Privacy Policy

What we collect and why

Honest.Education collects only the minimum information necessary to deliver the certification service. We do not collect data for advertising, profiling, or sale to third parties.

• Account information: Email address and password (hashed) to create and secure your account.
• Payment information: We use Stripe for payment processing. We store only your Stripe customer ID and payment status. We never see or store raw card numbers.
• Identity verification: Completed via Stripe Identity. We store only the verification status result. The underlying identity documents are held by Stripe subject to their privacy practices.
• Student information: First name, last name, and date of birth. We collect date of birth to determine whether the student is a minor for the purpose of routing the attestation correctly. We do not require a student login or a student account.
• Essay content: The uploaded essay text and file, stored securely in access-controlled storage. The first paragraph is stored separately to support the verification lookup.
• Attestation records: The sworn attestation, including the typed full legal name, attestation timestamp, and IP address of the signing session. These records are immutable once created.
• Verification logs: Each admissions officer lookup is logged, including the H-number queried, the second factor used, the result, and the requesting IP. These logs exist for audit and abuse prevention purposes.

Student data and minor protections

We are aware that many students using this service are under 18. We take the following specific measures:

• We do not create accounts for students. The account is always held by a paying adult.
• Students under 13 cannot sign the sworn attestation. The attestation must be signed by a parent or legal guardian.
• We collect student date of birth only to determine minor status. It is stored securely and not displayed in the verification database.
• We comply with the intent of COPPA for users under 13, FERPA-adjacent expectations for student data, and applicable state student privacy laws.

How we store and protect your data

All data is transmitted over encrypted HTTPS connections. Student and certification records are stored in access-controlled, role-restricted storage: only the account holder and authorized administrators can read them. Access to the verification database is limited to the minimal fields needed to confirm a certificate (student name, certification date, and the opening paragraph) and is rate-limited per requesting location.

Our sessions use httpOnly, sameSite, and secure cookies. We enforce HTTPS across all services.

How long we keep your data

We retain certification records for as long as they may be needed for verification purposes, typically seven years from the date of issuance. Account data is retained while the account is active. You may request deletion of your account and associated student data at any time by contacting us.

If a student's data is deleted, any associated certificates are revoked before deletion. Revocation is permanent and reflected on the verification page.

Your rights

You have the right to:

• Request a copy of the data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated student data
• Withdraw consent where processing is consent-based

To exercise any of these rights, contact privacy@honest.education.

Third parties

We share data with the following third parties only as necessary to operate the service:

• Stripe: For payment processing and identity verification.
• Pangram: Essay text is sent to Pangram's API for AI-authorship analysis. We share only the essay text, not student PII.

We do not sell, rent, or share your data with advertising networks, data brokers, or any other parties.

Contact

For privacy questions or data requests, contact us at privacy@honest.education.