Data policy

Plain language, because you should actually be able to read it.

When you apply

We store exactly what you type into the form, plus basic technical context (browser, language, which page you applied from). Applications are reviewed by AI against a published rubric, with human oversight of flagged and sampled cases. Final awards among qualified applicants are decided by a publicly seeded lottery. We never sell or share your application; declined applications are deleted within 12 months.

We ask you to confirm your email address before your application enters the draw. We store a one-way hash of your IP address to spot abuse — never the address itself.

If you receive a seat

The seat is measured, and we tell you exactly how before you accept it:

Workspace analytics — seat activity from the Claude workspace admin console (e.g. days active). Used to run the program, spot unused seats, and detect abuse.
Claude Code telemetry — standard OpenTelemetry metrics the tool emits: session counts, lines of code changed, commits, tool-acceptance rates, token usage, model used. You run the setup script yourself and can inspect precisely what is sent. We never see your code, your prompts, or your files.
Surveys — one at the start, one at the end, about 3–5 minutes each.

Exactly which telemetry we keep

From what Claude Code sends, we extract and store only these measures, per seat, per day. Raw telemetry payloads are deleted after 7 days; the extracted measures below are what we keep.

sessions started, and active days
lines of code added and removed
commits authored
tool-use decisions accepted and rejected
tokens used, by model
estimated cost of usage

Research

We study whether access to AI coding tools changes what people can do, and we publish findings only in aggregate — never your name, email, or individual usage data. Research exports are keyed by a salted pseudonym, not by your identity. If we ever pursue formal academic publication, the study design goes through independent ethics review first.

Who else processes your data

Supabase — the database that stores your application (EU/US region as configured).
Vercel — serves these pages and runs the form handler.
Resend — sends our email. Resend retains its own delivery logs on its side.
Anthropic — provides the Claude workspace and the seat itself, under its own terms.

Your rights

Email privacy@wildcardscholarship.org and a human will answer. We act on deletion requests in the live database immediately. Encrypted backups are kept for 90 days, so a deleted record can persist in a backup for up to that long before it ages out.

Questions about anything here: hello@wildcardscholarship.org.

Ask what we hold about you, and get a copy.
Ask us to delete your data — application or usage — at any time. Deleting usage data doesn't end your seat.
Withdraw from the research analysis while keeping your seat.