Your record is yours. Here's exactly who sees it.

We collect only what Stellar needs to work:

• Account details: your name, email address, password (stored hashed by our authentication provider, never readable by us), role (student, advisor or admin), school, intended path and class year.
• What you log: shadowing and experience entries, hours, reflections, courses and grades, GPAs you report, MCAT plans and scores, and schools you save to your list.
• Advisor verification: for advisor accounts, a school email address and a link to a staff directory page, so we can confirm you work where you say you do.
• Technical basics: a session cookie that keeps you signed in, and your light or dark theme choice, saved in your own browser. Our hosting providers keep standard server logs (such as IP address and time of request) for security and troubleshooting.

Never enter patient information. Stellar is for your hours and reflections, not patient names, dates of birth, record numbers or any other detail that could identify a patient.

We use your information to run your Stellar account: to show your progress, share it with the advisor you choose, send account emails (sign-up confirmations, advisor approvals and renewal reminders) and keep the service secure.

We do not sell your information, rent it, show you third-party ads, or share it with medical schools, employers or anyone else unless you ask us to.

• You. Students see and edit only their own record.
• Your advisor, if you link one. Nothing is shared until you enter an advisor's code in Settings. A linked advisor can read your record but can never change it. You can unlink at any time and their access ends at once.
• Advisor notes are private to the advisor who wrote them.
• The Stellar team can access data only when needed to run, secure or support the service, or when the law requires it.

These rules are enforced in the database itself (row-level security), not only in the app, and are tested automatically every time the code changes.

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records held by schools that receive U.S. Department of Education funding.

• Students using Stellar on their own: what you enter is your own information, kept by you in your own account. It is not an education record held by your school, and you control who sees it.
• When a school or advisor uses Stellar: advisors see only students who have chosen to link to them. Advisors must use a verified school email and re-confirm it every 180 days, so access ends when someone leaves their job.
• Institutional agreements: when a school signs an agreement with us, we act as a “school official” with a legitimate educational interest under the school's direct control. We use that school's data only to provide Stellar to it, don't re-disclose it except as FERPA allows, and return or delete it when the agreement ends.

Schools can ask us for a data processing agreement and a summary of our security practices.

We use a small number of trusted companies to run Stellar. They process data only on our instructions:

• Supabase: database and sign-in, hosted in the United States.
• Vercel: web hosting.
• Resend: account emails.
• Payment processor (when paid plans launch): handles card details directly. Stellar never sees or stores your full card number.
• AI provider (when Stella, our AI assistant, launches): the questions you ask Stella and the parts of your record needed to answer them are sent to our AI provider to generate a reply. We will choose providers that do not train their models on your data.

Data is encrypted in transit (HTTPS) and at rest by our database provider. Access is limited by role and enforced in the database. Advisors are verified before they can see any student. No system is perfectly secure, so we can't promise absolute security, but if a breach affects your information we will notify you as the law requires.

• See and correct everything you've entered, any time, from your portal.
• Unlink your advisor in Settings whenever you like.
• Ask us for a copy of your data, or to delete your account and everything in it.
• Depending on where you live (for example California), you may have further rights to know, correct or delete your information. We honor them for everyone.

To make a request, contact the Stellar team. We respond within 30 days.

We keep your information while your account is open. If you delete your account, we delete your record within 30 days, except for limited copies in backups (which expire on their own schedule) or anything the law requires us to keep.

Stellar is for college students, graduates and the professionals who advise them. You must be at least 16 to use it, and we don't knowingly collect information from children under 13.

If we make a significant change to this policy, we'll tell you in the app or by email before it takes effect. Questions? Contact the Stellar team. See also our Terms of Use and disclaimer. Stellar operates Stellar.