Privacy Policy
We only collect what we need to run a call. We do not sell your data. Here are the details (last updated August 10, 2026).
1 · What we collect
To run Candid Campus we collect your name and email; a phone number when you take a call (for the secure bridge); a payment method, handled by Stripe (we never see full card numbers); any prep questions or notes you choose to share with a student; and basic usage and device data to keep the service working and secure. Hosts additionally provide one represented institution, program level, enrollment or completion status, and completion year; verify a government ID through our identity provider; and have that academic affiliation reviewed. Recent graduates also confirm periodically that they are not enrolled in another post-secondary program. A host who enrolls in payouts also confirms they are legally allowed to receive self-employment income in the United States; we keep the date of that confirmation and the exact statement they agreed to, and we never show either one publicly. An adult booking participant who chooses to connect Google Calendar gives us their Google account identifier and email, selected calendar identifiers, calendar time zone, free-or-busy results, and an encrypted authorization credential. Calendar names are fetched only while a host chooses which calendars should block availability and are not saved. We do not request or collect the titles, descriptions, attendees, or other content of their existing calendar events. Hosts invited to the creator program may also provide one public Linktree or social URL, choose whether they want paid-content or campus-tour opportunities, and opt into a public featured creator profile. We keep their creator-agreement version and acceptance date.
2 · How we use it
We use your information to set up and connect calls, process payments and refunds, verify student hosts, keep the community safe, provide support, and send service messages such as sign-in links and booking updates. We do not sell your personal data, and we don’t show your profile to anyone other than a student you’ve booked. A creator host’s approved headshot, selected host-profile facts, biography, topics, and chosen social link are public only after that host separately opts into and activates the creator program. We also use signed creator-link visits, booking-attribution records, and reward-ledger data to apply discounts and pay commissions. A valid creator-link visit is retained for up to 30 days before a qualifying first booking; once that booking is funded, its creator attribution remains associated with the family account for later qualifying bookings. For someone who connects Google Calendar, we use free-or-busy results only to avoid suggesting times that conflict with a connected calendar. Host suggestions also stay inside the host’s chosen booking hours. We compute suggestions ephemerally and keep only the windows the host actually sends. The initial connection does not authorize us to read event details or write events. Either side can disconnect at any time.
3 · Minors
Candid Campus is for high-schoolers 13 and up. A teen’s own login starts out limited to browsing and building a shortlist. When a parent or guardian books a call that includes their child, they consent at checkout. A parent or guardian can also grant standing permission from their account that lets their teen book and pay for their own solo calls. They can remove that permission for future bookings at any time; existing bookings stay in place. The payment method can be the teen’s own, still handled by Stripe (we never see full card numbers). We keep an audit record of each grant and removal and preserve the verified identity and exact statement affirmed at each grant. We collect the minimum needed for the experience. See also Calls involving minors.
5 · Calls are not recorded
Candid Campus does not record, store, transcribe, sell, or train on call audio, on either side. See Recording & consent.
6 · Retention & deletion
You can delete your account anytime from Account › Privacy. Deletion removes your reviews, notes, threads, and booking history within 30 days; we keep the minimum required for legal, tax, and anti-abuse purposes (for example, anonymized recommendation stats, payment records, and a host’s payout-eligibility confirmation). To request a copy of your data, email hello@candidcampus.io.
Disconnecting Google Calendar removes the stored authorization credential and stops future calendar access; we also make a best-effort request for Google to revoke the grant. Account deletion removes the credential; host deletion also removes the host’s calendar scheduling preferences.
We protect the stored Google authorization credential with authenticated encryption and restrict calendar connection data to server-side systems and authorized operations. Short-lived access tokens are not stored in our database.
7 · Your choices & rights
You can access, correct, or delete your information, and depending on where you live you may have additional rights (for example under GDPR or CCPA). We use a small number of cookies for sign-in and security. To exercise any right, email hello@candidcampus.io.
8 · Changes & contact
We’ll update this page if our practices change and revise the date above. Questions about privacy? Email hello@candidcampus.io and we will reply as soon as possible.