Privacy policy

This policy explains what College Actually (“we”) collects when you use the site, why, who it's shared with, and the choices you have. We collect as little as we can and never sell your information.

The short version

• You can browse without an account. We don't use advertising or third-party trackers.
• Your email address, school email and IP address are never shown to anyone.
• We don't keep your school email. We keep only a one-way fingerprint of it.
• We never sell or rent your information, and universities don't receive it from us.
• You can delete your account at any time from your account page, or ask us by emailing collegeactuallysupport@gmail.com.

What's public

• Your username, unless you post anonymously, and the reviews and ratings you post.
• A “Verified Student” badge, if you've verified with a school email.
• Survey results, only as totals, and never for groups too small to stay anonymous.

What's never public

• Your email address, your school email, your IP address, and which account wrote an anonymous review.
• Your individual survey answers. Only averages for groups of 5 or more people are ever shown.
• Your saved places.

What we collect, and why

• Account: your email address, username and a securely hashed password. We use your email only to sign you in and send account emails. We can't read your password.
• Student verification: we use your school email once, to send a code, and don't keep it. We store a one-way fingerprint of it so the same address can't verify a second account.
• Sign-in sessions: a one-way fingerprint of your IP address and your browser type, for security and to stop abuse.
• What you post: reviews, ratings, helpful votes, reports, saved places and survey answers. Each review also keeps a one-way fingerprint of the IP address it was posted from, never shown, so moderators can spot spam and fake reviews.
• Abuse prevention: short-lived counters that limit how often actions like signing in or posting can happen. They use one-way fingerprints, not your IP address or email.
• Usage: simple counts of which features get used (for example, “a search happened”), with no account, IP address or search text attached.
• Staff records: when a moderator acts on a review or an account, we keep a log of what was done and why, so decisions can be checked.

Cookies

We use only the cookies needed to keep you signed in. There are no advertising, analytics or third-party cookies. If you block cookies, you can still browse, but you won't be able to sign in.

Anonymous posting

Anonymous reviews hide your username from everyone else. The account behind them is still known to our moderators, so harassment and spam can be stopped. We don't reveal who wrote an anonymous review unless the law requires it (see below).

Who we share it with

We use a small number of services to run the site. Each gets only what it needs:

• Database hosting (Supabase): stores the site's data on servers in the United States. Connections are encrypted.
• Web hosting: serves the site's pages.
• Email delivery (Resend): receives the email address and message for account emails, so they can be delivered.
• AI summaries (Anthropic): only if you choose “Summarize with AI” in Ask. Your question and the site's public reviews and rankings are sent to write the summary. Your account details, email and IP address are not sent, and we don't store your questions.

We may also share information if the law requires it, such as a valid court order, or to protect someone from serious harm. Otherwise we don't share, sell or rent your information to anyone.

Email

We only email you for account actions: confirming your address, resetting your password and verification codes. No newsletters or marketing.

How long we keep it

• Your account and what you post: until you delete it or your account.
• Sign-in sessions: up to 30 days, or until you sign out.
• Verification codes: 15 minutes. Password reset links: 1 hour.
• Usage counts: 90 days. Abuse-prevention counters: about a day after they expire.
• Staff records of moderation decisions: kept so decisions can be reviewed, without your email or IP address.

Your choices

• You can change your username and edit or delete your reviews at any time from the site.
• Delete your account: on your account page, confirm your password and it's deleted right away, along with your reviews, ratings, votes, saved places, survey answers and student verification. If you can't sign in, email collegeactuallysupport@gmail.com from the address on your account and we'll delete it within 30 days. Reports you filed and professor requests you sent stay with our moderators without your account attached, and records of staff decisions about your account are kept. Survey totals that have already been calculated may still include your answer, without anything that links it to you.
• Get a copy of your information, or ask us to correct it: email the same address.

Young people

You must be 13 or older to create an account. If you're under 13, please don't sign up. If we learn that an account belongs to someone under 13, we'll delete it. Parents can contact us at collegeactuallysupport@gmail.com. Some parts of the site, like bar and Greek life reviews, can only be written by verified college students.

Security

Passwords are hashed, school emails and IP addresses are stored only as one-way fingerprints, and every connection is encrypted. No system is perfectly secure, but if we learn of a breach that affects you, we'll tell you.

Not affiliated

College Actually is an independent student platform. It is not run by, endorsed by or affiliated with any university, and universities don't receive your data from us.

Changes and contact

If we change this policy, we'll update the date at the top, and for important changes we'll tell signed-in users on the site. Questions or requests: collegeactuallysupport@gmail.com. See also our terms of use and community guidelines.