Privacy Policy

We only collect what a feature needs. Anything marked "Optional" can be left blank and you can still use the rest of the service.

• Sign-in

  What we collectYour email address, used to send sign-in codes and one-click sign-in links. If you choose Google sign-in, we receive your email, name and avatar from Google — never your Google password.
  Required?Required

• Basics

  What we collectYour current stage (high school / college / graduate or PhD / working); high school students also give grade and curriculum
  Required?Required

• Profile

  What we collectStage, target school tier, major area, types of past activities and time spent, application season or target date, current main goal; the 3 pre-session questions
  Required?Optional

• Scores

  What we collectGPA, SAT, ACT, TOEFL
  Required?Optional

• Planning tools

  What we collectActivities and drafts you enter
  Required?Optional

• Starred schools

  What we collectSchools you star in the school library, and when you starred them; unstarring deletes the record
  Required?Optional

• Booking a consultation

  What we collectThe mentor and time slot you book, your pre-session topics and one-line note, order number and amount, whether you have paid, the meeting link, and your post-session feedback and rating. You pay our operations team by WeChat transfer; we only record whether the transfer was made and never access your payment account or bank card.
  Required?Required to book

• Becoming a mentor

  What we collectYour school and major, school email, proof of admission or enrollment (and the personal information in it), bio, consultation price, available time slots, current status (college / graduate or PhD / working), and the meeting link for each consultation
  Required?Mentor applicants only

• Usage and security

  What we collectIP address and browser information (to stop code abuse and brute-force sign-in attempts); server logs; error summaries when a page fails (page path and error message only, with emails masked); in-product usage statistics
  Required?Generated automatically

• Account deletion feedback

  What we collectThe reason you optionally give when deleting your account
  Required?Optional

• Sign-in and account security: sending codes, detecting unusual sign-ins and code abuse.
• Planning and reports: generating the four-axis analysis in your planning report from your profile.
• Starred schools: keeping the schools you star in your account, so you see them on any device you sign in on.
• Delivering consultations: letting the mentor you booked understand your situation in advance (see section 05), and sending meeting links and reminders.
• Mentor review: verifying a mentor's school and identity before they can take bookings as a verified mentor.
• Fixing problems and improving the product: locating page errors and measuring feature usage.

We do not sell your personal information, do not run personalized advertising, and do not use your information for purposes not described in this policy. If we need to use it for a new purpose, we will ask for your consent first.

We keep your sign-in token, chosen role (student / mentor), draft basic information and interface language in your browser's local storage, to keep you signed in and remember your settings. Schools you star while signed out are kept there too; when you sign in they are added to your account and removed from the browser. We do not use third-party advertising or tracking cookies. Signing out clears the sign-in token, and you can clear this site's data in your browser settings at any time.

If Google sign-in is enabled, the sign-in page loads a sign-in component provided by Google.

The following providers process the listed information on our behalf, within their terms of service, and may not use it for any other purpose:

• Cloud servers, database and cache (Railway)

  LocationOutside mainland · Singapore
  Information processedAll account and service data, including scheduled database backups. In the cache: Sign-in and school-email verification codes: your email address, a digest of the code (never the code itself), and the IP network range or device identifier the code was requested from, plus the requesting account number for school-email verification; deleted when the code expires. Counters for rate limiting and for de-duplicating access records: counted per IP address, email address, device or account, and deleted automatically when their counting window ends, at most 24 hours

• Website hosting (Vercel)

  LocationOutside mainland
  Information processedBuilding and serving the web pages (including public content such as mentor profiles); IP address, browser information and the page visited, in access logs

• File storage (Railway volume)

  LocationOutside mainland · Singapore
  Information processedAvatars users upload (publicly accessible) and mentors' credential documents; the volume is not directly reachable from the internet and has scheduled backups

• Email delivery (Plus Five Five, Inc. (Resend) · support@resend.com)

  LocationOutside mainland
  Information processedYour email address and email content (sign-in codes, meeting reminders)

• Network acceleration and protection (Cloudflare, when a custom domain is used)

  LocationOutside mainland · if enabled
  Information processedWeb page and API requests passing through it, including IP address, browser information and request content (such as sign-in codes and profiles); used only to route and protect traffic

• Error tracking

  LocationOutside mainland · if enabled
  Information processedError summaries from pages and services

• DeepSeek (Hangzhou DeepSeek)

  LocationMainland China
  Information processedThe activity description text you submit when asking for AI suggestions in the planning tools, without your name, email or other identifiers; the bio, major, expertise tags and internship experience on a mentor's public profile (to generate the English version), excluding credential documents, school email and contact details

These are third-party platforms you choose to use, each governed by its own privacy rules:

• WeChat

  LocationMainland China
  When it is usedAfter booking, to message our operations team and transfer payment

• Tencent Meeting

  LocationMainland China
  When it is usedWhen you open the meeting link, the consultation takes place in Tencent Meeting

• Google

  LocationOutside mainland China · optional
  When it is usedOnly if you choose Google sign-in

• OpenStreetMap

  LocationOutside mainland China
  When it is usedWhen you open the school map, your browser loads map images directly from its servers, which receive your IP address

Only mentors you have booked can see your profile; other mentors cannot.

During the beta, your personal information is stored on servers in Singapore, outside mainland China (see "Storage outside mainland China during the beta" in section 05). Beyond that, only the services marked as outside mainland China in section 04 handle the information listed there, and mentors view it abroad as described in section 05; we do not transfer your personal information outside mainland China in any other way.

• Account, profile, planning data and starred schools

  How long we keep itUntil you delete your account

• Usage statistics (feature clicks and other page events)

  How long we keep itUntil you delete your account; deleted with it

• The booked mentor's access to your profile

  How long we keep itFrom payment confirmation until 30 days after the consultation ends; after that the mentor loses access unless you book again

• Order records

  How long we keep itWhen you delete your account, the linked email, nickname, avatar and profile are deleted or anonymized, together with the pre-session intake, agenda and feedback you wrote in the order. The order itself is kept as a transaction record for at least three years from completion, as required by the E-Commerce Law of the People's Republic of China, and then deleted or anonymized

• Scheduled backups of the database and volume

  How long we keep itUp to 30 days; after account deletion, copies in backups are cleared within 30 days as backups rotate

• Rate-limiting records

  How long we keep itExpire automatically within 24 hours

• Server logs

  How long we keep itDeleted automatically by the cloud providers under their retention periods, at most 30 days

• Access records (when a mentor or staff member viewed your profile, activities, order intake or credential documents)

  How long we keep itKept for at least 6 months to investigate data leaks; kept after account deletion, containing only your account number and none of your data

• Page error records

  How long we keep itNo more than 90 days

• Mentor credential documents

  How long we keep itKept while the mentor status is active, for re-verification; after closing mentor status you can ask us to delete them

• HTTPS encryption across the whole site
• Sign-in codes expire, have a limit on wrong attempts, and sending is rate-limited by IP
• Role-based access: mentors only see students who booked them, and key admin actions are audit-logged
• When a mentor or staff member views your profile, activities, order intake or credential documents, an access record is kept (who, when, and what kind of data)
• Credential documents are not public: only the uploader and our operations staff can retrieve them after signing in
• Error reports exclude request bodies (where codes and profiles live), and emails in them are masked

If a personal information security incident occurs, we will notify you promptly and report to the competent authorities as required by law.

When this policy changes, we update the date at the top of the page. For significant changes — such as what we collect, why we use it, or who we share it with — we will show a prominent notice on the site and ask for your consent again where necessary.