Privacy Policy

Last updated: September 23, 2026

We try to collect as little as possible and tell you what we do. Kolly is used by high school students, so we are specific about which services see your data and on which pages.

What we collect

Account data. Your email and the OAuth identifier from your sign-in provider (typically Google). Name and profile picture if your provider sends them.
Profile data. What you choose to tell us during setup or in Settings, like your high school graduation year, target schools, intended major, GPA, and test scores.
Essay data. The essays, activities, honors, letters, and notes you create or upload, plus the scores and reviews Kolly produces for them.
Usage data. Pages visited, features used, how you first found Kolly (the referring site or campaign link), error logs, and rough device info (browser, operating system, IP at the time of request). We use this to debug and improve the product.
Billing data. If you subscribe, Stripe handles your card. We get back the subscription status, invoice metadata, and the last four digits of the card. We do not see or store your full card number.
Free tool submissions. Essays pasted into the free tools are stored so we can show you the result, let you share it, and let you continue with it if you create an account. We also store a random session id, your IP address and your browser type to prevent abuse. Tool runs are deleted after 90 days.
Email without an account. If you ask a free tool to email you a result, we store that email address with the result so we can send it, send one reminder about the same essay, and connect it to your account if you sign up later. There is no newsletter. Every email has a link to stop further messages, or write to founders@kolly.ai and we will delete it.

What we don't do

We don't sell your data.
We don't use your essays to train AI models, and the model providers below don't either.
We don't run third-party analytics, advertising tags, or session recording on signed-in pages: the dashboard, onboarding, settings, checkout and payment pages, and sign-in. Links that show your own writing (shared essays and shared tool results) are treated the same way.
We don't ask for medical, legal, or financial information, and we'd rather you not paste it in.

Who we share data with

To run Kolly we use a small set of vendors. Each one only sees the data it needs to do its job:

Supabase stores your account, essays, and scores. Hosted in the US.
Intercom runs the support chat on signed-in pages. It receives your name, email, account id, the messages you send it, and basic page and device information, and it sets its own cookies.
Anthropic and DeepSeek models, reached through the Vercel AI Gateway, write the scores, feedback, and chat replies. Your essay text is sent each time one of these runs. Anthropic's Claude runs on Anthropic or on the cloud platforms that host Claude for Anthropic. The DeepSeek model we use runs only on Amazon Bedrock or DeepInfra, never on DeepSeek's own servers. Every one of these hosts has agreed with Vercel not to keep your text after answering and not to train on it.
OpenAI turns essay text and uploaded documents into embeddings, the lists of numbers Kolly uses to find related passages and similar accepted essays. OpenAI does not train on this text but may keep it for up to 30 days for abuse monitoring.
Stripe processes payments.
Vercel hosts the app and serves the website. Vercel Web Analytics and Speed Insights count page views and measure load times on every page without cookies.
Resend (or a similar transactional provider) sends account emails.
Google Analytics collects traffic stats on public pages, like the home page, blog, pricing, and the free tools. When we run ads, the Google Ads tag loads on those same public pages to measure which ads bring visitors. Neither loads on signed-in pages, so neither sees your essays or your account.
Microsoft Clarity records how visitors use public pages (clicks, scrolling, and what is on screen) so we can find confusing screens. It never loads on signed-in pages. Anything typed into a form field is masked, and on the free tools all page text is masked too, so pasted essays and their results are never recorded. If you are signed in, the recording is tagged with a one-way hash of your account id, never your email or name.

We may also disclose data if a court orders us to, or if it is necessary to protect a person from harm.

Cookies

We use a small number of cookies to keep you logged in and remember your settings. The free tools also set a cookie for up to 24 hours that remembers which draft you pasted, so you can pick it up after you sign in. The free essay tool sets a kolly_anon_id cookie, kept for up to 2 days, so we can apply the free limit to each browser. A kolly_attribution cookie, kept for up to 90 days, remembers how you first found Kolly. On public pages, Google Analytics and Microsoft Clarity set their own cookies to count visits and group a session, and the Google Ads tag, when it is on, sets one to measure ad visits. None of these load on signed-in pages. On signed-in pages, the Intercom support chat sets its own cookies.

Your choices

See your data. Most of it is visible in the dashboard.
Delete your data. Deleting an essay from its document menu removes it from your account, but it is hidden rather than erased right away. To have essays or your whole account permanently deleted, email founders@kolly.ai.
Cancel. Cancel your subscription from Settings.
Export. Email us if you want a copy of everything Kolly has on you.

Data retention

Your account data and essays, including essays you have deleted in the app, are kept until you ask us to delete them or your account is closed. Backups age out within 30 days of that deletion. Billing records are kept for as long as we are legally required to keep them. Free tool runs, including runs from signed-out visitors, are deleted 90 days after they are created.

Children

Kolly is for students 13 and older, and we don't knowingly collect data from anyone under 13. Setup asks for your high school graduation year. If that year means you are probably under 13, Kolly flags the account, turns off its AI features, and we review it. If you think a child under 13 has signed up, or you are a parent who wants your child's account deleted, email founders@kolly.ai and we'll delete it.

International users

Kolly is hosted in the United States. If you use it from outside the US, you are sending your data to the US.

Changes to this Privacy Policy

We'll update the date at the top when this changes. Material changes will get an email to your account.

Contact

Privacy questions or requests: founders@kolly.ai. Mail: Dotter, Inc., 42822 Songbird Ct, Ashburn, VA.