Security & data safety

Built to keep student data limited and protected.

Scholark is a student-built educational project, so the security model is intentionally straightforward: collect only what features need, keep private credentials out of browser code, protect saved cloud data with authentication and rules, and make privacy choices visible.

Last reviewed: September 6, 2026
Independent educational project — not a company

Scholark is independent, student-built, non-commercial, not incorporated, not an employer, and not revenue-generating. The site exists to provide free educational planning and academic-support tools.

HTTPSFirebase AuthenticationFirestore Security RulesSecret ScanningNo Advertising Monetization

1. Account security

Account features use authentication so saved information is associated with an authenticated user rather than exposed as public page content. Users should keep passwords private and should not share account access.

2. Cloud-data controls

Where Scholark stores account-linked information in Firebase, access is intended to be governed by authentication and Firestore Security Rules. Public browser configuration for Firebase is not treated as a private credential; private server credentials and service-account secrets must not be committed to the public frontend repository.

3. Secret-scanning policy

The repository includes automated checks for common private-key and token patterns. Private API keys, passwords, signing keys, access tokens, and service-account credentials must stay out of frontend code and public Git history.

4. HTTPS

The production site is served over HTTPS. Scholark also includes a browser-side fallback that redirects non-localhost HTTP visits to HTTPS.

5. Privacy by feature design

Some features are designed to keep processing on the device where practical. For example, the Essay Rubric Coach performs its rubric analysis on-device; a draft is only stored with an account when a user deliberately chooses a save or sync feature.

6. Cookies and analytics

Necessary browser storage supports authentication, security, preferences, and consent state. Optional analytics defaults to off until the user chooses otherwise where supported. Scholark does not use advertising cookies or advertising personalization and does not run advertising monetization.

7. What students should avoid saving

Do not place passwords, government identification numbers, payment-card information, medical records, or other highly sensitive information into educational planning fields. Scholark is a planning and study project, not a secure vault for sensitive records.

No system is perfectly secure. These controls reduce risk, but no website can guarantee absolute security. If you discover a security issue, avoid publicly posting sensitive exploit details and use the project owner's private contact method where available.

8. Related policies

Read the Privacy Policy for data-use details and the Terms & Conditions for educational-use limits and account responsibilities.