Privacy Policy
Last updated: June 2026 · NEXTUP.AI is built with privacy as a first principle.
1. Our Privacy Philosophy
NEXTUP.AI is built on a "privacy by design" principle. We collect the minimum data necessary to operate the platform. Your most sensitive information — including your registration number, CGPA, and academic marks — is encrypted in your browser before reaching our servers, so even we cannot read it.
2. What Data We Collect
Account Data (stored as plaintext):
- Email address (used for authentication via Supabase)
- Full name and branch (e.g., CSE, ECE)
- Batch year and degree type
Sensitive Data (stored as AES-256 encrypted blobs — we cannot read this):
- VIT Registration Number (Neo ID)
- CGPA, 10th marks, 12th marks
- Application notes and status updates
Usage Data:
- Application tracking history (companies, stages)
- Calendar events and placement deadlines
- Parsed email metadata (subject, sender, parsed drive details)
3. How Encryption Works
When you log in, your browser derives an encryption key from your password. Sensitive profile fields are encrypted before storage, while a separate one-way matching token is used where the service needs to identify a shortlist match without keeping your Neo ID as plain text.
Sensitive data is encrypted before upload and decrypted when needed by the protected application flow. Our database does not keep your Neo ID as a readable value.
4. Cookies & Local Storage
We use only essential cookies required for authentication (Supabase session cookies). We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party tracking scripts.
We store your Zustand session state (user profile and auth token) inlocalStorage to keep you logged in across browser refreshes. This does not include your encryption key.
5. Gmail Access
NEXTUP.AI does not ask for access to your Gmail account and does not sync or scan your personal inbox. Placement updates are collected from a developer-managed college inbox, processed once, and then served from the shared opportunity database to all users.
6. Third-Party Services
- Supabase — provides authentication and database hosting. Data stored on Supabase is subject to Supabase's Privacy Policy.
We do not use Google Analytics, Meta Pixel, Hotjar, or any other third-party analytics or advertising tools.
7. Data Retention & Deletion
Your account data is retained for as long as your account is active. You may delete your account at any time by contacting us through the in-app feedback form. Account deletion removes all your data from our servers within 30 days.
8. Your Rights
- Right to access your personal data
- Right to correct inaccurate data
- Right to delete your account and all associated data
- Right to disconnect Gmail at any time
9. Contact
For any privacy concerns, use the feedback form inside the platform. NEXTUP.AI is a student project maintained voluntarily — we will respond as promptly as possible.