Privacy Policy

Last updated: September 6, 2026

This Privacy Policy explains how CAA Readiness Index LLC, a Mississippi limited liability company (“CRI,” “we,” “us,” or “our”), handles personal information when you visit criscore.org, create an account, use the CRI calculator and planning tools, interact with the CRI Discord bot, participate in community features, contact us, or purchase CRI Plus (collectively, the “Service”).

CRI operates the Service and is the entity responsible for the personal information described in this policy.

This policy is a notice about our practices; it is not a request for consent where consent is not the appropriate legal basis. Our Data Usage Policy gives additional product-level detail, and our Terms of Service govern use of the Service.

1. Information We Collect

In short: We collect your account details, what you enter into CRI tools or the Discord bot, community contributions, payment records if you subscribe, and ordinary technical data. If you choose CASAA auto-fill, we process the application PDF only to extract selected fields for your draft. The acceptance letter and deposit receipt used to verify an accepted-applicant submission are separate documents with a separate review process. Stripe holds your card number, not us. Website Post Generator drafts stay in your browser and are not sent to us.

Account and profile information. Your email address, account identifier, authentication records, display name, optional avatar, account preferences, marketing-email preference, signup source or survey responses, and the date and source of your acceptance of our terms.

Academic, application, and planning information. Information you enter into CRI tools or the Discord bot, such as GPA values, MCAT or GRE type and score, prerequisites, programs of interest, saved programs and results, application milestones, response dates, experience-hour entries and goals, matcher inputs, background information, and notes.

Uploaded transcripts. If you use the transcript upload on the CASAA GPA Calculator, the PDF you choose is stored privately for the seconds it takes to read it and is deleted once it has been read. While it is being read, a copy is sent to Anthropic, whose retention is described in their privacy notice linked in section 6. We keep a record that a read happened, how many files it covered, and its size in tokens, so we can meter the feature and answer billing questions. That record contains no course, grade, or school information.

CASAA applications uploaded for auto-fill.If you choose the CASAA auto-fill option on the Accepted Applicant Survey or the website's Discord Post Generator, your browser uploads the PDF under a random filename to private CRI storage. CRI reads it, sends a copy to Anthropic's commercial API to extract selected application fields, returns those fields to your editable draft, and deletes the stored PDF after processing. A CASAA application may contain a legal name, address, date of birth, applicant ID, references, and essays; CRI's extraction schema does not retain those fields or essay text.

If you use CASAA auto-fill inside the Discord bot, the attachment is uploaded to Discord. CRI retrieves it from Discord for that request, sends it to Anthropic for the same limited extraction, and does not place the PDF in CRI file storage. Discord and Anthropic may retain or otherwise handle the attachment under their own policies. For either upload path, CRI keeps a usage record containing the applicable CRI or Discord user ID, time, processing status, error code when applicable, and token counts. That record does not contain the PDF, its text, or the extracted application fields.

Discord bot information. When you use the bot, CRI receives your Discord user ID, server and channel IDs, commands, button and modal responses, attachment metadata, and the academic, background, experience, school, and cycle information you put in a draft. When you direct the bot to publish, it also uses your server nickname or Discord display name and avatar so the post appears as yours. CRI stores the draft fields, Discord user, server and channel IDs, timestamps, post type, and resulting Discord message IDs as described in section 8. Using the bot by itself does not require a CRI website account. If you choose Connect Discord on the website, Supabase links the Discord identity to your CRI authentication account. CRI then uses the Discord user ID, username, avatar, server membership, roles, screening or timeout state, and channel permissions to confirm that you may publish to the selected CAA Discord channel. CRI does not receive your Discord password or store a Discord user access token in its application tables.

To enforce one shared posting limit across the website and bot, CRI also temporarily records the Discord user ID, draft ID, reservation time, successful publication time when applicable, and expiry time. That quota record contains no post text, form answers, CRI account ID, IP address, or Discord access token.

Acceptance documents. If you fill in the Accepted Applicant Survey, you upload two files at the end: your acceptance letter and your deposit receipt. They go into private storage that no other account can read, and they exist for one reason, so a person can check that you were accepted before your cycle is added to the dataset. This is the same check the CAA Discord does. Both files are deleted the moment your submission is approved or rejected, and automatically after 30 days if nobody has reviewed it by then. What we keep afterwards is the decision, the date it was made, and any note the reviewer wrote. We do not keep the documents, and we never publish them.

Your name on the acceptance letter. The Accepted Applicant Survey also asks you to type your name as it appears on that letter. It is used for one thing, so the reviewer can see that the two files belong to each other and to you, and it is held to the same clock as the files: deleted when your submission is approved or rejected, and automatically after 30 days if nobody has reviewed it. It is never added to the dataset, never exported, and never published.

Survey answers saved in your browser.The Accepted Applicant Survey can be filled in before you sign in, so while you are working on it your answers are held in your own browser's local storage on that device. Except when you choose the CASAA auto-fill described above, nothing is sent to us until you press submit. Extracted auto-fill values become part of the same editable browser draft, but uploading the application does not submit the survey. That saved draft is discarded after 14 days, when you press Start Over, or when a different account signs in on the same device. Uploaded files are never part of the browser draft.

Carrying a post into the Accepted Applicant Survey. The website Post Generator offers to carry the answers you have entered into the Accepted Applicant Survey so that you do not type them a second time. Those answers move through your own browser and are not sent to CRI for this purpose, and carrying them over fills in your editable draft rather than submitting the survey. The Discord bot makes no such offer and creates no link of any kind.

Post Generator answers saved in your browser.The Discord Post Generator keeps what you enter in your own browser's local storage on that device, so a half-written post survives closing the tab or navigating away. It holds both the What Are My Chances and the Success Story post, which of the two you were working on, and how far through you were. Saving sends nothing to CRI. The saved draft is discarded after 14 days, and is removed as soon as both posts are empty, which is what Start Over does. An uploaded CASAA application is never part of it, although fields read from one are saved like anything else on the form.

Post Generator form during account connection.If signing in or connecting Discord takes you away from the Post Generator, the page temporarily places the current form in that browser tab's session storage. It restores and removes the form when you return and ignores a saved copy after one hour. The saved browser form does not include an uploaded PDF.

Community and support content. Application-response contributions, feedback, reviews, ratings, support messages, and related timestamps.

Subscription and transaction information. If you purchase CRI Plus, we receive Stripe customer and subscription identifiers, plan, billing status, renewal and cancellation information, invoice or dispute status, and limited payment metadata. Stripe processes payment-card details; CRI does not receive or store your full card number.

Cancellation feedback. If you cancel CRI Plus, we store the reason you select, either the one Stripe collects in its billing portal or the optional question shown in Account Settings. Answering is optional, and your answer does not affect your access or any refund.

Device, log, and usage information. IP address, browser and device type, operating system, referral source, pages or features used, approximate location derived from IP, timestamps, error and security logs, and cookie or similar identifiers. Google Analytics receives data only if you enable Analytics in our consent controls. Vercel Web Analytics operates without third-party cookies and reports aggregated traffic information.

2. How We Collect Information

In short: Some of it you type in yourself. Some comes from your browser automatically. The rest comes from the companies we use to run the site.

Directly from you when you create an account, use a tool, contribute content, make a purchase, or contact us
Automatically from your browser or device when you use the Service
From service providers and platforms such as Supabase, Stripe, Vercel, Anthropic, and Discord
From public program sources and community-contributed admissions information

3. How We Use Information

In short: We use it to run the site, work out your score, save your stuff, handle payments, email you, spot abuse, and follow the law.

Provide, personalize, maintain, and troubleshoot the Service
Calculate CRI scores, percentiles, comparisons, and program matches
Save your scenarios, trackers, prerequisites, programs, goals, and preferences
Extract selected fields from a CASAA application when you request auto-fill
Connect a Discord identity, verify CAA server and channel access, operate Discord drafts, publish, update, or delete a post when you direct CRI to do so, and enforce Discord posting limits
Operate community activity, response tracking, and aggregate analytics
Process subscriptions, renewals, cancellations, refunds, and payment disputes
Send authentication, security, billing, service, support, and marketing messages when enabled
Measure performance, understand feature use, and improve our models and tools
Detect fraud, scraping, abuse, security incidents, and violations of our Terms
Comply with law and establish, exercise, or defend legal claims

4. Community and Public Information

In short: Some parts of CRI are meant to be seen by other people. Website community views omit your email and account ID. A Discord draft stays in the private interaction panel until you choose Post it; the resulting post shows the information you included together with your Discord name and avatar to people who can access that channel.

Some features are designed to share information with the CRI community. The Recent Calculations Made feed and Community Score Distribution may show a calculation's CRI score, GPA range, test type, and test-score range without showing the account's email, user ID, or display name.

The community application dashboard may show school, application cycle, submission and response month, status, response method, fee, and submission timestamp. Account IDs and private notes are excluded from the public community view. Do not submit information you want to keep confidential.

The Discord bot's builder panel and preview are sent as an ephemeral interaction visible to you. The bot publishes only when you choose Post it, and the website publishes only after you confirm Post now. A published What Are My Chances or Success Story post may include the academic, background, experience, school, cycle, and free-text information you selected, and it is displayed with your current server nickname or Discord display name and avatar. Anyone who can access that Discord channel may be able to view or copy it. You can run the command again to update or delete a post while CRI still has the required draft or message record; Discord moderators and Discord may also control content on their platform. Do not include information you do not want channel members to see.

Supporters panel. You may choose to be listed in Supporters. Listing is off by default and is a separate decision from the licensure advocacy contribution, which applies to every CRI Plus subscription and involves no choice by you. When you enable listing, the panel shows the display name from your profile, together with the month you chose to be listed. It is visible only to signed-in CRI members, is not accessible to the public, and is excluded from search engine indexing. Your email, account ID, and the amount contributed on your behalf are never shown, and the order of the list does not reflect any amount. Your name appears only while your CRI Plus subscription is active and is removed when that subscription ends, so being listed tells other signed-in members that you are a current CRI Plus subscriber. Turning listing off removes your name immediately.

We may use aggregated or de-identified information for product analytics, community benchmarks, reports, and research. We do not publish your email or account ID as part of those materials.

5. How We Disclose Information

In short: We pass data to the companies that run parts of the Service, including Supabase, Vercel, Anthropic, Discord, and Stripe. We may also disclose it if the law requires it or if the company is sold. We never sell your personal information, and we never use your grades to target ads at you.

We may disclose information to the following recipients for the purposes described in this policy:

Supabase: database hosting, authentication, and file storage
Vercel: website hosting, delivery, logs, and web analytics
Render: hosting for the CRI analysis backend that calculates scores
Cloudflare: DNS, content delivery, network protection, and temporary routing for CRI services
Google Analytics: consent-based website analytics
Anthropic: reading transcripts and CASAA applications you choose to upload
Discord: providing linked-account authorization, server membership verification, the bot interface, bot interactions and attachments, and delivery of posts to Discord channels
Stripe: checkout, subscriptions, invoices, refunds, and payment disputes
Resend: transactional, service, and marketing email delivery
Mailgun: receiving email you send to our support and privacy addresses
Mapbox: map tiles and interactive program-map functionality
Google/YouTube: playlist data and video playback when those features are used
The CRI community: information you submit to public or community features as described above

We may also disclose information if required by law; to protect rights, safety, and security; to professional advisers; or as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards.

We do not sell personal information or share it for cross-context behavioral advertising. We also do not use your academic profile to target third-party advertising.

6. Service Provider Privacy Notices

In short: Links to the privacy policies of every company we use. They handle your data under their own rules.

These providers process information under their own terms and privacy notices.

7. Cookies and Similar Technologies

In short: Some cookies are required to keep you logged in and secure. Google Analytics only runs if you turn it on, and you can change your mind any time from Cookie Preferences in the footer.

We use necessary cookies and browser storage to authenticate accounts, protect sessions, remember trusted-device and consent choices, preserve interface preferences, and provide requested functionality. Disabling these technologies may prevent account or security features from working.

Google Analytics is loaded only after you choose to enable Analytics. Its standard web implementation uses a first-party identifier to distinguish users and sessions. Vercel Web Analytics does not use third-party cookies and provides CRI with aggregated traffic data.

You can revisit your choice at any time using Cookie Preferencesin the site footer. You may also clear or block cookies and site data in your browser. We do not respond to Do Not Track signals because there is no consistent industry standard for them; we honor legally required opt-out preference signals where applicable.

8. Data Retention

In short: Retention depends on the feature. Website CASAA uploads are deleted after processing, unfinished Discord drafts expire after about one day or whenever you press Delete draft, and published Discord drafts remain editable until Delete post removes both the post and its saved draft. Acceptance-verification documents are kept only until review and never longer than 30 days. Some identifiers, shared content, provider records, and legal or security records last longer.

We keep personal information only as long as reasonably necessary for the purposes described here, including providing the Service, maintaining community datasets, resolving disputes, enforcing agreements, meeting legal obligations, and protecting the Service. Retention depends on the type of information:

Account and private planning data are generally retained while your account is active
Calculation and community contributions may be retained to maintain longitudinal, aggregate, and community features
Support, security, and transaction records may be retained as needed for fraud prevention, accounting, disputes, and legal compliance
A CASAA application uploaded through the website is deleted from CRI storage after processing; extracted fields then follow the retention rules of the editable form or survey draft they fill
CRI does not store a CASAA application uploaded through the Discord bot as a file; Discord and Anthropic handle their copies under their own retention policies
An unposted Discord bot draft expires 24 hours after creation and is deleted by routine cleanup, and the panel's Delete draft button removes it and its answers straight away, whether or not anything has been filled in
After publication, CRI keeps the form answers and Discord user, server, channel, and message IDs needed to edit or delete the post until Delete post removes both the Discord post and its CRI draft record
Deleting a message directly in Discord may not immediately tell CRI to remove the saved draft; use Delete post in the bot or contact us when you want both copies removed
Some posts made before September 1, 2026 no longer have saved form answers because those answers were removed under the previous 30-day policy; the answers cannot be restored, but the bot can still delete the Discord post
Discord publication-quota records contain a Discord user ID, draft ID, and short-lived timestamps but no post content or form answers; they are removed through routine cleanup after they stop affecting the rolling one-hour limit
A Discord Post Generator draft is held only in your own browser, is discarded 14 days after it was last changed, and is removed as soon as both posts are empty
A linked Discord identity remains associated with your CRI authentication account until you disconnect it, delete the account, or the provider removes it, subject to provider, backup, legal, and security retention
CASAA auto-fill usage records may be retained for quota enforcement, security, troubleshooting, and cost accounting, but contain no PDF content or extracted fields
Acceptance letters and deposit receipts uploaded to the Accepted Applicant Survey are deleted when the submission is approved or rejected, and no later than 30 days after it is made; only the decision, its date, and any reviewer note are kept
The name given with those documents is deleted on the same schedule, in the same operation, and is never added to the dataset or published
Analytics and infrastructure providers retain data under their settings and policies
Deletion may not immediately remove information from encrypted backups, provider records, or information we must retain by law

9. Your Choices and Rights

In short: You can view, edit, or delete almost everything yourself in Account Settings. Email us if you want a copy of your data or need something removed that you cannot remove on your own.

Review and update profile information in Account Settings
Delete saved results and other user-managed entries in the relevant tool
Disconnect Discord from the Post Generator, and use the Discord bot to delete a draft before it is posted or to update or delete a supported published post, or contact us if those controls are no longer available
Turn marketing email on or off in Account Settings
Change consent-based analytics through Cookie Preferences
Delete your account from Account Settings
Request access, correction, deletion, or a portable copy by emailing us

Account deletion removes the authentication account and account-linked data subject to technical, legal, security, and payment-record exceptions. It does not necessarily cancel an active subscription with Stripe. Cancel CRI Plus in Account Settings > Billing before deleting your account.

We may need to verify your identity before completing a request. Rights and exceptions vary by location, and we will respond within the period required by applicable law. Authorized agents may submit a request where permitted by law, subject to verification of their authority.

10. U.S. State Privacy Disclosures

In short: If you live in a U.S. state with a privacy law, you have extra rights, like asking what we hold on you and having it deleted. We will not treat you worse for asking. If we turn a request down, you can ask us to look again, and if we still say no we will point you to your state attorney general.

Depending on where you live and whether the applicable law covers CRI, you may have rights to know or access, correct, delete, or obtain a copy of personal information; opt out of certain sales, sharing, targeted advertising, or profiling; limit certain uses of sensitive information; appeal a decision; and receive equal service without discrimination.

In the preceding 12 months, CRI has collected the categories described in Section 1: identifiers; customer records; commercial information; internet or electronic activity; educational and professional information; user-provided content; approximate geolocation; and inferences generated by CRI tools. We have disclosed these categories for the business purposes in Sections 3 and 5. We have not sold them or shared them for cross-context behavioral advertising.

Appealing a decision. If we decline a privacy request, you may appeal. Reply to our decision, or email team@criscore.orgwith “Appeal” in the subject line and a brief explanation of why you disagree. We will review it and respond in writing within 45 days, with the reasons for our conclusion. If we deny the appeal, that response will also tell you how to complain to the attorney general or supervisory authority where you live.

11. EEA, UK, and Swiss Users

In short: If you are in Europe or the UK, GDPR-style rights apply to you, including the right to object, to get your data moved, and to complain to your local regulator.

Where applicable, our legal bases include performance of a contract (providing your account, requested tools, and subscription), legitimate interests (operating, securing, preventing abuse of, and improving the Service), consent (Google Analytics and marketing where required), and compliance with legal obligations. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

You may have rights to access, rectify, erase, restrict, port, and object to processing, as well as the right to complain to your local supervisory authority. CRI and its providers may process information in the United States and other countries that may have different data-protection laws. Where required, transfers are made using recognized safeguards.

12. Automated Outputs

In short: Our scores and matches are worked out by formulas. Optional CASAA auto-fill uses an AI model to copy selected fields into a draft for you to check. Neither process makes an admissions decision or automatically submits or publishes your information.

CRI scores, percentiles, comparisons, and Program Matcher results are generated automatically from the data you enter and our statistical models. They are informational planning tools. CRI does not make admissions decisions, and these outputs do not produce legal or similarly significant effects.

CASAA auto-fill uses Anthropic's model to extract selected fields from the document you provide. Automated extraction can be incomplete or incorrect. The returned fields remain editable, and CRI does not submit an Accepted Applicant Survey or publish a Discord post until you take the separate action that does so.

13. Security

In short: We use encryption, access controls, and managed logins to protect your data. No website is perfectly safe, so keep your own login secure too.

We use safeguards designed to protect information, including HTTPS, access controls, server-side authorization, and database row-level security. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Protect your credentials and contact us if you believe your account has been compromised.

14. Age Requirement

In short: You must be 18 or older. We do not knowingly collect data from children, and we delete it if we find it.

The Service is intended for adults applying to graduate-level professional programs. You must be at least 18 to create an account or purchase CRI Plus. We do not knowingly collect personal information from children. Contact us if you believe a child has provided personal information.

15. Changes to This Policy

In short: If we change this policy, we post the new version with a new date, and tell you directly when the change is a big one.

We may update this policy as the Service or law changes. We will post the revised policy with a new “Last updated” date and provide additional notice when a change is material and applicable law requires it.

16. Contact and Privacy Requests

Email questions or privacy requests to team@criscore.org. Please use the email associated with your account when possible and describe the request clearly.

Written requests may be sent to CAA Readiness Index LLC at PO Box 15352, Hattiesburg, MS 39404.