Privacy Policy for RaiCRUITED

1. Information We Collect

We collect information you provide directly to us, including:

• Account information (name, email address, password)
• Profile information (athletic statistics, academic achievements)
• Sport-specific data (position, team, performance metrics)
• Academic information (GPA, test scores, graduation year)
• College preferences and rankings
• Chat conversations with our AI assistant
• Learning module responses and progress

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Personalize your recruiting guidance and recommendations
• Save your progress and preferences across devices
• Send you technical notices and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent transactions and other illegal activities

3. Information Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties. We may share your information in the following situations:

• With your consent or at your direction
• To comply with legal obligations
• To protect and defend our rights and property
• With service providers who assist in our operations (under strict confidentiality agreements)

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Restricted access to personal information
• Secure hosting on Supabase infrastructure

5. Third-Party Services

Our app integrates with the following third-party services:

• Supabase: Database, authentication, and file storage
• OpenAI: AI-powered chat functionality
• Railway: Application hosting and deployment
• Vercel AI SDK: Streaming chat responses
• PostHog: Product analytics (details below)
• Sentry: Crash and error monitoring (details below)

These services have their own privacy policies and we encourage you to review them.

Analytics — PostHog

We use PostHog (operated by PostHog Inc., processed on PostHog US Cloud) to understand how visitors use RaiCRUITED so we can improve the product. After you sign in, PostHog receives:

• Your RaiCRUITED account UUID — never your email, name, or any other identifier.
• The pages you visit and the buttons or links you interact with.
• Timing for the onboarding flow (which step, how long it took).

PostHog stores a first-party cookie and a small entry in your browser's local storage so we can recognize repeat visits from the same browser.

Session replay. After you sign in, PostHog also records a visual replay of your session so we can study how students use the product and improve onboarding over time. Every value you type (your name, email, school searches, swim times, and passwords) is masked in the recording and is never transmitted, and the AI chat conversation is excluded from recordings entirely. Because a replay reflects what is on your screen, information already displayed on a page you visit (such as details on your profile or dashboard) can appear in the replay. Recordings are retained for 30 days and then automatically deleted.

We do not send PostHog the values you type, your AI chat messages, your IP address, or your device identifier.

Users confirmed to be under 13 are excluded — once we determine an account belongs to a user under 13, no further analytics are recorded for that account. Logged-out (anonymous) visitors are not tracked at all.

To request deletion or export of your analytics data, contact us at privacy@raicruited.com. We will respond within 30 days.

Analytics in the mobile app

The rAIcruited iOS app uses PostHog too, but it collects less than the website does. After you sign in, PostHog receives your rAIcruited account UUID and the names of the screens you open — nothing else.

The app records no session replays, sets no cookies, and sends PostHog none of the values you type. In place of a browser cookie it keeps a small entry in the app's own on-device storage. As on the web, analytics never start at all for an account we determine belongs to a user under 13.

Crash and error monitoring — Sentry

We use Sentry (operated by Functional Software, Inc.) to record crashes and errors so we can find and fix them. A report describes the failure itself: the error and where in the app it happened, the app version, and your device model and operating system version.

After you sign in, Sentry also receives your RaiCRUITED account UUID, so we can tell how many people a given problem affects. It is never sent your email address, name, or password.

To request deletion or export of your crash data, contact us at privacy@raicruited.com. We will respond within 30 days.

6. Your Rights and Choices

You have the right to:

• Access and receive a copy of your personal information
• Correct or update your personal information
• Delete your account and associated data, or deactivate it instead (see below)
• Opt-out of certain communications
• Export your data in a portable format

7. Children's Privacy

Our service is designed for users aged 12 and older. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information.

8. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this privacy policy.

Deleting your account. Deleting is always available immediately and permanently: we scrub your profile, statistics, chat history, and Gmail connection data, then delete your account right away. On the website only, you can instead choose to schedule the deletion 15 days out — you're signed out immediately, and logging back in during that window cancels it; otherwise it completes automatically once the window closes. Either way, once deletion completes we keep only de-identified athletic and usage records that can no longer be traced back to you, plus any billing records the law requires us to retain — everything else is gone.

Deactivating your account. You can deactivate instead of deleting. Deactivating hides your public profile links immediately and signs you out, but keeps your data intact — log back in any time to reactivate, with nothing lost.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with this privacy policy.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Last updated" date.

11. Contact Us

If you have any questions about this privacy policy or our practices, please contact us at: