Private exploration, with minimal data

What we collect

The guest experience stores language, country, province/territory or state, education stage, questionnaire choices, saved directions and professions, selected education options, and checklist progress. We do not ask for a legal name, birth date, address, school, transcript, email, or protected demographic information.

How guest plans are protected

A random plan identifier and a separate private access token are kept on the student’s device. The token is sent only in an authorization header, never in a page URL. Anyone with access to that device’s browser profile may be able to open the guest plan, so shared-device users should delete the plan after exporting it.

Student-controlled sharing

A student may create a separate, one-time invitation for a guardian or counsellor and choose each category they can see. An unused invitation expires after seven days; acceptance replaces it with an independent viewer credential. The student can revoke a pending or active relationship at any time; revocation immediately makes that viewer credential unusable.

Shared categories can include saved career directions, saved professions, selected pathways, completed plan steps, and—only when chosen—country, province/state, and an approximate grade or education-stage band. Sharing never exposes questionnaire answers, skipped answers, exact grades, names, email addresses, schools, addresses, plan credentials, private AI conversations, or free-text notes. Counsellor recommendations are catalogue selections stored separately and never overwrite the student’s plan.

Hosting and technical data

Cloudflare hosts the application and may process standard request metadata such as IP address, approximate country, device/browser information, security signals, and request timestamps for delivery, abuse prevention, and diagnostics. Questionnaire answers and plan access tokens must not be placed in analytics or application logs.

Retention, export, and deletion

Guest plans currently remain until the student deletes them. The plan page provides export and deletion controls. A time-based retention limit, account workflow, processor register, incident contact, and formal consent records must be approved before the service collects identifying account data.