What we promise.

We never share, sell, rent, or license student data. Not to advertisers, not to data brokers, not as anonymized aggregates. There is no version of our business where this changes.

Sharing with EssayLab.

Gradovate and EssayLab are both our products. They share one profile, keyed by your email address, so you don't rebuild the same academic picture twice. That shared profile holds your academic snapshot (GPA, rank, course rigor, test scores), numeric essay trait scores (0–5 per trait — never the text of your essays), and application context you enter yourself, such as activities, awards, and intended major.

EssayLab can read and write only the essay-score portion. It has no access to your grades, transcripts, or report cards. Because both products are ours, this is not a sale and not third-party sharing — but it is a real data flow between two products, so we are telling you about it.

How it works.

In the Gradovate mobile app, your school portal credentials never leave your device. Scraping runs in a sandboxed in-app browser. Your password never reaches a Gradovate server.

What we store on our servers is encrypted at rest, protected by row-level security so no account ever sees another account's data.

Session tokens are encrypted with AES-256. We don't write plaintext SIS credentials to disk.

FERPA.

Districts that adopt Gradovate sign a data processing agreement codifying these protections in writing.

Our AI provider (Anthropic) is contractually prohibited from training on our API inputs per Anthropic's Commercial Terms §B. Our database host (Supabase) operates under their standard DPA. As we add vendors we maintain those relationships under zero-retention or contractually-restricted terms.

Found something?

Responsible disclosure: email support@gradovate.com with "Security Disclosure" in the subject line.