Privacy Policy

Things you tell us directly

• Account: your email address, your name if you give one, your timezone, your target cycle year, and which application services you are using.
• Schools and applications: the schools you are applying to, each application’s status and history, interview details, costs you log, your notes, and a portal address with an optional username hint. We deliberately do not support storing portal passwords.
• Academic record: coursework, credits, grades, MCAT attempts, and any transcript file you upload.
• Experience: activities, hours, and the private reflections (“moments”) you attach to them.
• Essays: your personal statement, backbones, per-school versions, and every saved revision of each.
• Letter writers and supervisors: the names, roles, and email addresses of third parties you ask us to track or contact. See section 4.
• Billing: what you bought, when, how much it cost, and whether it is still active. Card details are not on this list and never will be: they go straight to Stripe and never touch our servers. See section 8.
• Gifts: if you buy one, the buyer’s email address and the recipient’s name and email if given. Any note written to the recipient is encrypted before it is stored and is shown only to them.

Things we collect automatically

• Sign-in records: your email address and session records. You can sign in with a password or with a one-time emailed link. Both reach the same account. Authentication is handled by Supabase; if you set a password we never see it, and only a hash of it is stored, never the password itself.
• Forwarded mail: if you use a Cyclios forwarding address, we receive the messages you forward to it. See section 3.
• Push subscriptions: if you enable notifications, the subscription details your browser issues.
• Operational logs kept by our hosting and email providers, which include IP addresses, for security and abuse prevention.

We do not use advertising trackers, we do not sell or share your personal information for cross-context behavioural advertising, and we do not build advertising profiles. Fonts are served from our own domain, so simply reading a page does not tell a third party you did.

We use your data to run the product you asked for: tracking your applications and deadlines, calculating your GPA, showing which requirements you have met, reminding you about things, and letting you write and find your essays. We also use aggregate, non-identifying counts to understand whether features work.

We do not use your essays, moments, or forwarded mail to train AI models, our own or anybody else’s. Section 5 sets out exactly which AI processing happens.

The forwarding address exists so a secondary invitation or an interview offer can update your tracker without you retyping it. When a message arrives we classify it, extract the school, the dates and a short summary, and keep only that extracted information long term.

The raw message body is encrypted at rest and deleted after you confirm or dismiss the suggestion it produced. Forward only what is useful to you: anything you send to that address is processed as described here, including anything a school happened to include that you did not need us to see.

Two features involve people who are not you: tracking a letter writer, and asking a supervisor to verify your hours. When you use them you give us that person’s name and email address, and in the verification case we email them on your behalf.

• We contact a supervisor only because you asked us to, using a single-use link, and we keep what they submit as part of your record.
• Anyone we email can decline and opt out of any further contact, and we keep a suppression list so that choice is honoured.
• You are responsible for having a reasonable basis to give us someone else’s contact details: in practice, that they know you are asking.

Two features let you show parts of your record to another person, and both are off until you turn them on. Nothing in this section happens to anyone who does nothing.

• Friends can be shown your effort: total logged hours, hours by type, and your streak. Each is a separate switch, one setting for all friends, and all three start off. Friends can never see anything else, whatever they or you select.
• An advisor you link can be shown a set you choose per advisor: hours, streak, courses completed, how many schools you are tracking, GPA, MCAT, readiness and requirement gaps. You pick the set when you accept their code, you can change or revoke it at any time, and revocation is immediate. Advisors can read what you show them; they cannot change anything.

Some things are never shareable at any setting, by design rather than by default: your essays and their versions, your moments and journal entries, forwarded email and anything extracted from it, which schools you are applying to, application statuses, interviews and decisions, letters and letter-writer identities, and supervisor contact details. There is no toggle for these; the feature cannot show them.

Every grant, change and revocation is recorded, and so is each time your shared fields are actually shown to someone. That disclosure log is yours to inspect, in Settings, so “who has looked, and at what” is a question you can answer without asking us.

Cyclios uses AI for a small number of specific jobs, and each one is a suggestion you confirm rather than something applied silently:

• Classifying forwarded email: deciding whether a message is a secondary invitation, an interview offer, or a decision, and pulling out the dates.
• Reading an uploaded transcript into a coursework list you then check.
• Suggesting how a course maps to prerequisite subjects, and which canonical question a school’s essay prompt is asking.
• Adapting one of your essays to a school’s prompt, only when you ask. This is the one feature that sends something you wrote to an AI provider, and it never runs on its own: the button says what will be sent before you press it, each press is a separate decision, and the result is a suggestion you can accept or discard. Nothing is saved unless you accept it, and declining changes nothing.

These calls go to Anthropic, whose API terms do not permit it to train models on this data. We separately send published school essay prompts and our own category descriptions (public catalogue text, never anything you wrote) to OpenRouter to compute similarity scores. Beyond the essay-adaptation feature you invoke yourself, nothing you wrote, your essays, your moments, your email bodies, is ever sent to any AI provider.

We log the model, token counts and timing of every AI call so we can see what the feature costs. We never log the content.

None of this makes a decision with legal or similarly significant effects about you. Everything the product suggests is advisory, and every suggestion needs your confirmation.

• Your essays, your moments, and raw forwarded email bodies are encrypted at rest with AES-256-GCM, on top of the encryption our database provider applies.
• Search decrypts your writing in memory for the length of a single request and stores no index of what it says, a deliberate choice, because a searchable copy in the clear would undo the encryption sitting next to it.
• Uploaded documents are private, and are served through links that expire in 60 seconds.
• All access is server-side and scoped to your account. Sessions use signed, HTTP-only cookies.

No system is perfectly secure, and we do not promise that one is. We do promise to tell you promptly if we learn that your data has been exposed.

We use these providers to run the service. They process data on our instructions and are not permitted to use it for their own purposes.

We do not sell your personal information, and we have not in the preceding twelve months.

We never see your card. Payment is handled by Stripe: your card details are entered on Stripe’s own checkout and go directly to them. We could not show you your own card number if you asked, because we have never held it.

What we do hold is the record of the transaction:

• an identifier linking your account to your customer record at Stripe;
• what you bought, when, the amount, and the currency;
• whether a subscription is active, cancelled or past due, and when the paid period ends;
• whether something was refunded, and when.

Stripe is a processor for us and also handles this data as a controller in its own right for fraud prevention and its own legal obligations. Its privacy policy governs that part and is worth reading if you want the full picture.

If you use a referral code we record who referred whom, so the reward can be paid and reversed if the purchase is refunded. That is visible to us, not to other users: a referrer learns that a reward was earned, never who bought what.

• Your account and records: until you delete them or close your account.
• Raw forwarded email bodies: deleted once classified and acted on.
• Essay versions: kept until you delete the essay, because recovering a paragraph you cut months ago is the point of keeping them.
• Agreement records: kept while your account exists and for as long as we may need to show what you agreed to.
• Billing records: what you bought, when, and for how much, kept for as long as tax and accounting law requires, which is longer than your account. This is the one category that survives deletion, and it is a legal obligation rather than a choice. It never includes card details, because we never have them.

When you delete your account we delete your personal data, including your essays and their history, other than anything we are required to keep by law: in practice, the billing records above.

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or export it, and we will not treat you differently for asking. Email office@cyclios.com and we will respond within 30 days.

If you are in the EEA or UK, our basis for processing is performance of our contract with you for the core product, your consent for optional things like push notifications and the forwarding address, and our legitimate interest in keeping the service secure. You may withdraw consent at any time and complain to your local supervisory authority. If you are in California, the rights above are your CCPA/CPRA rights to know, delete, correct and opt out; we do not sell or share your data, so there is nothing to opt out of.

Cyclios is not intended for children. You must be at least 16 to use it, and if you are under 18 a parent or guardian must agree to the Terms on your behalf. We do not knowingly collect data from anyone under 16; if you believe we have, contact us and we will delete it.

If we change this policy in a way that matters, we will publish a new version and ask you to read and accept it the next time you sign in. Minor corrections are published without asking again. Every version is dated at the top of this page.

Kyle Klintworth
office@cyclios.com

Cyclios operates entirely online and has no physical premises open to the public. Email is the fastest way to reach us, and it is the address to use for any request under section 10.