Privacy Policy: How We Protect Your Data
Last updated: October 20, 2026
Scholarship Wizard (“we”) is operated by Vantyx. This policy covers the website at scholarshipwizard.net and the Scholarship Wizard Autofill Chrome extension. We are not a lender, are not affiliated with FAFSA or the U.S. Department of Education, and we never ask for a Social Security number.
What we collect
Account data
Email address, a salted password hash (never the password itself), account type (parent or student), display name, and your email notification preferences. If you arrive through a referral or partner link we store that referral code with your account.
Student profile data (used for matching)
Grade level, graduation year, state, city/county, GPA, intended major, career interests, planned college type, activities, honors, first-generation status, financial-need level, and optional self-reported demographic and life-circumstance details you choose to add (for example ethnicity, or circumstances such as caregiving responsibilities or a learning difference). These optional details exist only because many scholarships are restricted to applicants who have them; every one of them is optional and you can clear them at any time. A parent account may hold more than one student profile.
Application identity data (only if you use application features)
When you prepare a real application we store the details provider forms ask for: legal first, middle and last name, date of birth, cell and home phone, mailing address, country, citizenship and visa type, gender, ethnicity, SMS consent, and a parent/guardian contact block (relationship, name, email, phone, SMS consent). Every one of those fields is encrypted at rest. We also store any documents you upload (such as transcripts or recommendation letters) and, where you create provider accounts through us, those credentials, also encrypted at rest.
Content you create
Saved scholarships, match history and dismissals, applications and checklists, application outcomes you report, and every version of every essay draft.
Payment data
Subscriptions are processed by Stripe. We never see or store your card number. We store only a Stripe customer and subscription identifier, your plan, and its status.
Technical data
Server logs record IP address, user agent, and requested URL for security, abuse prevention and debugging. We use Google’s ad measurement tag to learn whether our Google ads lead to sign-ups (see Cookies below). We do not run third-party analytics or social pixels, we do not use remarketing or ad personalization, and we do not sell or rent personal information to anyone, ever.
Cookies
auth_token keeps you signed in. It is HttpOnly (unreadable by page
scripts), SameSite=Lax, sent only over HTTPS in production, and expires after
7 days. It is strictly necessary for the service to function. Signing out, changing your
password, or resetting it invalidates the session immediately.
Ad measurement cookies let us and Google tell whether a click on one of our Google ads led
to a sign-up or trial. Google’s tag sets _gcl_* cookies (90 days): a
random identifier on any visit, plus the ad’s click identifier when you arrive from one
of our ads. When you arrive from an ad we also keep that click identifier in our own
_sw_gcl cookie (90 days). They carry none of your profile or application data
and are not used for remarketing or ad personalization. You can block or delete them in your
browser without affecting the service.
The Chrome extension
The Scholarship Wizard Autofill extension fills scholarship application forms with the profile data you already gave us, inside your own browser session.
-
You sign in through the extension. The resulting session token is stored in
chrome.storage.local, which is private to the extension and unreadable by any web page. Signing out of the extension deletes it. - When you press Fill this page, the extension requests your selected student profile's field values from our API and writes them into the matching fields of the page you are on. Nothing happens until you press that button.
- The extension never submits a form. You review every field and submit yourself.
- The extension does not read, collect or transmit the contents of the pages you visit, your browsing history, or anything else from the sites you use it on. Data flows one way: from your Scholarship Wizard profile into the form in front of you.
- It requests access to a page only at the moment you click the extension icon, and it talks to no server other than scholarshipwizard.net.
Children's privacy
Scholarship Wizard is built for high-school students and their families, so we expect to hold data about people under 18.
- Accounts are for parents/guardians and students aged 13 or older. A student below 9th grade cannot create their own account; a parent or guardian must create the account and manage the student's profile.
- We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us information, email [email protected] and we will delete it.
- A parent or guardian who holds the account can view, export, correct or delete their student's profile and all associated data at any time from the Account tab.
- We do not use student data for advertising, do not build advertising profiles, and do not disclose student data to advertisers or data brokers.
Who we share data with
We use a small number of processors, each for one purpose:
- Stripe — subscription payments and the billing portal.
- Our AI service — essay drafts, plain-English match explanations, and reading uploaded documents. Requests carry the profile and scholarship context needed to produce the draft. Essay generation runs on Vantyx-operated infrastructure by default; if a scanned document needs an image-capable model we may use xAI (Grok) as a fallback for that step only.
- Zoho Mail — sending and receiving our email.
- Our catalog crawler — fetches public scholarship pages to build the catalog. It reads provider websites, never your data.
- Cloudflare — serves and protects the site.
We also disclose information where the law requires it, or to protect the rights and safety of our users. When you apply to a scholarship, information you submit to that provider is governed by the provider's own privacy policy, not ours.
How long we keep it
Account and profile data are kept while your account is open. Deleting your account removes your profiles, matches, applications, essay drafts, uploaded documents, application identity records and stored provider credentials from our database. Server logs roll off within 30 days. Stripe retains payment records for as long as its own legal obligations require, and backups are purged on their own rotation (encrypted, and no more than 30 days old).
Your choices and rights
- Export — download everything we hold about your account as JSON from the Account tab.
- Delete — delete your account and its data from the Account tab. This is immediate and cannot be undone.
- Correct — edit any profile field at any time, including clearing optional demographic details.
- Email — every recurring email has a one-click unsubscribe link, and each stream (deadline reminders, digests, new-match alerts, catalog updates) can be switched off independently on the Account tab. Account emails such as password resets are not marketing and are always sent.
If you are in a jurisdiction with additional rights over your personal data (for example the EU/UK or a U.S. state privacy law), write to us and we will honour them.
Security
Passwords are salted and hashed. Application identity fields and provider credentials are encrypted at rest with a key held outside the database. Traffic is HTTPS-only with HSTS. Database backups are encrypted. No system is perfectly secure, but we hold the minimum data the product needs — which is why we never ask for an SSN.
Changes
We will update the date at the top of this page when this policy changes, and will tell you by email if a change materially affects how we handle your data.