This notice describes the current website. Updated September 28, 2026.
Browsing the catalog
You can search benefits and visit official provider pages without giving us an email address. Browsing and newsletter signup do not ask for identity documents, payment details, tax records, financial-aid applications, or detailed eligibility records.
The site runs on Azure Container Apps and reads its public benefit catalog from Supabase. Hosting services may process technical request information, such as IP addresses and request logs, to operate and secure the website.
Local benefit wallet
The optional benefit wallet stores your Saved, Interested, Claimed, or Dismissed statuses in your browser's local storage. The wallet does not require an account, and those wallet statuses are not uploaded to Student Benefits Intelligence or included in the site's analytics event stream.
The local wallet can also retain the last-known benefit name, provider, and verification date so an item can be shown as unavailable if it later disappears from the active verified catalog. Clearing this site's browser storage removes the wallet from that browser.
First-party usage measurement
We record a limited set of aggregate website events so we can understand whether students find and use verified benefits. These events can include one session-entry event per browser-tab session where session storage is available, page views, benefit views, claim clicks, official-source clicks, affiliate clicks, successful newsletter signups, searches, filter usage, and limited feedback/contact interaction events such as opening the widget or successfully submitting a form.
An event may include the current site path, a benefit slug when relevant, campaign tags such as UTM source/medium/campaign, and the hostname of an external referring site. Campaign/referrer attribution and a simple session-entry marker can be kept in your browser's session storage while you move between pages. The marker contains no account or user identifier; it is used only to avoid counting every internal page navigation as a new session entry.
We do not send newsletter email addresses, feedback/contact message text, feedback names or email addresses, search text, eligibility answers, wallet statuses, authentication tokens, database credentials, full outbound destination URLs, or student profiles into this event stream. Direct public access to the analytics event table is disabled.
Optional newsletter signup
When you submit the newsletter form, we store your email address, subscription status, signup and update timestamps, a general form location such as the homepage or a benefit page, and an opaque management token in Supabase. The form does not attach your search terms or a student profile to your signup.
Your email is collected for student benefit updates. A successful form submission means your signup has been saved; it does not mean an email has been sent. Newsletter delivery is still being prepared.
Newsletter preference links use the opaque management token rather than an email address. The token is placed in the link's URL fragment so it is not sent with the initial HTTP request, and the preferences page removes that fragment from the visible address after reading it. The page still requires an explicit action before unsubscribing or deleting a subscription record, which helps prevent automated link scanners from changing your subscription simply by opening a link.
Anonymous correction reports
Benefit detail pages include an optional correction form for outdated eligibility, value, deadline, availability, or source information. When you submit it, we store the benefit identifier, correction category, the text you enter, an optional HTTPS evidence link, and submission timestamps in a private review queue.
The form does not ask for your name, email address, student ID, account information, payment information, tax information, or other personal records, and it asks you not to include those details in the report text. Duplicate reports are limited by a content-based daily deduplication key, and per-listing daily intake is capped to reduce abuse without storing an application-level IP address. Direct public access to the review queue is disabled.
Correction reports are review-only. A submission cannot edit or publish a benefit automatically; a material change still requires verification against an official source before the public catalog is updated.
Feedback widget and Contact page
The optional site-wide feedback widget and Contact page can store the category you choose, the message you enter, the current site path, relevant benefit or university context, an optional experience rating, and any name, email, organization, or HTTPS link you choose to provide. These submissions are kept in a private review queue with direct public table access disabled.
Name and email are optional for the floating feedback widget and for anonymous corrections or benefit suggestions. A reply-required contact inquiry asks for an email so SBI has a way to respond. Submitting either form does not subscribe you to marketing or the newsletter.
To slow automated abuse, the feedback API can use a proxy-provided network address only in transient server memory to create a short-lived one-way rate-limit key. That key is not written to the feedback table. Database deduplication and daily intake caps provide additional abuse protection without storing an application-level IP address in the submission record.
If feedback reports an active verified benefit as outdated, the factual report may also be copied into the existing private correction queue without copying the optional name or email. It still requires official-source verification before any public catalog change.
Advertising and Google AdSense
Student Benefits Intelligence uses Google AdSense code to connect the site to Google advertising services. Google and its advertising partners may use cookies, device identifiers, IP addresses, and similar technical information to deliver, measure, secure, and personalize ads where permitted.
Google's use of advertising data is governed by its own privacy and advertising policies. Where consent is legally required for advertising cookies or personalized ads, the applicable consent controls must be completed before those technologies are used.
Official provider and affiliate links
Claiming a benefit happens on the provider's website. That provider handles its own applications, eligibility checks, and privacy practices. Review its terms before sharing personal information.
Some claim links may later be affiliate or referral links. Monetized links are labeled and kept separate from the official source used to verify the benefit. See the affiliate disclosure for how those links are handled.
Details still being finalized
A dedicated public privacy email address and fixed retention periods for newsletter, feedback/contact, and aggregate event data have not yet been published. Privacy and data requests can be submitted through the Contact page. Tokenized self-service unsubscribe and subscription-record deletion controls are implemented, but newsletter delivery is not yet enabled. These operational disclosures are not a completed, reviewed privacy policy.
If you prefer to wait until the remaining details are available, continue using the catalog without subscribing.