Privacy

Last updated November 1, 2026

This is our privacy policy in plain English. If anything here is unclear, or you want to ask what we hold about you, email hello@loreeducation.com.

Who we are

Lore is a college counselor for all four years of high school, in early preview. Right now the site has a free college price check for parents (Check 3 Schools), pages on what colleges cost with their sources, planning guides, a few free tools, a deadline tracker, a way for a student to send a parent a cost report, Shifts (short job stories for teens), and free family accounts that keep each student’s college-planning record. Lore also sells counselor plans and a Merit Money Report, on our terms, which say when each goes on sale; what paying for them shares and keeps is below. Lore also runs a back office for independent college counselors’ practices (the IEC Copilot); what that means for their clients’ data is below. Lore is run by its founder, as an early-stage project that is not incorporated yet. You can reach us at hello@loreeducation.com.

The price check

• The GPA, test score (or “no test”), state and colleges you enter, and whether the student is a U.S. citizen or permanent resident if you answer, are sent to our server to work out your results. We don’t save them on our servers unless you ask us to email you the lookup, and you don’t need an account.
• Your answers and colleges ride in the page’s address, so Back and a refresh keep your results. So your browser’s history keeps them, anyone you share the address with sees them, and our host’s short-lived request logs see it when the page loads. “Send this to a parent” passes on only the colleges and the state.
• Each check records one usage event: which colleges you picked, your state, and your GPA and test score as rough bands — never the exact numbers. We also count clicks the same way, like when you open a college’s own page.
• To tell visits apart without accounts, your browser keeps a random device ID, stored in this site’s local storage under the name lore_sid. It isn’t your name or email. It only lets us see that two events came from the same browser. A new one starts whenever someone signs in to Lore or out of it on that browser, so on a shared computer one person’s visits aren’t counted as another’s.
• On your first visit, your browser also keeps a cookie named lore_ft for 180 days. It remembers how you first found Lore: the campaign or partner tag in the link you followed (like utm_source), the name of the website that sent you (not the page), the first page you opened here, and when. That’s how we tell which partners and posts bring families to Lore. It rides along on the usage events from that browser, Shifts included, along with which page of ours the event came from, and it’s never changed after that first visit.

Email

We only get your email address if you type it in: to sign in to an account (next section), to save a price-check lookup, to hear when NMSC publishes its official National Merit numbers (the PSAT Score Decoder), or with a report of a wrong number. For saving and signing up, we only ask when we can actually store it and send you the link. We send it only what the words beside the box say, and we never sell it or share it for marketing. Our analytics record that an address was given, not the address itself. We keep it with how you first found Lore (the lore_ft details above), and in our own database the later usage events from the browser you gave it in are linked to it, so we can see whether families come back. That browser’s lore_vid cookie (below) is linked to it too, and so is the one in a browser you confirm the save in or open its re-run link from, so we can note the days each comes back to Lore: the first and last visit time each day, never what you looked at. Shifts events are never linked to that address, and PostHog never receives the address or either link. (Signing in is different: see usage events under accounts, next.)

Saving a lookup

• When you ask us to email you a lookup, we keep the address, your answers and colleges, the words shown beside the box (your consent), and when, and send that address one link that works for 72 hours. The lookup isn’t saved, and nothing else is sent to that address, until the button on that link’s page is used (an email scanner that opens links saves nothing). Unused, the request is deleted within 5 days, with the address unless something else keeps it (an account’s login, say).
• Once you confirm, we email you a link to re-run the lookup and, now and then, a college-planning guide. The link carries your answers encrypted, so the email shows no GPA or score, and we keep no other copy of them; our copy of that email is deleted 30 days after it’s sent. Opening it counts as a return visit, linked to your address in our own database.
• Every one of these emails has a one-click unsubscribe. We keep a note that the address left, so we never add it back unless you confirm a new save; to delete the address too, email us.

National Merit official numbers

• When you ask the PSAT Score Decoder to email you NMSC’s official numbers, we keep the address, the words shown beside the box (your consent), and when, and send it one link that works for 72 hours. Your scores are never sent to us: the decoder works them out in your browser. Nothing is sent to that address until the button on that link’s page is used, and an unused request is deleted within 5 days, with the address unless something else keeps it.
• Once you confirm, we email you when NMSC publishes its official National Merit numbers for your student’s year, with a link to NMSC’s own page, and now and then a junior-year planning note. Each has a one-click unsubscribe, kept the same way as above.
• The decoder can also link to a parent group on Facebook or WhatsApp. That group is run on that service, under its own privacy policy; following the link tells us only that it was clicked, never who you are there.

The emails an account gets

The emails an account gets are the ones it needs, and these are all of them:

• When someone asks: sign-in links, a student’s invitation to their own login, a guardian’s confirmation link, a student’s request to a parent and deletion certificates are each sent only when someone asks for one (a sign-in, an invitation, a deletion), to the people it’s for.
• Once your family buys something: its receipt, the email saying a report is ready (or that one we said we’d email you about can’t be finished), a refund’s confirmation (the appeal guarantee’s refund included), and, before a Multi-Year Plan’s year ends, one email asking whether you’d like another year and at most one reminder: these go to every parent on the account, one message each, except a report’s link sent again on request, which goes only to the parent who asked.
• With a counselor plan: deadline reminders, the parents’ Sunday-evening digest, and a student’s monthly experiment email, to their own login. Each says what’s due or what’s suggested, never a draft, an essay or a reflection, and each has its own way off (see accounts, below).
• Counselor reviews: when a parent asks for a review that reads the student’s work, the student’s own login is told first: who asked, which review, and what the counselor may read. When a review is ready, or its call moves to a new time, the parents and the student’s own login each get a short note saying so (with the new time, for a call), never the review itself. Lore’s counselor for the student, or Lore’s admins while no counselor is assigned, is emailed the student’s first name, class year and which review was asked for; when its deadline is near or missed, the counselor and Lore’s admins are each emailed again.
• If your counselor runs their practice on Lore: the practice’s emails are listed under counselor practices, below.

Nothing else is sent from an account. Lore’s own team also gets email: an alert when something on the site needs a person, and a weekly report of counts. Neither carries a family’s name or email address.

Sending a report to a parent

• A student, no account needed, picks up to 8 colleges (signed in, their account’s list comes pre-picked), and enters their state, a GPA (exact, a range or none), any test scores they want to share, a first name and a short note if they like, and a parent’s email address.
• We keep the report exactly as they preview it, so the parent gets what they saw. A preview can be sent for a day and is deleted a day after that. A sent report’s link works for a year; then the report, name and note included, is deleted. We count its opens, and the student is never told whether it was opened or the address has stopped these emails.
• The email’s words never change: nothing the student typed is in it, and the name and note show only on the report page. Resend (below) receives the address and the email. We keep only a scrambled form of the address and of the inbox it reaches (hashed with a secret key): enough to honor a parent who stops these emails, a stop with no end date that holds for every spelling of their inbox (name+tag@… and, at Gmail, dotted forms), and to delete the reports sent to a family’s addresses when it deletes its Lore account.
• Opening the report sets two cookies, lore_origin and lore_handoff (below), so we can count the families a student’s report brings.
• We count previews and sends per IP address and per parent’s inbox, both scrambled, for up to 7 days, and record usage events that hold only counts, yes-or-no facts and where the student started — never the note, a name, an address, a GPA or a college. They’re marked as a student’s, so they never join an address saved from the price check.

Free tools, the tracker, college pages and guides

• A free tool (College-View GPA, Test Score Planner, PSAT Score Decoder, Scholarship Scam Checker, Is This Summer Program Worth It?) saves what you type in your browser as you type, under lore_tool:<tool>, until its Clear button deletes it. Lore’s servers never receive it. We record which tool was used, a result copied, shared, printed or downloaded, a source clicked, and where you went next — never what you typed.
• On the PSAT Score Decoder we also count each step of a visit: that the page was opened, that a score was typed (never the score), that a result was shown, that the email sign-up was sent, and that the parent group link was clicked. Each count carries only where that browser tab came from: the name of the website that sent you (not the page), the campaign tag in the link, and the first page you opened. It’s kept in no cookie or storage, carries no device ID, is never linked to an email address or an earlier visit, stays in our own database, and is deleted on our usual schedule.
• Signed out, the deadline tracker’s list (college ID numbers only) lives in the page’s address and your browser (lore_tracker); signed in, it shows your account’s college list. Its calendar file is made when you ask, and we keep no copy. We record how many colleges are listed and that a calendar was downloaded, never which colleges.
• Reading a college page or a guide records which page it was, like any usage event.

Reporting a wrong number

• The “Report a problem” form keeps what you tell us about a figure (which part, what the college’s page shows, a link, a note), filed under your account and its address if you’re signed in. Otherwise an email address is optional unless you claim the $100 bounty; we use it only to confirm we got your report, tell you what we found and pay you, and a claim keeps your name if you give it and whether we may thank you by first name.
• Ask us, and we remove your address, name, account link and note from the report and its claim; deleting a Lore account does the same for every report made with it or its address. The report about the figure stays.

Accounts

• Signing in: there’s no password. You type your email address and we email you a link that works once, for 15 minutes. We keep your address as your login, your name if you give it, whether you said you’re a parent or guardian or a student, and when you last signed in. We never store the link itself, only a scrambled (hashed) form of it.
• Staying signed in: a cookie keeps you signed in on that browser (see cookies). It stops working after 14 days without use, and after 30 days at most; Lore staff sign-ins end after two hours without use and last 12 hours at most. Signing out ends it. “Sign out everywhere” ends every sign-in you have and cancels every sign-in link we’ve sent you that hasn’t been used.
• Setting up a family: a parent or guardian adds each student with a first name, the year they graduate and, if they like, their state. For each student, the parent ticks a box saying they are that student’s parent or legal guardian, and we email a confirmation link to the inbox they signed in with. The student’s account opens only when that link is used (it works for 7 days). The box agrees to Shifts, our job simulations, too, except at the report’s checkout, whether a student is added there or confirmed again: that box covers the record only, and Shifts stay off for that student until a parent says yes to them from their Lore page, with the same box, link and record as any other consent. We keep a record of that consent: the exact words agreed to, when, and a scrambled form of the inbox that confirmed it — never a second copy of the address. If no one confirms, we delete what was entered within 30 days.
• The student’s record: what the family enters — GPA and test scores, state, intended majors, the college list, courses, and activities. Each saved version of an activity is also kept in an append-only history: Lore’s database refuses any change to an entry in it, from anyone using Lore, our staff included, and it goes only when the record is deleted. A student can download their whole record (the four-year record, with its hash chain) from their account. A parent can download the family’s copy: when each entry was saved and what kind it was, never what it says, and no fingerprint of it.
• PSAT results: a PSAT result the student or a parent enters (which PSAT, the year it was taken, and its two section scores) is kept with the student’s record, where the family can see it, and is deleted with it.
• Your family’s time zone: we store your family’s time zone (for example America/Chicago), never a location. We take it once from a family member’s browser if you haven’t chosen one (not when the browser hides its zone and reports UTC), or you choose it yourself, and your choice replaces it. Until we have one, we use U.S. Eastern time. We use it only to date deadlines, reminders and the Sunday digest on your own calendar, and it is deleted with your family’s account.
• Deadline reminders and the Sunday digest: with a counselor plan, Lore emails deadline reminders two weeks, one week, three days and one day before each dated item on the roadmap. They go to the student, or to the parents while the student has no login of their own, and from three days out to the parents too. Parents also get a Sunday-evening digest. These emails carry deadlines, money dates and progress status only, never drafts, essays or exploration notes. Every one has a link that turns it off without signing in, and a page where each can be switched on or off; we keep that choice with your account, and it is deleted with it.
• The monthly experiment email: in a month a counselor plan covers, a student with a login of their own, once a parent or guardian has confirmed it, gets one email naming that month’s one suggested experiment: what it is, about how long it takes, what it costs if anything, what it can tell them, and why it was picked (the names of the courses or activities on their record it came from, or that it is a first step). It goes to the student’s own login only, never to a parent. It has its own link that turns it off without signing in, and its own switch on the same page; we keep that choice with the student’s login, and it is deleted with it. We note which month’s email went out, and that note is deleted with the student’s record.
• AI write-ups a student asks for: with a counselor plan, and only when the student asks from their own login, our AI model provider, Anthropic, writes two things from the student’s own record. The plain-words readout of their exploration map receives the map’s evidence: the names of the courses and activities it counts, the interests and majors the student listed, the titles of the experiments they ran with their two quick answers about each (how it left them, whether they want more), and the directions, majors and careers the map shows; never anything they wrote in a reflection. The summary of what their record says receives their activities with what they wrote about them, their courses, the experiments they finished, and the reflections and notes in their record; never an essay draft or an application answer. It leaves out any entry the check described under parents and teens flags, and tells the student how many it left out. We never send either one the student’s name, GPA, test scores or college list. Anthropic may keep what it receives for as long as its terms permit (see who we share data with), and those terms bar it from training models on it. What it writes is the student’s, like the rest of their exploration: a parent never sees it. It is kept with the student’s record and deleted with it.
• A student’s own login: once the parent has confirmed, they can invite the student (13 or older) to a login of their own, at an inbox only the student reads. Lore refuses a parent’s own address, or a variation of it that lands in the same inbox (like name+teen@…); it can’t see where any other address forwards. A student with no family can ask a parent instead: they type the parent’s address and we send it one email. We keep that address only with its link, which works for 7 days.
• Usage events: account actions are counted like the rest of the site: that something happened (a sign-in, a saved course), never what it says, and never an email address or a name. Signing in starts a new device ID in that browser, and the usage events from it while you’re signed in count as your account’s, under an account number, in our database and in PostHog. That browser’s earlier events join your account only if you’re Lore staff, or a parent or guardian who has signed in before, and only if no Shifts were played under that device ID. When a student signs in, the browser’s earlier events are never joined to anyone, and Shifts played while no one was signed in are never joined to anyone’s account. Signing out starts a new device ID again, so whoever uses the browser next isn’t counted as you. A parent’s sign-in also links that browser’s lore_vid cookie to their login, so we can note the days it comes back to Lore (never what was looked at); a student’s sign-in, signing out everywhere, or deleting the family’s account starts that cookie over, linked to nothing.

Paying for a plan or a report

• A parent pays on Stripe’s own checkout page. The card or bank details you type there go to Stripe, never to Lore. Stripe then tells us whether the payment went through, and, for a bank payment, when it clears. Its messages to us also carry what else you typed on its page, such as the name and billing address you gave there: we don’t keep any of that, only the payment’s outcome and Stripe’s reference numbers (below). Stripe’s page runs Stripe’s own fraud checks, which look at details of your device and browser, under Stripe’s privacy policy (below).
• To open that page, Lore sends Stripe the email address you sign in with (to fill in its form), what you’re buying, its price and a line about its term or its refund — never your student’s name — and a note on the payment: our order number, your account’s number, your browser’s device ID, whether your family first came to Lore through a student’s report, and the partner or campaign tags from the link you first followed to Lore (from the lore_ft cookie: never the page you landed on or the site that sent you). The tags are how we pay the partners who send families to Lore.
• We keep a record of each order: what was bought and for which student, the price, any credit used, how your family first came to Lore, when it was paid, and Stripe’s reference numbers for the payment — never card or bank details. With it we keep each refund (how much, why, and which parent asked), whether a payment was disputed with a bank, the report’s credit toward a plan, a plan’s dates, its renewal email and a parent’s answer, a plan moved to a sibling, and, for the appeal guarantee, how much appealable aid our analysis found.
• Usage events count visits to the plans page and checkout, purchases, refunds, renewals and disputes, with the product, the amount and the days since buying — never a name, an email address or a student’s numbers. A purchase is counted under your account’s number and the device ID you bought from, so we can see which visits led to it.
• So a script can’t start thousands of checkouts, we count the checkouts started from each account and each network, both scrambled, for an hour.

The Merit Money Report

• A report is made from the student’s record once it’s paid for: their first name, graduating class, state, GPA and any test scores, and their college list, with the colleges we add to round the list out, each college’s published figures and our estimates. We keep it until the student’s record is deleted. When a college changes one of its figures, the report is updated to match (and held for a person to check if it still doesn’t), and a parent can rebuild it with the student’s current numbers. A refund never takes it away.
• The student’s parents and the student can open it, and so can a counselor assigned to the student (once there is one) and Lore’s admins. It holds numbers and colleges, never anything the student wrote.
• Its strategy memo starts as our own template. When an AI model writes it instead, Anthropic receives the report’s college names, where each one falls (likely, target or reach), whether your family picked it or we added it, the application round planned, and, where it changes the price, whether your student pays the in-state or out-of-state price there (which can show the state you live in). Every price, scholarship, amount and date goes to it as a reference code it can only copy, never as a name or a number, and it never receives your student’s name, GPA or test scores. Every number in the memo comes from our own calculations, not from the model. The memo it writes is kept as part of the report; our record of the request itself holds only its size and cost, against the family’s account.
• Usage events count that a report was made, emailed and opened (on the web or as a PDF), and how long after buying — never the numbers in it.

Shifts

• What you type in a Shift is sent to Anthropic, our AI model provider, so the story can write its replies and the safety screen (below) can check it.
• Lore keeps no copy of the conversation on its servers. Your browser keeps one, so you can pick a run back up later; restarting a Shift wipes it, and so does clearing this site’s data in your browser settings. A run you play while signed in to your own Lore account is saved in that browser with your account’s number, and is forgotten once the browser isn’t signed in to your account. Signing out of Lore with “Sign out” or “Sign out everywhere” also wipes every Shift run that browser keeps.
• Signed in to your own Lore account as a student, once a parent or guardian has said yes to Shifts: a Shift you finish, or tap out of, is noted on your exploration map (which Shift, the short or the whole version, and when) so you can reflect on it, never what you or the story wrote. To check that the run really ended, your browser sends Lore the run’s random id (kept with the note, so a run is noted only once) and only its outline (which parts of the story came in what order, and when you left or came back), and Lore keeps none of the outline. While you play signed in, your browser also sends that id with each turn, and the turn that ends the run comes back with a code saying it really ended, made from your account, the Shift, the version and the id, never from what was written. Your browser keeps the code with the run and sends it with the outline; a run is noted only with that code, and Lore keeps no copy of it. A run that showed a help card is never sent or noted, and nothing records that it was skipped.
• Anthropic may keep what it receives for as long as its terms permit — its Commercial Terms and Data Processing Addendum — which bar it from training models on it. Those terms let Anthropic keep content longer when that’s needed to combat harmful use of its service, so we can’t promise how long it keeps any one message, and we can’t delete Anthropic’s copy early.
• We record usage events — which Shift, how many turns, whether you finished, stopped, or went quiet — tied to your random device ID (or, once you’ve signed in, your account number; see accounts, above). They never include your words, or whether a help card was shown.
• To stop abuse and runaway costs, we count requests and estimated AI costs per device ID (for a signed-in student, per account, under a scrambled form of its number) and per IP address. The IP address is scrambled one way (hashed) before it’s counted, and Lore never stores raw IP addresses. These counters expire on their own within two days.
• What you type is also checked for signs that you, or someone you know, may be in danger: first by a simple word check on Lore’s server, then — if that doesn’t catch it — by an AI safety screen run by the same provider, Anthropic. Nothing about what the screen decides is stored, except the daily totals described next. If the screen is ever down, the story goes on, and Lore adds one to a daily count of outages kept the same way — the date and what went wrong, with no words and no device ID.
• If something you write sounds like you might not be safe, Shifts steps out of the story and shows real places to get help. When that happens, Lore adds one to a daily total on its server: the date, which card was shown (a check-in or the crisis card), what spotted it, and the kind of concern. The totals hold no device ID, no IP address, no time of day, and never your words. Only the founder reads them, through a private code, and that code shows only whole days that are already over — never a running count for today. We use them to see how often the cards show up, never to work out who saw one, and they’re deleted after about 40 days. One honest limit: on a very quiet day, when only a few people used Shifts, even a small total could hint at who it was.
• Signed out, the first time you open Shifts on a device, it asks for your birth month and year and whether a parent or guardian knows you’re trying it. Only the yes-or-no result is kept, in that browser. We never store your birthday. It’s a check you answer yourself, on each device — not a verified ID check.
• Signed in to your own Lore account as a student, Shifts skips that question: your parent or guardian’s confirmed consent to Shifts (see accounts, above) stands in for it, checked on every turn, and Shifts closes if they take it back. No invite code is needed.
• The invite code you entered is kept in your browser too, so you don’t have to type it again.
• The parents’ demo on the plans page is a short Shift for adults that needs no account, invite code or age question (a student signed in to their own account is sent to their own Shifts instead). What you type there goes to Anthropic the same way, for the story and the safety checks above. Lore’s servers keep none of the words, and the page holds the conversation only while it’s open. So a demo can’t run past its 6 turns, our usage counters keep a scrambled fingerprint of each demo run for six hours (a code made from the words, never the words) and count the demo’s AI spend for the day, per scrambled IP address. Its usage events count that a demo started, each turn and why it stopped, never what you typed; they’re marked as a parent’s, apart from students’ Shifts.

Parents and teens

• Lore is for parents and for students 13 and older. Without an account, Shifts asks your age first and doesn’t continue on that device for anyone who says they’re under 13 — it’s self-declared, not verified. Signed in as a student, Shifts opens only on a parent or guardian’s confirmed consent to Shifts, and closes again if they withdraw it. An account asks a student for their birth month and year once; if that’s under 13, we delete the account that sign-in just made, with anything saved under its address, and we never store the birthday. We don’t knowingly collect personal information from children under 13. If you think we have, email us and we’ll delete it.
• A student under 18 gets a record in Lore only through a parent or guardian, who confirms from their own inbox (see accounts). A student can sign in before that, but only to ask a parent: that login holds just its address, that they said they’re a student, and when they signed in. A parent can take that consent back at any time: the student’s own login closes right away, and the record stays with the family until a parent deletes it or the schedule below does.
• Lore’s rule for the whole product: parents see deadlines, money, and progress; what a student writes stays the student’s own. In an account, a parent sees and can change the student’s GPA, test scores, state, college list and courses, reads the majors the student lists as ones they’re considering (they shape the money side), and sees how many activities there are and the hours they add up to. Activity descriptions — and the drafts and reflections later parts of Lore will keep — are the student’s: no Lore screen shows them to a parent, and of Lore’s own staff only the student’s counselor sees them, during a review, as the next point says. We don’t show a teen’s Shifts writing to their parents, or to anyone else — Shifts isn’t connected to any parent view at all.
• Our promise, in the words we show families:

  Parents see deadlines, money, and progress. Essays, drafts, and exploration stay the student’s own — never shown to parents. A counselor you’ve booked can read what you share for that checkpoint, only until it’s delivered. That’s what makes the honesty real.

  The student’s Lore counselor reads their work only during a review the student or a parent asks for: the annual plan review (reflections, experiment write-ups, projects and activity descriptions) or the pre-submission review (essay drafts, short answers, activity descriptions and essay coach feedback), and only those kinds of work. When a parent asks, the student is told before any of it opens. It opens only while that counselor has the review and before the review’s 48-hour deadline, for at most 96 hours at a time (renewable once), and it closes when the review is delivered, withdrawn or cancelled, or when the deadline passes; after that, only Lore’s team can reopen it. Every time the counselor opens the student’s work, it goes on a list that only the student sees, never a parent.
• If what a student writes sounds like they might not be safe: the simple word check Shifts uses, reading the student’s words as their own rather than as a story, runs on Lore’s server, with no AI, on a question a student asks the essay coach and the saved draft it would read, and on their reflections and quarterly check-ins when they’re saved. When it finds something, the student sees real places to get help. A question that sounds serious isn’t sent to the coach at all; a softer one, or anything in the draft, gets a check-in the student can answer to carry on. A reflection or check-in is still saved as they wrote it, and an answer to “Anything new you’re curious about?” that the check flags isn’t added to their interests. No one is told a card was shown: not a parent, not their counselor, and no usage event says so. Lore adds one to a daily total on its server: the date, where the card was shown (the essay coach, or reflections and check-ins), which card it was, and the kind of concern; never the student, the essay, or the words. Only Lore’s admins read these totals, for whole days that are already over, and they’re deleted after about 40 days. One honest limit: our usage events note when a student saves a reflection or a check-in or gets feedback from the coach (never what it says), so on days when very few students did, a total could hint at who it was.
• A student’s report to a parent holds only what they chose to put in it, and they see exactly that before it goes. It isn’t connected to their record or to any account.
• The law can still require us to hand over data — a court order, for example. If that ever reaches what a student wrote, we’ll tell the student, unless the law forbids it.
• A parent or guardian can ask us to delete anything we hold about their student.

If your counselor runs their practice on Lore

Some independent college counselors use Lore’s IEC Copilot as their practice’s back office. When a counselor adds you or your student as a client, the practice decides what goes into its workspace and what it’s for, and Lore holds it for the practice, as its service provider, only to run the workspace. A data processing agreement the practice accepts before it adds its first client says so in writing, and records which version was accepted, by whom and when.

• The promise: Your client data is never used to train models, never shown to other customers, never used in our consumer product. Never sold, to anyone.
• What the workspace holds: each client’s first name, graduating class and school, the record the client and the practice keep, essays with their saved drafts and drafting record, the practice’s rubrics, reviews and private notes, and the feedback it releases; each parent’s name and email address, whether they confirmed, and whether they stopped the weekly update; and the staff’s sign-in addresses and roles.
• Who sees what: the practice’s staff see their own practice’s clients, and no other practice’s. A client sees their own record and the feedback the practice releases, never the practice’s notes. Parents get a weekly update in the practice’s name with deadlines, the list and where each essay stands, never the essays, drafts or exploration themselves. A practice’s staff can build their client’s college list once a parent has confirmed. Each row is held to its practice in the database itself, and nothing in a workspace reaches Lore’s family product.
• A client’s own sign-in opens only after a parent confirms, from their own inbox, that they’re the parent and agree.
• The emails a workspace sends: invitations to the practice’s staff; to a client’s parent, a request to confirm, its confirmation link, and then the weekly update in the practice’s name; a client’s invitation to their own sign-in; and, to the practice’s administrators, a reminder before the free trial ends, a note when a payment fails, and the certificate of deletion. A counselor who signs up for the essay prompt database gets a sign-in link. The weekly update carries deadlines, the list and where each essay stands, never the essays themselves.
• The AI’s first pass: Anthropic receives a draft, its essay prompt and the practice’s rubric, and suggests feedback for the counselor to edit. It never writes or rewrites a client’s sentences, and nothing reaches the client until the practice releases it.
• The only things that leave a workspace: corrections to college facts (a deadline, an essay prompt, a scholarship figure), which go into Lore’s college data and say nothing about a person; and de-identified statistics for groups of at least 20 people, only if a practice opts in, which no practice can do today.
• Asking about your data: to see, fix or delete what a practice holds about you or your student, ask the practice. If you write to us instead (hello@loreeducation.com), we tell the practice and help it answer.
• Export and deletion: the practice can export its clients’ files in every plan state. When it cancels, or its free trial ends unpaid, we delete the whole workspace within 30 days and email its administrator a certificate of deletion. A failed payment deletes nothing. A parent’s own Lore sign-in, if they have one, stays theirs.
• The essay prompt database for counselors: signing up keeps your sign-in address, the practice name you give (if you give one), which version of the sign-up line you affirmed with a fingerprint of its exact words, and when you last opened the database (noted at most once an hour). It stays until your sign-in is deleted, which you can ask for at hello@loreeducation.com. It is never a lead or a mailing list, and Lore’s family product never uses it.

Cookies and browser storage

Lore sets only its own cookies, none for advertising, and none from anyone else. This is everything our code keeps in your browser, by name. Clearing this site’s data in your browser settings removes all of it, and signs you out.

Some browsers also clear a site’s local storage on their own: Safari, and the browsers built into apps on an iPhone or iPad, delete it after seven days of use without a visit to the site. That takes a free tool’s saved answers, the tracker’s list, Shifts runs and the device ID with it. They also keep a cookie the page itself sets (lore_student) seven days at most.

Cookies

• __Host-lore_session: Keeps you signed in: a random code. Scripts on the page can’t read it, and our database keeps only a scrambled (hashed) form of it. Up to 30 days (Lore staff: 12 hours). It stops working after 14 days without use (staff: two hours), and signing out deletes it.
• lore_signed_in: Says only that this browser is signed in (the value 1), never who. It opens nothing. Up to 30 days (Lore staff: 12 hours), even after a sign-in has ended for lack of use; signing out deletes it.
• lore_demo: Only when you try Lore with the sample family (/demo): says this browser is using the made-up family (the value 1), so nothing it does is emailed or counted in our statistics. Kept 7 days.
• lore_demo_family: Only when you try Lore with the sample family (/demo): the sign-in codes of that made-up family’s parent and students, so you can switch between their views. Scripts on the page can’t read it. Kept 7 days.
• lore_student: In a family’s account, which student you last looked at (a record number, not a name), so the next page opens on them. Kept 180 days; signing out deletes it.
• __Host-lore_signed_out: Says only that this browser just signed out (the value 1), never who. The next Lore page it opens then wipes what signing out wipes (Shift runs, unsaved essay writing, award letter typing in that tab) and starts a new device ID, even when Sign out was pressed before the page had finished loading. With JavaScript turned off, no page can touch your browser’s storage: that happens on the first Lore page this browser opens with JavaScript on, before anything there reads it. Until that page deletes it, a year at most.
• lore_ft: How you first found Lore (see the price check, above). Kept 180 days.
• lore_origin: Set when you open a report a student sent you: it says this browser came to Lore through a student’s report (the value “teen”), so we can count how many families a student’s report brings. Scripts on the page can’t read it. Kept 180 days.
• lore_handoff: Set with the one above: which report brought you (a report number, not a name). Scripts on the page can’t read it. Kept 180 days.
• lore_vid: A random ID for this browser, not your name or address. Scripts on the page can’t read it. Until you save an address with us or a parent signs in on this browser, we write nothing down about it; after that we note the days this browser comes back to Lore (the first and last visit time that day, never what you looked at), to count the families who return. Our database keeps only a scrambled (hashed) form of the ID. A student signing in on this browser, signing out everywhere, or deleting your family’s account starts a new one, and so does a parent signing in here while it is linked to another parent’s login. Kept 395 days.
• lore_vl: Says only that this browser is linked to a saved address or a parent’s login (the value 1), so we know to note the days it comes back. Kept 395 days; a student’s sign-in, signing out everywhere, or deleting your family’s account deletes it.
• lore_vs: Says this browser’s visit was just noted (the value 1), so we note at most one visit each half hour. 30 minutes.

In your browser’s local storage

• lore_sid: Your random device ID (see the price check, above). It rides along with usage events. Until someone signs in or out on this browser (a new one starts), or you clear this site’s data.
• lore_sid_state: Two facts about that device ID, so a sign-in never joins the wrong events to an account: whether it was started at a sign-in, and whether it has played Shifts. As long as that device ID.
• lore_tracker: The colleges on the deadline tracker’s list, when you use it without signing in (their ID numbers, nothing else), so coming back to the tracker brings the list back. It never leaves this browser except in the page’s own address. Until you empty the list or clear this site’s data.
• lore_tool:<tool>: One per free tool you use: what you typed into it (see the free tools, above). Lore’s servers never receive it. Until you press Clear on that tool or clear this site’s data.
• lore_essay_draft:<essay>: One per essay you write in Lore: the writing that hasn’t reached your drafting record yet, so a lost connection or a closed tab doesn’t lose it. Until that writing is saved to your drafting record, you sign out of Lore, or you clear this site’s data.
• lore_invite: The Shifts invite code you entered, so you don’t have to type it again. Until you clear this site’s data.
• lore_consent_v1: That this device passed Shifts’ age and parent check: only the yes, never your birthday. Until you clear this site’s data.
• lore_age_block: That someone on this device said they were under 13, so Shifts stays closed here. Until you clear this site’s data.
• lore_s_run:<shift>: One per Shift played signed out: its conversation (what you typed and the story’s replies), so you can pick it back up. Restarting the Shift wipes it. Until you restart the Shift, sign out of Lore, or clear this site’s data.
• lore_s_run@<account>/<shift>: The same for a Shift played signed in, filed under your account’s number: only that account is ever shown it, and a random id for the run, the code Lore sent back when it ended, and whether it is already on your map. Until you restart the Shift, sign out of Lore, or clear this site’s data; it also goes once this browser isn’t signed in to that account.
• lore_s_done:<shift>: One per Shift played signed out: that it was finished, so the list of Shifts can show it. Until you sign out of Lore or clear this site’s data.
• lore_s_done@<account>/<shift>: The same for a Shift finished signed in, filed under your account’s number. Until you sign out of Lore or clear this site’s data; it also goes once this browser isn’t signed in to that account.

In this tab’s session storage

• lore_appeal:<account>:<student>:<form>: On the award letters page, what you’ve typed into an offer or an appeal letter that hasn’t reached Lore yet, so a reload, a restored tab or the Back button doesn’t lose it. Until Lore has it (an offer or a reworded letter when you save it; a letter’s answers as you type them, when the connection allows), you close the tab, or you sign out of Lore.
• lore_nmsc_ask_parent: That someone in this tab said they were under 13, so the PSAT decoder’s email sign-up stays closed in it. Until you close the tab.

Who we share data with

A few companies run parts of the site for us. They handle data only to do that job, under their own privacy policies. We don’t sell data to anyone.

• Vercel hosts the site. Like any web host, it keeps short-lived request logs, which can include your IP address and the address of the page you loaded (for a price check, the answers in it). Vercel’s privacy policy
• Anthropic provides the AI model that writes the replies in Shifts and the parents’ demo, the AI safety screen that checks what you type, the essay coach’s questions and the check that reads each reply before a student sees it, the plain-words readout of a student’s exploration map and the summary of what a student’s record says, each only when the student asks, the AI draft of a report’s strategy memo when one is used, and, in a counselor practice’s workspace, the first pass of feedback on a client’s draft. It receives what you type in a Shift; for the essay coach, the saved draft a student asks about, its essay prompt, the student’s question and the coach’s reply; for the readout and the summary, the parts of the student’s record named under accounts below (never their name, GPA, test scores or college list); and a report’s college names with where each sits on the list, including whether your student pays the in-state or out-of-state price there (never your student’s name, GPA or test scores; prices and scholarships only as reference codes); and, for a practice’s first pass, the client’s draft, its essay prompt and the practice’s rubric, and may keep it for as long as its terms permit; those terms bar it from training models on it. Anthropic’s Commercial Terms
• PostHog product analytics. It receives the usage events described above, tied to a random device ID, or to an account number once you sign in — never your words, your name, your email, or exact scores. PostHog’s privacy policy
• Neon our database. It stores accounts and each student’s record (described above), the consent records behind them, each family’s payment records and Merit Money Reports (never card or bank details), deletion certificates, each counselor practice’s workspace (described under counselor practices, above), email addresses people choose to give us with how each person first found Lore and the words they agreed to, the days a browser linked to a saved address or a parent’s login came back, the reports students send to parents (with a scrambled form of the parent’s address, never the address), reports of wrong numbers, and a copy of the usage events described above. Neon’s privacy policy
• Upstash usage counters, once turned on. It holds short-lived request and cost counts keyed by device ID (or a scrambled account number, for a signed-in student) and scrambled (hashed) IP address, counts of the sign-in emails sent to each address and from each account (both scrambled the same way), counts of the emails sent to each address to save a lookup and of the reports students send to each parent’s inbox (scrambled the same way), counts of the checkouts started from each account and each network (scrambled the same way), the parents’ demo Shift’s AI spend for the day, in total and per scrambled IP address, a scrambled fingerprint of each demo run for six hours, and the daily help-card and safety-screen outage totals, which hold no device ID or IP address. Upstash’s privacy policy
• Resend sends our email: sign-in links, invitations, a student’s request to a parent to set up Lore, guardian confirmations, deletion certificates, receipts, report and refund emails, a plan’s renewal emails, deadline reminders, the Sunday digest, the monthly experiment email, the counselor-review emails (a student’s notice that a review was asked for, the notes that a review is ready or its call moved, and the counselor’s own notices), the links to save and re-run a lookup, college-planning guides, a student’s report to a parent, replies about a wrong number you reported, Lore’s own team’s alerts and weekly report, and, for a counselor practice, its staff invitations, the parents’ confirmation requests and weekly updates, its clients’ invitations, its administrator’s emails about the trial and a failed payment, a counselor’s sign-in link to the prompt database, and its certificate of deletion. It receives the address and the message we send to it. Resend’s privacy policy
• Sentry error reports, once turned on. When something breaks, it’s told what kind of error happened, where in our code, and on what kind of browser or server. Never your words, your email, your scores or the page’s address, and we tell it not to store your IP address. Sentry’s privacy policy
• Stripe takes payments, on its own checkout page. It receives the card or bank details you type there (Lore never does), the email address you sign in with, what you’re buying and its price, and the note on the payment described under paying, above — never your student’s name. For a counselor practice’s monthly plan, it receives the administrator’s sign-in address, the plan and a reference number for the practice, never anything about its clients. It keeps its own record of each payment, under its privacy policy, and we can’t delete it. Stripe’s privacy policy

What we never do

We never sell or share your student’s information with colleges, lenders, or marketers. Cancel anytime and we delete it.

Nothing Lore sells a family renews by itself, so there’s nothing you have to remember to cancel: the Senior-Year Plan ends on May 31 of senior year, and a Multi-Year Plan’s year ends unless a parent says yes to another and pays for it. The deleting part works whenever you ask, plan or no plan, from your account page or by email. Here’s how.

We never use your personal information — what a student writes, their profile, their exploration, our feedback — to train AI models, and we never give it to anyone else to train theirs. Anthropic’s Commercial Terms, which cover how we use its API, say Anthropic may not train models on customer content from its services. That’s what their terms say; we can’t audit Anthropic ourselves.

There are no advertising trackers on this site, and we don’t follow you around other websites. Because of that, a browser’s “Do Not Track” setting doesn’t change anything here: our anonymous usage events work the same either way.

Seeing or fixing your data

Most of a student’s record can be seen and corrected in the account itself. For a copy of everything we hold about you or your student, or to fix something you can’t change there, email hello@loreeducation.com. We answer within 30 days. A parent or guardian can ask on a student’s behalf.

Deleting your data

If you have an account, a parent can delete one student’s record, or the whole family’s account, from the account page, at any time. It happens right away and can’t be undone. Then we email a deletion certificate to whoever asked: how many records of each kind were deleted and when, never what they said, with a link that shows it again later.

• Deleting a student deletes their whole record — profile, courses, activities, the college list, the history behind them and the consent records — and the student’s own login, with anything saved under its email address (price-check addresses included). Each deleted history entry leaves only its fingerprint (a hash, no words) and the date, so a drafting record saved earlier can still be shown to be one Lore held and deleted at your request. Their Merit Money Report and any plan they have go too, and deleting doesn’t refund a plan (our terms say what’s refunded). The record of what was paid stays, no longer linked to the student.
• Deleting the family deletes every student’s record, every login only your family uses, the sign-in links we sent you, and anything saved under your family’s email addresses, price-check addresses included, and the reports students sent to the addresses your family signs in with. Records of what your family paid, and of any refunds, are kept for our accounts with no name on them: the family account they belong to is emptied and renamed “Deleted family”.
• A student can’t delete their record on their own: they can ask a parent, or email us.

Everything else: email hello@loreeducation.com and tell us what to delete. We do it within 30 days and write back when it’s done. A parent or guardian can ask on a student’s behalf.

• Your email address: send it from that address (or tell us the address). We delete it from our database, with everything saved under it, its unsubscribe note included.
• A report a student sent you: its email’s link stops more for good; to delete the ones already sent, email us from that address.
• A free tool’s saved answers: its Clear button, or clearing this site’s data.
• Usage events: these aren’t linked to your name. If you have an account or gave us your email, we can find the ones linked to it, in our database and in PostHog; for the rest we need your device ID. If you’re reading this in the browser you used, it’s right here:

You can also find it yourself: open your browser’s developer tools on this site, go to Storage (or Application) → Local Storage, and copy the value next to lore_sid. If that’s a hassle, just tell us roughly when you used Lore and on what device, and we’ll do our best to find and delete those events.

• Shifts conversations: Lore doesn’t have them — your browser does. Restart the Shift, or clear this site’s data in your browser settings, and they’re gone from your browser.
• What we can’t reach: our host’s request logs expire on their own, and we can’t delete single lines from them. Anthropic may keep what it received from a Shift for as long as its terms permit (its Commercial Terms and Data Processing Addendum), and we can’t delete it early. Our email service keeps its own record of the messages it delivered, under its terms (linked above). Stripe keeps its own record of each payment, under its privacy policy (linked above), and we can’t delete it. The daily help-card and outage totals hold no device ID, IP address or words, so we have no way to tell which count, if any, was yours to remove; they expire after about 40 days.

How long we keep things

A four-year counselor needs a four-year memory, so a student’s record is kept while the family uses Lore — but not forever. Here is how long each thing is kept; the deletions on this schedule run on their own, every day.

• A student’s record: until a parent deletes it, or a year after June 30 of the year the student graduates, whichever comes first. A plan that’s still running, or waiting on a parent’s answer about another year, keeps it until that’s over.
• A whole family’s account: deleted once two years pass with no one in the family signing in (and no plan running or waiting on a renewal answer).
• A student whose parent or guardian never confirmed: deleted within 30 days of the box last being ticked.
• Your login: deleted with your family’s account. A login that isn’t part of any family (a student still waiting for a parent, say) is kept until you ask us to delete it.
• Sign-in links, invitations and parent requests: they work for 15 minutes (sign-in) or 7 days (invitations and requests), and are deleted a day after they expire.
• Sign-in sessions: deleted when you sign out, and otherwise within 31 days of signing in.
• A Merit Money Report: with the student’s record, and deleted with it. A refund doesn’t delete it.
• PSAT results, and the AI write-ups a student asks for: with the student’s record, and deleted with it.
• Records of payments and refunds: kept for our accounts. Deleting a student takes the student off them; deleting the family’s account leaves them with no name on them. Stripe keeps its own (above).
• Deletion certificates: kept, as the proof that a deletion happened. They hold counts and dates, never what was deleted.
• Price-check entries: your exact GPA and scores aren’t kept on our servers unless you save the lookup (next). The usage event (state, colleges, rough bands) is kept like other usage events, below.
• A request to save a lookup: its link works for 72 hours; your answers are deleted from it when it’s used, the link a day after it expires, and a request no one confirms is gone within 5 days.
• Email addresses saved from the price check: deleted two years after you gave one, unless it became an account’s login (then it goes with the account) or the browser you gave it in used Lore again (then two years after that). Or sooner, when you ask. What you agreed to, and whether you unsubscribed, go with it.
• The days a browser came back: kept as long as the saved address or login that browser is linked to, and deleted with it.
• Our copy of an email we queued: deleted 30 days after it was queued, once sent (or given up on).
• A student’s report to a parent: an unsent preview, a day after it expires; a sent one, a year after sending, or sooner if the family that address belongs to deletes its Lore account. A parent’s stop keeps only the scrambled address and inbox, with no end date.
• A free tool’s saved answers and the tracker’s list: in your browser until you clear them or this site’s data (or the browser does, above).
• Shifts conversations: not on Lore’s servers. In your browser until you restart or clear site data. Anthropic may keep what it received for as long as its terms permit (linked above); we can’t shorten that.
• Request, cost and email counters: two days at most, except the weekly count of reports sent to each parent’s inbox, which lasts 7 days.
• The parents’ demo Shift: no words kept; each run’s scrambled fingerprint lasts six hours.
• Daily help-card and safety-screen outage totals: about 40 days.
• The lore_ft cookie: 180 days in your browser, or until you clear this site’s data. The two cookies a student’s report sets (lore_origin, lore_handoff): 180 days.
• A counselor practice’s workspace (the IEC Copilot): its clients’ records, the practice’s notes, rubrics and reviews, and its weekly parent updates are kept while the practice uses Lore. A failed payment never deletes anything: 7 days of full use, then read-only. Once the practice cancels, or its trial ends unpaid, all of it is deleted within 30 days, with a certificate of deletion. What stays is that certificate, and a line with no name on it for Lore’s own counts: which plan the practice had, and when its trial, its first payment and its plan began and ended. A parent’s own Lore login stays theirs.
• Usage events: kept two years after they’re recorded, in our own database and in PostHog, then deleted: ours by the daily deletions above, PostHog’s by its own setting for how long it keeps them. When an account or a saved address is deleted, its usage events stay until then, with nothing that leads back to a name or an email address. You can have yours deleted sooner any time (see deleting your data).

Security

Found a security problem? Email hello@loreeducation.com. We acknowledge reports within 48 hours and won’t pursue good-faith researchers. A wrong number on a page isn’t a security issue — that’s our $100 data bounty.

Changes to this policy

When what we collect changes, this page changes first, with a new date at the top. If a change would use data you already gave us in a new way, we’ll say so on the site before it takes effect — and email you if you’ve given us your address. See also our terms.