Privacy Policy

Effective date: October 4, 2026

SHMACS ("we", "us") is a course-discovery and scheduling site for students, run by SHMACS LLC. This page explains what we collect, why, and what you can do about it.

1. What we collect

Account info. Your email address when you sign in (school tools use your school email; the college advisor uses the email you purchase with). We use it to send sign-in codes and to associate your access with you.
Chat conversations. When you use SHMACS chat while signed in, we log the conversation — with your email replaced by a hashed identifier and common patterns like email addresses and phone numbers scrubbed — to improve answers and keep the service running affordably. The scrub is a best effort, not a guarantee: don't type anything into chat you wouldn't want a staff member to read.
Uploads. If you upload a transcript or degree audit while signed in, its contents are stored with your chat so the assistant can use them. They are sensitive documents — upload only what you're comfortable with, and you can erase them any time with "Forget my uploaded data" in Settings.
Usage analytics. We collect analytics about how the site is used (pages, clicks, and session recordings that may include what you type into the site, excluding passwords) to fix problems and improve the product.
Advertising measurement. We use the Meta (Facebook/Instagram) Pixel to measure whether our ads work — for example, that a visit came from an ad. It sends Meta the page visited plus cookie identifiers Meta sets, and it also reports when you complete a few key actions: that you compared colleges, that you messaged the advisor, and that you started or completed a pass purchase, including its price. We never send it your email, form entries, or uploads. Turn it off with your browser's "Do Not Track" setting.
Payments. Handled entirely by Stripe. We never see or store your card number — we keep only your email and your pass's status.

2. Service providers

We use a small number of service providers to run SHMACS: a cloud hosting provider, our AI providers (OpenAI, Google, and TypeSafe via OpenRouter), Stripe (payments), an analytics provider, and Meta (Facebook/Instagram, for advertising measurement). Each receives only what it needs to do its job.

AI features. When you use chat or the college advisor, your messages, the conversation so far, and any transcript or degree audit you upload are sent to our AI providers to process your requests and generate replies, and a search query based on your question may be sent to OpenAI's web search. These providers may keep information derived from these requests as their terms allow. By default, OpenAI does not use data sent through its API to train its models.

3. Retention

We keep logs and uploads for as long as they're useful for running and improving the service, and we delete them on request (below).

4. Access

Access to logs is limited to SHMACS staff for debugging, safety, and product improvement. We don't sell your data.

5. Your choices & deletion

Use "Forget my uploaded data" in Settings to erase uploaded documents and chat history from your browser and our cache.
Email hello@shmacs.org from the address you signed in with to request deletion of your data. We'll act on verified requests within 30 days.

6. Minors

SHMACS is intended for users 13 and older. If you're under 18, get a parent or guardian's permission before purchasing anything.

7. Cookies

We use cookies to sign you in, remember preferences (like your last-visited school), and measure our advertising. The advertising cookies are set by the Meta Pixel (see "Advertising measurement" above); your browser's "Do Not Track" setting disables them.

8. Changes

We'll update this page when our practices change and adjust the effective date above.

9. Contact

Questions or requests: hello@shmacs.org.