TransferRoute keeps your planning data on your own device unless you choose to sync it. This page explains exactly what we collect, what third-party services run on the site, and how to export or delete your data.
1. Who We Are
TransferRoute is operated by TransferRoute LLC, a California limited liability company. We are an independent planning tool for community college students in the United States. We are not affiliated with, endorsed by, or connected to any university, the University of California, the California State University, ASSIST.org, or any government agency. Questions about this policy: contact@transferroute.org.
2. Data Stored on Your Device
By default, the profile you build stays in your browser. TransferRoute stores your planning information locally using your browser's localStorage. Unless you sign in (see Section 4), the following stays on your device:
- Academic information you enter (GPA, courses, units, test scores)
- Financial information you enter (income, expenses, savings, FAFSA status, aid)
- Transfer goals, school preferences, and saved schools
- Scholarship, application, and deadline tracking
- Essay and recommendation-letter trackers (statuses, word counts, and your notes; the essay text itself is never stored)
- Background information you volunteer for scholarship matching (Section 3)
- Parsed ASSIST agreement uploads (Section 5)
- Savings transaction logs, your referral code, and the referral or campaign tag that first brought you to the site
Clearing your browser data erases the local copy, and the offline (PWA or iOS app) copy lives on the device the same way. One exception to note: if you enter an email address while building your profile, we use it to send a welcome email, described in Section 7, even if you never create an account.
3. Background Information for Scholarship Matching
The profile builder has an optional background step where you can share things like first-generation status, Pell Grant eligibility, foster youth status, single-parent status, military or veteran affiliation, disability, immigration or DACA status, gender, and ethnicity. Because this is sensitive, the rules for it are strict:
- All of it is optional. Every field can be skipped and the tools still work.
- It is used for one purpose: matching you with scholarships and aid programs whose published eligibility mentions those criteria.
- It is never sold and never used to build advertising audiences.
- It stays on your device unless you sign in. If you create an account, it syncs with the rest of your profile (Section 4) so your matches follow you across devices.
- You can remove it anytime by editing your profile or by deleting your data in Settings.
4. Optional Account and Cloud Sync
If you create an account, your planning data (profile, transfer path, saved schools, applications, savings transactions, GE progress, and the essay and recommendation trackers) is also stored in our database, hosted with Supabase, so it follows you across devices. Each account's data is isolated to that account: database row-level security ties every record to your user ID, so other users cannot read or change it.
Sign-in is passwordless: an emailed magic link through Supabase Auth, or Google sign-in (OAuth). We never store a password. If the same data is edited on two devices, the copy with the newer timestamp wins. Accounts are opt-in; without one, your planning data stays on your device. Cloud sync is currently a Premium feature. Deleting your account is covered in Sections 11 and 13.
5. Articulation Agreement Uploads
If you upload an articulation or transfer-credit agreement (an ASSIST PDF, or a saved .html agreement page from a private or out-of-state school), the file is read entirely inside your browser. The file and its parsed contents are never uploaded to us or anyone else. What the reader extracts is saved in your browser's local storage so you can reuse it, and it is excluded from cloud sync even if you sign in. A button on the dashboard removes all uploaded agreement data from the device. (The open-source PDF-reading library itself loads from a public CDN, the same way our fonts do; your file does not go there.)
6. Payments
If you subscribe to Premium ($12.99/month or $109.99/year), payment is handled entirely by Stripe through Stripe Checkout and the Stripe Billing Portal. Card numbers are entered on Stripe's pages and never reach us. Stripe notifies our server of subscription events (webhooks), and from those we store your Stripe customer and subscription identifiers, your subscription status, and the renewal date so we know what to unlock. Your browser keeps a short-lived copy of that status so Premium keeps working during brief outages. You can cancel anytime through the billing portal in Settings.
7. Email
We send transactional email through Resend, from addresses ending in @transferroute.org:
- Waitlist: joining the waitlist stores your email, first name, and any referral or campaign tag that brought you here, and sends you a confirmation. Occasional updates follow (a few emails a month at most). Reply to any of them to unsubscribe, or write to contact@transferroute.org to be removed entirely.
- Profile welcome: if you enter an email while building your profile, we send one welcome email about your plan. This happens even if you do not create an account.
- Sign-in links: magic-link emails when you sign in.
- Internal notifications: new signups also send us an internal copy of the same signup details so we can spot problems and respond.
- Deadline reminder digests (off by default): if you have a synced account and switch on Weekly Deadline Reminders (in Settings or while building your profile), we send at most one email per week listing upcoming items from your verified transfer timeline and deadlines of scholarships you saved, only when something falls in the next 30 days; if nothing is due, nothing sends. Accounts with reminders on may also receive a single one-time note summarizing how many scholarships match their profile. Every one of these emails carries a one-click unsubscribe link (it works without signing in) and a List-Unsubscribe header your mail app can use; you can also switch the toggle off in Settings at any time. We do not add our own tracking pixels to any email.
8. Analytics and Advertising Measurement
We use Google Analytics 4 to see general traffic patterns (pages visited, referral sources, approximate region, with IP anonymization turned on) and the Meta Pixel plus the Meta Conversions API to measure whether our ads on Facebook and Instagram actually lead to signups. Here is exactly what that involves:
- Events. The Meta Pixel reports page views and these milestones: joining the waitlist (Lead and CompleteRegistration), completing a profile (Lead), starting a Premium checkout (InitiateCheckout), and finishing one (Purchase, with the plan price). Google Analytics receives equivalent events.
- Advanced Matching. When you join the waitlist or complete a profile with an email address, that address (lowercased) is given to the Meta Pixel code running in your browser, which converts it to a one-way hash before sending it to Meta. Meta can match the hash against existing Meta accounts to measure ad results, but it does not receive the raw address from us.
- Conversions API. When you join the waitlist, our server also reports the signup to Meta directly, sending a hashed copy of your email along with your IP address and browser user-agent string. The browser event and the server event share an ID so Meta counts them once, not twice. We do this because browser-only measurement is often blocked, and we need to know whether ads work.
- Cookies. Meta's code sets first-party cookies (
_fbp, and_fbcafter an ad click) and Google Analytics sets its own. A cookie notice appears on your first visit, and your acknowledgment is remembered on your device (tr_cookie_consent).
The academic, financial, and background details you enter into the planning tools are not sent to Google or Meta. You can block this measurement with browser settings or a content blocker, and the site works fine with it blocked. How Meta uses what it receives is described in the Meta Privacy Policy.
9. Bot Protection, Rate Limits, and Hosting Logs
The waitlist form is protected by Cloudflare Turnstile: when you submit it, Cloudflare processes the request, including your IP address, to tell people from bots. Our server endpoints keep short-lived request counters keyed to your IP address (stored with our host, Netlify) purely to limit abuse; they expire on their own and are never linked to your profile. The site runs on Netlify, which keeps standard hosting access logs like every provider.
10. Third-Party Services
- Google Analytics 4: traffic analytics, with IP anonymization
- Meta Pixel and Conversions API: ad measurement, including hashed Advanced Matching (Section 8)
- Supabase: optional accounts and cloud sync
- Stripe: subscription payments; card data is handled entirely by Stripe
- Resend: transactional email
- Cloudflare Turnstile: bot protection on the waitlist form
- Netlify: site hosting, server functions, and rate-limit storage
- Google Fonts: typefaces loaded on each page
- Public CDNs (jsDelivr, cdnjs): deliver two open-source libraries (our database client and the PDF reader); like any web request, the CDN sees your IP address
- Outbound links: links to universities, scholarship providers, or ASSIST.org open third-party sites governed by their own policies. School logos are served from our own site.
11. Your Choices
From Settings you can download a JSON export of your profile and savings transactions, and delete everything on the device under Danger Zone (this clears every TransferRoute key from that browser).
If you created an account, deleting it from Settings removes your synced planning data, your profile, and the login itself from our database (details in Section 13). Deleting your account does not by itself cancel an active Premium subscription, so cancel in the billing portal first if you have one. Clearing your browser data also removes the local copy on that device. We do not sell your data.
12. Your Privacy Rights
California residents (CCPA/CPRA). You have the right to know the personal information we collect and how we use it, to request a copy, to correct it, and to delete it. The categories we collect are identifiers (such as the email and name you provide), commercial information (subscription status), internet and device activity (analytics), the academic, financial, and planning information you choose to enter, and, only if you volunteer it, the background information described in Section 3, which California treats as sensitive personal information and which we use solely for scholarship matching. We do not sell your personal information, and we do not share it for cross-context behavioral advertising beyond the measurement described in Section 8, which you can block. You will never be treated differently for exercising these rights. We honor these requests in good faith for all users, whether or not a statute technically obligates a company our size. To make a request, email contact@transferroute.org or use Export and Delete in Settings.
EU, UK, and EEA residents (GDPR and UK GDPR). Our legal bases are the performance of our service to you, our legitimate interests (running the planning tool, keeping it secure, and measuring whether our advertising works), and your consent where required (for example, marketing email). You have the right to access, correct, erase, restrict, port, and object to the processing of your data, and to withdraw consent at any time. To exercise any of these, email contact@transferroute.org. You may also lodge a complaint with your local data protection authority.
A note on FERPA. TransferRoute is not a school and is not covered by FERPA, the federal law governing education records held by schools. We treat the education data you give us as sensitive anyway, and handle it exactly as this policy describes.
13. Data Retention
- On your device: data in
localStoragestays until you clear your browser or use Delete in Settings. We never receive it unless you sync. - Account data (Supabase): kept while your account is active. Deleting your account removes your synced planning data, your profile, your login, and the subscription record tied to it from our live database right away; routine encrypted backups age out on their own cycle.
- Waitlist: waitlist entries are separate from accounts and are kept until you ask to be removed (reply to any email or write to contact@transferroute.org).
- Payments (Stripe): Stripe retains transaction records under its own policies and applicable tax and accounting law; those financial records cannot be erased on request. We keep only your Stripe identifiers and subscription status while your account exists.
- Email (Resend): delivery logs are kept for a limited period for deliverability and abuse prevention.
- Analytics (Google Analytics 4): retained in pseudonymous, aggregated form per our GA4 retention setting (currently 14 months).
14. Children's Privacy
TransferRoute is for users 13 and older. We do not knowingly collect personal information from children under 13, and if we learn we have, we will delete it; email contact@transferroute.org to report it. Most of our users are 16 to 24. If you are under 18, use TransferRoute with the involvement and consent of a parent or guardian, and review this policy with them.
15. The iOS App
The TransferRoute iOS app is the same product in an app wrapper, and this policy governs it the same way. The app adds no data collection of its own: no push notifications, no location, no contacts, and no tracking beyond what this policy already describes for the website. Your planning data lives on the device unless you sign in, exactly as above.
16. Changes to This Policy
We update this policy when our data practices change. The "Last updated" date above reflects the most recent revision. If you keep using TransferRoute after an update, the revised policy applies.