Back to NextStep
Privacy
Privacy Policy
Last updated: 7 October 2026
NextStep is an independent website for students in Sri Lanka. We collect only what we need to run it, and we never sell your information.
Your information
What we collect, why, and who sees it
What we collect
Only what we need
- Name, email and password if you create an account. Passwords are stored only as a one-way hash by our login provider - nobody, including us, can read them.
- What you search for, to show results. It isn't saved to your account.
- Sign-in cookies that keep you logged in - until you log out, or until you close the browser if you don't tick "Remember me".
- Basic technical logs kept by our host, such as IP address and browser type.
- Feedback you send us - your message, and the page link, screenshot or email if you add them.
No advertising or analytics cookies, and we never ask for your ID number, phone, address or payment details.
How we use it
Only to run NextStep
- Show degrees and universities that match your search
- Let you create an account and stay signed in
- Answer your questions, fix errors you report and reply to your feedback
- Keep the site secure and running smoothly
Who we share it with
Only when needed - never sold
- Supabase - stores your account and any feedback you send, on servers in Singapore, and sends sign-in emails.
- Cloudflare Turnstile - a security check on our forms that tells people from bots. It looks at basic browser signals, not your form answers, and doesn't use advertising cookies.
- Our hosting provider - for technical logs.
- Authorities - only if the law requires it.
Your rights and safety
Control over your data, and how we look after it
Your choices and rights
You can ask us to
- show you what we hold about you
- correct your name or email
- delete your account
Email ashenibandara21@gmail.com from your account's address - we reply within 30 days, under Sri Lanka's Personal Data Protection Act, No. 9 of 2022.
How long we keep it
Account details stay until you delete your account and are removed within 30 days of your request. Feedback is kept until it's dealt with, and technical logs only as long as needed for security.
How we protect it
Passwords are hashed, sign-in cookies are hidden from page scripts, your data is locked so only our server can read it, and everything travels over HTTPS.
Good to know
Other websites, younger students and future changes
Links to other websites
We link to official university, institute and UGC websites. Their own privacy policies apply there.
Students under 18
If you're under 18, please use the site with a parent or guardian. If a child gave us information without permission, email us and we'll delete it.
Changes to this policy
We'll update this page and the date at the top, and show a notice on the site if a change is significant.
Questions, corrections or requests?
Email ashenibandara21@gmail.com.