ProfScout is a research tool that helps students discover professors and manage academic outreach. We keep data collection to the minimum needed to run the product.
What we store
When you create an account we store your sign-in details and the profile information you choose to add (such as your field, interests, and resume-derived summary) so we can remember your preferences and tailor recommendations. Outreach you log is saved to your account so you can track it across sessions.
We also record product usage events (which features are used, and when) against a random device id, and against your account id while you are signed in, so we can understand and improve the product.
How we use it
Your profile is used only to power discovery and recommendations inside ProfScout. We do not sell your data, and we do not share it with third parties for advertising.
How we protect your data
We hold as little as we can, and these are the measures protecting what we do hold:
- Encrypted in transit. ProfScout is served over HTTPS only. Plain HTTP requests are redirected, and we send a Strict-Transport-Security header so browsers refuse an unencrypted connection to us. Every call between your browser, our server, and any Google API is encrypted with TLS.
- Encrypted at rest. Everything we store is held in Google Cloud Firestore, which encrypts data with AES-256 before it is written to disk.
- A password we never see. Sign-in is handled by Firebase Authentication. Your password is set and checked by Google. ProfScout never receives or stores it.
- Deny-by-default access rules. Our database rules reject every read and write unless the request comes from the signed-in account that owns the document. The collections our server uses for caching, analytics, and billing are closed to every browser client, with no exception for signed-in users.
- Secrets kept server-side. API keys and service-account credentials are stored as encrypted environment variables on our host. They are never sent to the browser and never committed to our source code.
- Limited human access. Only the people who operate ProfScout can reach production data, through accounts protected by two-factor authentication, and only to run and support the service.
- No card data. Payments run on Stripe’s own hosted checkout page. Card numbers never reach ProfScout’s servers.
- No model training. We do not use your data, and specifically do not use any data obtained through Google APIs, to develop, improve, or train generalized artificial intelligence or machine learning models.
Data retention and deletion
We keep your account data for as long as your account is open. A message you have started but not sent is saved to your account so you can come back to it, and is cleared once the message is sent.
You can disconnect ProfScout from your Google Account at any time from your Google Account permissions page. That immediately revokes our ability to send on your behalf, and needs nothing further from us. To delete your account and everything stored with it, email us at team@profscout.com. We remove it within 30 days and write back to confirm.
Third-party services
We rely on public academic sources (such as OpenAlex) to surface professor and publication data, and on infrastructure providers to host the app and authenticate you. Their handling of data is governed by their own policies.
Analytics & cookies
We use Google Analytics (GA4) to understand how ProfScout is used so we can improve it. It collects pseudonymous usage data (which pages you view, which features you use, how long a session lasts, your approximate location, and your device and browser type) using cookies and similar identifiers. We do not use this data for ad personalization, and we do not sell it. Google’s handling of that data is governed by the Google Privacy Policy. You can opt out of Google Analytics on any site by installing the Google Analytics opt-out browser add-on, or by blocking cookies in your browser settings.
Gmail
If you choose to connect Gmail, ProfScout requests only the Google permission to send email on your behalf (gmail.send). It is used solely to send messages you compose, when you click Send. ProfScout cannot read, modify, or delete anything in your mailbox.
How we protect it. gmail.send is the narrowest permission that can send a message, and it grants no ability to read, list, modify, or delete anything in your mailbox. The access token Google issues is held in your browser’s memory for the current session only: it is never written to disk, never placed in a cookie or in local storage, and never sent to ProfScout’s servers. The message is transmitted directly from your browser to Google over TLS, so the text you send never passes through our servers at all. The token expires on the schedule Google sets (about an hour) and is gone when you close the tab.
The only Google data we retain is the message and thread id Gmail returns, saved to your own account record so your outreach tracker can show that the message went out. It is readable only by you, under the access rules above. You can revoke ProfScout’s access at any time from your Google Account permissions.
ProfScout’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer information received from Google Workspace APIs to others, we do not use it for advertising, and we do not use it to develop, improve, or train generalized artificial intelligence or machine learning models.
Questions about your data, or want it removed? Contact us at team@profscout.com or 925-915-5548.