, consumer research and website analytics.

Payment Processors. Any payment information that you use to make a purchase on the Service is collected and processed directly by our payment processors, such as Stripe. Stripe may use your payment data in accordance with its privacy policy, which can be found at: https://stripe.com/privacy.

Business Transfers. We may sell, transfer, or otherwise share some or all of our business, assets, or shares, including your personal information, in connection with an actual or prospective corporate transaction such as an investment, financing, merger, acquisition, reorganization, or sale of assets.

Legal compliance. We may release your personal information when we believe in good faith that it is necessary to comply with the law, enforce our policies, or protect our rights or the rights of others regarding property or safety.

Obscured or anonymized data. We may use or provide anonymized data to other parties for marketing, advertising, or other uses. This data is stripped of any personally identifying characteristics and does not include Personal Information.

Google analytics. We use Google Analytics to collect information about the use of our website. Google Analytics is a service offered by Google that collects data to track and report website traffic. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network. This data may include pseudonymous identifiers that can be connected to other data that we have about you. By continuing to use our web site or any service offered by us, you agree and consent to our implementation and features of Google Analytics that we use. You can opt-out of making your activity on the service available to Google Analytics by installing the Google Analytics opt-out browser add-on. To the extent this activity is considered a “sale” or “sharing” under certain U.S. state privacy laws, you can opt out. See our Do Not Sell or Share My Personal Information page, or adjust your browser cookie settings, or use a Global Privacy Control signal.

PostHog product analytics. We use PostHog to understand how the Service is used so we can improve it — for example, which features are used, where people get stuck, and how often pages are viewed. PostHog processes this data on our behalf as a service provider; we identify you to PostHog only by your internal account identifier and account role, never by your name or email address. PostHog also records anonymized session replays of interactions with the Service. These replays are captured with all text and form inputs masked, meaning we can see the layout of a page and where you clicked, but not the content of your essays, college list, test scores, messages, or any other information you enter. On our public marketing pages, PostHog does not load at all unless you accept cookies, and it honors the Global Privacy Control signal. You can opt out at any time on our Do Not Sell or Share My Personal Information page. PostHog’s privacy policy is available at https://posthog.com/privacy.

We do not sell your personal information for money, and we do not use third-party advertising networks to serve targeted ads within the Services. We do not share your student application data with advertisers.

6. Privacy Rights

Residents of some states have enumerated privacy rights relating to Personal Information. We want to ensure that you know exactly how and why your data is collected and used, so you may fully exercise your privacy rights if you choose to do so. If you wish to exercise your privacy rights, you can send a description of your request to legal@goappapp.com. We will provide you with a response within 45 days or with an explanation as to why an extension might be necessary. Depending on your state, you may have the following rights regarding how we capture and use your data:

Right to access your Personal Information. You have the right to request access to the Personal Information we have collected about you. That information includes: the category of information, source of information, the business or commercial purpose for which the information is collected, whether and how that information may be shared with third parties, and what specific types of Personal Information are collected. You also have the right to request a copy of that information. We will provide this to you unless legal exceptions apply. If you wish to access your information, please send a description of the information you wish to see to legal@goappapp.com. All requests subject to identity verification. Verification includes, at a minimum: verification of name via government issued identification, e-mail, and other account information that would only be known to the account owner or legally appointed representative.

Right to know how and why we use your Personal Information. This policy describes how, when, where and why we collect your Personal Information. We ask that you not use the Service or site if you disagree with any aspect of this policy.

Right to opt out of selling or sharing of your data with a third party. You have the right to opt out of having your information shared or sold with third parties for a non “business purpose” as that term is defined under the California Privacy Rights Act (“CCPA”), for example for cross-behavioral advertising or with our affiliates as described above. If you wish to opt out of sharing of your personal information for commercial purposes, please send your request to opt out by contacting us using the information set forth under “Contact Us” in this Privacy Policy.

Right to correction. You have the right to request corrections be made to any inaccuracies you see in your personal information stored by AppApp.

Right to deletion. You can request your personal information be deleted at any time. We may need to retain some data for legal purposes, but we will make every effort to comply with your request. If you wish for us to delete your personal information, please email your request to: legal@goappapp.com or submit a request to delete your account through your account profile. Your request to delete is subject to identity authentication.

Right to non-discrimination. AppApp will not discriminate against you for exercising your privacy rights. This means that we will not deny you goods or services, charge you differently, penalize you, or subject you to different treatment as a result of you exercising your privacy rights.

7. Privacy Rights and Summary of Privacy Practices for California Residents and Other States

Applicability of this Section. Except as otherwise provided, this Section applies to residents of California and other states to the extent they have privacy laws applicable to us that grant their residents the rights described below (collectively the “State Privacy Laws”). To the extent that there is a conflict between this Section of this Privacy Policy and the remainder of this Privacy Policy, this Section of this Privacy Policy will control. Please note that not all rights listed below may be afforded to all users and that if your state does not afford you the rights set forth in this Section you may not be able to exercise these rights. In addition, we may not be able to process your access, correction or deletion request if you do not provide us with sufficient detail to allow us to confirm your identity and understand and respond to your request.

Your Privacy Rights. You can request to know whether we process your personal information. You can also request the following information about how we have collected and used your personal information during the past 12 months: The categories of personal information that we have collected, the categories of sources from which we collected personal information, the business or commercial purpose for collecting, selling, and/or sharing personal information for targeted advertising purposes, the categories of personal information that we sold or shared for targeted advertising purposes, the categories of third parties to whom this information was sold or shared, categorized by the type of personal information for each type of third party, the categories of personal information that we disclosed for business purposes and the types of entities to whom this information was disclosed, and the specific third parties to which we have disclosed personal information. You can request a copy or representative summary of the personal information that we have collected about you. You can ask us to correct inaccurate personal information that we have collected about you. You can ask us to delete the personal information that we have collected from or about you. You may have the right to revoke your consent to our processing of your personal information. You may submit requests regarding how we use your personal information by contacting us using the information set forth under “Contact Us” in this Privacy Policy. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.

Opt-out of certain processing for targeted advertising purposes. We do not sell your personal information. To the extent that our use of analytics and advertising cookies is considered a “sale” or “sharing” of personal information under the CCPA or other State Privacy Laws, you can opt out. We do not use your personal information to engage in automated processing or profiling personal information to evaluate, analyze, or predict personal aspects related to your economic situation, health, personal preferences, interests, reliability, behavior, location, or movements to make a decision that produces legal or similarly significant effects. You can submit requests to opt-out of targeted advertising and other “sales” or “sharing” of personal information (as defined by applicable State Privacy Laws) by adjusting your cookie setting, through the Do Not Sell or Share My Personal Information link, or by broadcasting the Global Privacy Control signal, or by contacting us using the information set forth under “Contact Us” in this Privacy Policy. For information about how to use the Global Privacy Control, please visit https://globalprivacycontrol.org/. These signals set your opt-out preferences only for the particular browser or device you are using and any consumer profile that we associate with that browser or device.

We may need to verify your identity to process your information/know, access, correction, deletion, or appeal requests and reserve the right to confirm your residency. To verify your identity, we may require government identification, a declaration under penalty of perjury or other specific information that we think only you would have, where permitted by law. Under some State Privacy Laws, you may enable an authorized agent to make a request on your behalf. However, we may need to verify your authorized agent’s identity and authority to act on your behalf. Depending on the kind of request you have made, we may require a copy of a valid power of attorney given to your authorized agent pursuant to applicable law. If you have not provided your agent with such a power of attorney, we may ask you to take additional steps permitted by law to verify that your request is authorized, such as by providing your agent with written and signed permission to exercise your State Privacy Law rights on your behalf, the information we request to verify your identity, or confirmation that you have given the authorized agent permission to submit the request.

Consumers Under 18. We require affirmative parental consent to this Privacy Policy upon creation of an Account.

Sensitive Personal Information: We may collect certain categories of Sensitive Personal Information (as such term is defined in the CCPA) as described in this Privacy Policy. We use Sensitive Personal Information as necessary for certain business purposes, including providing the Services as requested; ensuring safety, security; and integrity; countering wrongful or unlawful actions; short term transient use; performing services for our business, including maintaining and servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing analytic services, providing storage, or providing similar services on behalf of our business; activities relating to quality and safety control or product improvement; and other collection and processing that is not for the purpose of inferring characteristics about an individual. While we process certain categories of Sensitive Personal Information as described in this Privacy Policy, we do not process Sensitive Personal Information for purposes beyond those listed above. You can opt-out of our processing your Sensitive Personal Information by electing not to provide it to us or by notifying us of your opt-out by contacting us using the information set forth under “Contact Us” in this Privacy Policy. You are entitled to exercise the rights described above free from discrimination as prohibited by the State Privacy Laws. You can appeal our denial of any request validly submitted.

The table below is designed to provide you with notice of our recent, historical data practices over the prior 12 months (from the “Last Updated” listed at the bottom of this Privacy Policy). This table will be updated at least annually. The table describes the categories of personal information we collect, as well as examples of types of data that fit within such categories, in the left column. The right column states the categories of recipients that receive such personal information as part of disclosures for business purposes, as well as disclosures which may be considered a Sale or Sharing under the CCPA. In addition to the disclosures elsewhere in this Privacy Policy, which are incorporated into this Summary by reference, we have summarized how we have collected the following categories of personal information from consumers in the twelve (12) months preceding the effective date of this Privacy Policy. Information that you voluntarily provide to us, such as in response to free-form prompts, may contain other categories of personal information not described below.

Retention Period for Personal Information. We generally collect and retain your personal information long enough to complete the business activities and purpose for which you provided the data. Generally, we will retain your personal information until your account is deleted. We generally retain personal information to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, including Sensitive Personal Information, we may consider factors such as the length of time we have an ongoing relationship with you and provide services to you; the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorized use or disclosure of your personal information; the purposes for which we process your personal information and whether we can achieve those purposes through other means; whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); whether retention is advisable in light of our legal position, such as in regard to applicable statutes of limitations, litigation or regulatory investigations; and applicable legal requirements. For example, we will retain your personal information for as long as you have an account with us or keep using our services, and the length of time thereafter during which we may have a legitimate need to reference your personal information to address issues that may arise. When we no longer require the personal information we have collected about you, we may either delete it or de-identify it.

Additional information for Connecticut residents. We do not collect, use, or sell personal data for the purpose of training large language models (“LLMs”).

Additional information for Maryland residents. We do not knowingly sell or share the personal information of Maryland consumers under the age of 18 for targeted advertising purposes.

Additional information for California residents. Shine the Light law opt out. Under California’s Shine the Light law (California Civil Code Section 1798.83), we give you the right to opt-out of our disclosure of your personal information (as defined by this law) to third parties for their direct marketing purposes. You may send us requests by contacting us using the information set forth under “Contact Us” in this Privacy Policy. In your request, you must include the statement “Shine the Light Request,” and provide your first and last name and mailing address and certify that you are a California resident. We reserve the right to require additional information to confirm your identity and California residency.

Additional information for Texas residents. NOTICE: We may sell your sensitive personal data, as defined by the Texas Data Privacy and Security Act, by using services that help deliver interest-based ads to you as described above.

Additional information for Nevada residents. Nevada residents have the right to opt-out of the sale, as defined, of certain personal information for monetary consideration. While we do not currently engage in such sales, if you are a Nevada resident and would like to make a request to opt out of any potential future sales, please contact us using the information set forth under “Contact Us” in this Privacy Policy.

Contact Us. If you have questions or concerns about our privacy policies or information practices, please contact us at 5020 Second Avenue, P.O. Box 5631, Pittsburgh, Pennsylvania 15207 or via email at legal@goappapp.com.

8. Transmission of Information to Other Countries

Your data and information may be processed in a foreign country, where privacy laws may be less restrictive. By submitting your personal information to us you agree to the transfer, storage, and processing of your personal information in a country other than your country of residence including but not necessarily limited to the United States.

9. Securing and Storing Your Data

We take reasonable steps to maintain the safety of your personal information. For example, sensitive personal information is transmitted via Secure Socket Layer (SSL) technology and access to your account information requires a username and password. You must keep your password confidential and you should always log out and close your browser when you finish your session.

Though no service is impenetrable, our Service is built on Google Firebase. Firebase maintains recognized security certifications, including ISO 27001 and SOC 1, SOC 2, and SOC 3. More details about Firebase privacy and security are available at: https://firebase.google.com/support/privacy.

Please keep your password confidential and sign out when using a shared device. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data Retention

We collect and retain your data long enough to complete the business activities and purpose for which you provided the data. Generally, we will retain your personal information until your account is deleted. However, we may retain certain information longer if necessary to provide the Service, defend our legitimate interests or those of third parties, comply with legal requirements, resolve or defend ourselves in disputes, investigate misuse or disruption of the Service, or perform agreements.

11. Policy Modification

AppApp is constantly improving our Service, and online privacy rules and regulations are changing rapidly. We are committed to ensuring our policy changes with the laws and expectations of privacy on the web. We will post all updates here, and we may contact you through other methods to alert you of more significant changes to this policy.

Any questions you have regarding this policy should be directed to: legal@goappapp.com.

Last updated: July 17, 2026