Privacy Policy
Last updated: September 28, 2026
This policy explains what data Meritously collects, why we collect it, and how we protect it. We've written it in plain English first, with the formal language below each summary.
What We Collect
Account Information
When you create an account, we collect your name and email address through Clerk, our authentication provider. We do not store your password. Clerk handles authentication directly.
Profile Data
To match you with scholarships, we ask for information such as your GPA, intended major, school name, graduation year, demographic background, and scholarship preferences. This data is stored in our database and used solely to power your personalized scholarship feed and essay suggestions.
Optional Weekly Digest
If you join the weekly scholarship digest, we store your email address, confirmation and unsubscribe status, consent timestamps, and delivery records. We use hashed email and network identifiers to limit repeated signup requests. The digest is separate from account notifications and starts only after you confirm your email. Resend delivers these messages. Every digest includes an unsubscribe link; we retain your opt-out status to prevent further deliveries. You can request deletion using the contact address below.
Usage Data
We measure visits to the home page and public scholarship pages, returning browsers, account creation, saved awards and confirmed weekly digest opt-ins. We store page categories, limited campaign/source labels and referring hostnames, using random browser identifiers and keyed hashes. These identifiers are pseudonymous, not a count of individual people.
Analytics records do not contain raw IP addresses, emails, names, profile or essay content, full query strings, or account and email confirmation tokens. Private account pages and email action pages are excluded from browser tracking. A temporary keyed network hash limits abusive measurement requests. Reports are available only to the authorized site owner.
Cookies & Local Storage
We use cookies to maintain your session and remember your preferences. See the Cookies section below for details.
How We Use It
Scholarship Matching
We use your profile data and OpenAI-generated embeddings to rank and surface scholarships that best match your background and goals. This matching runs entirely within Meritously's infrastructure. Your profile is not shared with OpenAI beyond the embedding generation step.
Essay Engine
When you use Meritously's essay tools, your profile and essay drafts may be processed by OpenAI's API to generate suggestions. Only the data necessary for a given request is sent. We do not send your entire profile indiscriminately.
Deadline Reminders
If you opt in to deadline reminders, we use your email address to send transactional notifications via Resend. You can unsubscribe from these emails at any time from your account settings.
Product Improvement
Aggregated, anonymized usage data helps us understand which features are working and which need improvement. Individual user data is never used for A/B testing without your knowledge.
What We Don't Do
Beyond not selling your data, we also do not:
- Share your personal information with scholarship providers or universities without your explicit action (e.g., you clicking "Apply").
- Use your essays or profile data to train AI models without your explicit, opt-in consent.
- Send marketing emails to third parties on behalf of sponsors or partners.
- Use third-party advertising networks or tracking pixels.
- Retain your data after account deletion beyond the minimum required by law.
Third-Party Services
Clerk (Authentication)
Handles sign-up, sign-in, and session management. Clerk stores your email and password hash. Their privacy policy governs how they process your authentication data.
Neon (Database)
Hosts the PostgreSQL database where your profile, tracker, and scholarship data is stored. Data is encrypted at rest and in transit. Neon does not access your data for any purpose other than storage.
Vercel (Hosting & Infrastructure)
Serves the Meritously application. Vercel may log request metadata (IP address, request path, response time) for infrastructure and security purposes. These logs are retained for a limited period per Vercel's data retention policy.
OpenAI (Scholarship Matching & Essay Engine)
We send profile attributes and essay text to OpenAI's API to generate embeddings and essay suggestions. OpenAI does not use API data to train models by default under their enterprise terms. Only the minimum required data is sent per request.
Resend (Transactional Email)
Sends deadline reminders and account notifications to your email address. Resend is used exclusively for transactional email (no marketing or bulk mail).
Data Retention
Active Accounts
While your account is active, we retain your profile data, application tracker history, saved scholarships, and essay drafts. You can delete individual items at any time from within the app.
Account Deletion
When you delete your Meritously account, we initiate deletion of your personal data within 30 days. This includes your profile, essays, tracker entries, and any preference data. Some data may persist in encrypted database backups for up to 90 days before those backups are rotated and overwritten.
Analytics Retention
Analytics events are retained for 90 days and removed by a daily cleanup. Temporary network rate-limit hashes expire after one day and are removed by the same cleanup. Counts may be incomplete when browsers block storage or requests, or when measurement is unavailable.
Your Rights
Depending on your location, you may have the following rights under GDPR, CCPA, or similar privacy laws. Meritously honors these rights for all users regardless of geography.
Access
You can request a copy of all personal data Meritously holds about you.
Correction
You can update your profile data directly in the app at any time. For data held by third-party providers (e.g., Clerk), contact them directly or contact us and we'll facilitate.
Deletion
You can delete your account from the Settings page, which initiates deletion of your personal data within 30 days.
Export
You can request an export of your data in a machine-readable format (JSON or CSV). We aim to fulfill export requests within 14 days.
Opt-out of Communications
You can unsubscribe from email notifications at any time via the link in any email or in account settings.
To exercise any of these rights, email contact@meritously.com. We will respond within 30 days.
Children's Privacy
Meritously is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA).
If you are between 13 and 18, we recommend reviewing this Privacy Policy with a parent or guardian before creating an account.
If we learn that we have inadvertently collected personal information from a child under 13, we will delete that information as quickly as possible. Parents or guardians who believe their child has provided us with personal information may contact us at contact@meritously.com to request deletion.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make a substantive change (one that affects your rights or how we use your data), we will notify you by email at least 14 days before the change takes effect and update the "Last updated" date at the top of this page.
Cosmetic or clarifying changes (e.g., fixing a typo, improving wording without changing meaning) will not trigger a notification, but will still update the date. The current version of this policy is always available at meritously.com/privacy.
Continued use of Meritously after a policy change takes effect constitutes acceptance of the updated policy.
Contact
If you have questions about this Privacy Policy or your personal data, or want to exercise any of your rights, please contact us:
Privacy inquiries: contact@meritously.com
We aim to respond to all privacy-related inquiries within 5 business days.