Privacy

What we store: nothing

There is no database, no account and no copy of your data on our side. What the analysis keeps, a summary, lives only in your browser’s storage, and «Delete all my data» removes it. Two things are outside our hands: our host Vercel keeps short-lived technical logs, and if you pay, Stripe stores the payment. Google also receives measurement data about our ads, as described under «Cookies and measurement» below.

Open source

All of this site’s code is public under the MIT licence: github.com/moritzlauper/whatshouldistudy. You can read exactly which data goes where and check it yourself.

What happens to your data

• Connected accounts (YouTube, Spotify, Reddit): you sign in with the service. It gives your browser a read-only access token, stored in this tab’s session storage only and gone when you close it. Your browser fetches your data directly from the service. We never receive the token or the data.
• Exports (Google Takeout, Spotify, Instagram, TikTok): files you drop are read and unpacked on your device. They are not uploaded.
• What is kept: a summary per source (how much of your content relates to each field, a few example titles as evidence, counts), your questionnaire answers and preferences. These are stored in your browser’s local storage, on your device only. “Delete all my data” on the start page removes them.
• What we receive: to look up programmes, your browser sends us the ids and scores of your top fields, up to 80 topic words with a weight (say “theatre” 0.8, so single programmes can be sorted by your topics) and your filters (level, countries, budget, citizenship category). No titles, no searches, no channels, nothing that identifies you. We don’t store the request.
• Payments: handled by Stripe. We receive whether a checkout session was paid, not your card details. Stripe’s privacy policy applies to the payment.
• Plans for organisations: when a school or counselling service subscribes, Stripe stores its name, billing address, tax number and email for invoices. If you unlock the report through your school’s link, we only tell Stripe that the plan used one report, with a random id of your browser so you don’t count twice in the same month. Neither your school nor Stripe learns who you are or what your result is.
• Hosting: the site runs on Vercel, which keeps short-lived technical logs (IP address, time, page). We use your IP address only to infer your country and show the price in your currency.

Google user data

whatshouldistudy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request the read-only scope youtube.readonly to read your subscriptions, liked videos, playlists and uploads, and use it only to compute your field-of-study profile in your browser. The data is not transferred to us or to third parties, not used for advertising, and not used to train AI models. You can revoke access at any time at myaccount.google.com/permissions.

This site uses YouTube API Services. When you connect YouTube, the YouTube Terms of Service and the Google Privacy Policy also apply.

Cookies and measurement

Vercel Web Analytics counts page views without cookies and without an identifier that recognises you across days. Vercel sees the page, the referring page, your country and the device type. We cut parts of the address such as sign-in codes or payment ids before sending.

To see which ads bring people here and how many of them buy the report, we use Google Analytics and Google Ads by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google sets cookies for this and learns which pages you open and whether you view a result, start checkout or pay, with amount and currency, along with your IP address and browser and device details. When you buy, a hash of your email address (SHA-256) also goes to Google Ads so Google can match the purchase to an ad. The address itself does not.

Your history, your sources, your answers, your fields and your result never go into this measurement. Data from the YouTube API is not used for advertising.

Whether it runs depends on where you are. From the EU, the EEA and the UK we set Google cookies only after you agree. Without consent the Google tag sends only cookieless signals, such as that a page was opened, which Google uses to estimate totals. From Switzerland and all other countries measurement runs until you refuse it. You can change your choice at any time under «Cookie settings» at the bottom of every page.

Google may transfer data to the US and is certified under the EU-US Data Privacy Framework. How Google uses the data: policies.google.com/technologies/partner-sites.

Otherwise browser storage is used only for the data described above and your cookie choice.

Your rights

Because we don’t hold personal data about your use of the analysis, there is nothing for us to export or delete: you control it in your browser. For payment records, contact us at hello@whatshouldistudy.com. Controller: Moritz Lauper.