When Chris Gray sold his Shark Tank-backed scholarship search startup Scholly to Sallie Mae in 2023, he thought he had it all. Now he’s suing the student loan giant for wrongful termination and alleging that it’s selling the data his app collected, which includes personal info on minors, without properly informing users. 

Gray co-founded the company a decade prior with the hope of helping students more easily find college scholarships that were going untapped. Within two years, he nabbed sharks Daymond John and Lori Greiner as investors after an appearance on the show. 

With the acquisition, Gray became one of the few Black venture-backed fintech founders to exit their company, despite receiving some blowback that he was “selling out.” “I think being one of the first Black tech companies to get acquired by a bank, that’s really a big achievement,” he said at the time. 

He took a vice president role at Sallie Mae and expected to settle in nicely at his new gig, while helping scale Scholly and making it free to use, he said in an exclusive interview with TechCrunch.

What happened next is detailed in Gray’s lawsuit against Sallie Mae in Delaware Superior Court, and in a whistleblower complaint he submitted to the Securities and Exchange Commission, both of which he filed earlier this month. 

He alleges Sallie Mae laid off his employees, including his co-founders, and then went back on promises that it wouldn’t sell the users’ data, according to a TechCrunch review of both filings. He claims the company fired him a year after the acquisition when he tried to raise concerns about data privacy issues. Gray is seeking backpay and punitive damages in the suit, plus legal costs. 

Gray told TechCrunch that before he agreed to the sale, he believed Sallie Mae would be prohibited from disclosing or selling non-public personal information about Scholly customers to third parties because it was a federally regulated financial institution.  

Now he alleges that his acquirer got around any such regulations by putting Scholly into a subsidiary that is selling the data — including age, gender, race, and other indicators of an individual’s financial need — to third parties like universities and advertisers, possibly without students’ full awareness.  

“I sold Scholly to a regulated bank because I believed it would protect the students who trusted us,” Gray told TechCrunch. “Instead, I watched the company build a non-bank subsidiary to do things the bank itself can’t legally do: sell student data. That’s not the company I thought I was joining.”  

Sallie Mae denied Gray’s allegations, calling them “without merit” and declined to answer TechCrunch’s questions about its data privacy practices. 

“While we don’t comment on pending litigation, it’s unfortunate a former employee is making false accusations about our company following his departure nearly two years ago. We plan to vigorously defend ourselves against these claims which are without merit or substance,” Rick Castellano, the company’s vice president of corporate communications, said in an email.  

Asked which specific accusations were “false,” Castellano declined to comment. 

From Alabama to Shark Tank

Gray grew up low-income in Birmingham, Alabama, with a single mother and two siblings. He felt the barriers to higher education were “real and immediate” for someone like him.  

Aside from being expensive, he felt he lacked access to information to help him make proper decisions about where to go and how to afford it, a pressure that only compounded after his mother lost her job in the 2008 recession.  

“That experience shaped how I thought about the scholarship system later,” he recalled, saying he began to view education and scholarship as “a problem of access rather than a problem of merit.”  

As a teenager, when the time came for him to apply for scholarships, he found the process fragmented and inefficient, he said. There was no centralized search for him to find opportunities, and when he did find a website with scholarship options, there were thousands of listings, but no reliable way to filter to see what he was actually eligible for. Not to mention the scams and outdated listings that persisted on some sites.  

Still, he applied to about 75 scholarships over the course of seven months using public computers and the internet at the library, and won around $1.3 million in scholarship funding, including from the Bill and Melinda Gates Foundation and the Coca-Cola Scholars Foundation.  

He studied economics and entrepreneurship at Drexel University and met students facing a familiar roadblock. “Students kept asking for help finding scholarships,” he told TechCrunch. “The funding existed with hundreds of millions of dollars unclaimed each year, but the search process was broken.”  

He started mapping out the eight core criteria that determined scholarship eligibility — age, location, major, GPA, race, gender, field of study, and financial need. 

“That became the foundation of Scholly’s matching algorithm,” he said.  

During his senior year, Gray, alongside Nick Pirollo and Bryson Alef, whom he met as Coca-Cola Scholars, officially launched Scholly in 2013. For just $0.99 a month, students could use the platform and filter by eligibility criteria. “That price kept the business sustainable without having to sell data or run ads,” he said.  

Scholly switched to a freemium model after Gray pitched the idea on Shark Tank. The sharks clamored over his idea in what became the “worst fight in Shark Tank history,” according to one of the hosts who invested. Scholly grew to 5 million users and made more than $30 million in cumulative revenue, Gray said. 

In March of 2023, Sallie Mae’s corporate development team reached out to Scholly. The bank had just bought the scholarship organization Nitro College a year prior and was trying to move more into the scholarship and college-planning space. “It was a natural fit,” Gray said, of why the student loan institution wanted Scholly.  

Sallie Mae bought Scholly in July 2023, brought Gray and his co-founders on board as employees, and made Gray a vice president of product management. 

In addition to promising that it would “make Scholly free for all students, families, and other users,” Sallie Mae CEO Jon Witter said in 2023 that the acquisition “allows us to harness and build on Scholly’s innovative technology to unlock future strategic growth opportunities.” 

Sallie Mae vs. “Sallie” 

For Gray, the canary in the coal mine came one year after Scholly’s acquisition.  

He alleges in the suit that Sallie Mae laid off the Scholly founding team, including his co-founders, in July 2024. Around this same time, Gray claims he heard Sallie Mae executives discuss plans for selling Scholly user data in meetings.  

Gray alleges executives told him his position was safe, and that the company was just restructuring. But when he went on to raise further concerns about the possible selling of Scholly data, he claims in his suit he was fired before a scheduled meeting with Witter, the CEO, where he planned to discuss those issues.  

After his departure, around December 2024, Sallie Mae launched “Sallie.com.” This website describes itself as an “education solutions company,” and became home to the Scholly platform. It is separate from the website for Sallie Mae, which is home to the bank that makes student loans. 

The Sallie.com website says it’s owned by an entity called SLM Education Services, LLC. Gray contends in his lawsuit and whistleblower complaint that Sallie Mae is using SLM Education Services in order to sell the personal data collected by Scholly, since it is not a closely regulated financial services company like the Sallie Mae banking arm. 

Sallie.com discloses that it sells the following customer data in its privacy policy to third parties: name, phone number, email addresses, age, race, gender, education records, and geolocation data. The third parties it sells this information to, it says, include ad networks, educational institutions, brands, and companies dedicated to reselling consumer data.  

Sallie Mae also pays Sallie “for the referrral of student loan customers,” according to the Sallie.com “About” page. 

Gray argues in his complaints that the Sallie.com website may be easily confused with the official Sallie Mae website because of similar layouts and “sallie” logos, increasing the risk that students may hand over personal data to what they believe to be a bank.  

Gray’s suit goes on to allege that Sallie Mae used Scholly user data to create something called Backpack Media in March, which it bills as a “first-to-market education media network” that “offers brands efficient, scalable access to highly desirable, hard to reach audiences – Gen Z, Gen Alpha, and those involved in their purchasing decisions,” according to a Sallie press release.  

Castellano declined to comment on Backpack Media’s sources for data.

This would not be the first time a Salle Mae-affiliated company has been accused of deceptive or misleading behavior.  

A company called Navient, which split from Sallie Mae in 2014, has faced restitution orders from the Federal Deposit Insurance Corporation, Department of Justice, and the Department of Education for overcharges. It was sued by the Consumer Financial Protection Bureau and reached a $1.85 billion settlement with 39 attorneys general for over what the attorneys general described as predatory student loans.  

Gray said he knew of these past legal issues, but that he doesn’t regret the sale of Scholly as it helped make the platform free for every student. In fact, he said if he could, he would make the same decision to sell all over again. 

“But I’d also raise the same concerns again,” he said. “Because I believe we should live in a system where an executive can speak up and change the course of a company in line with the law and fair business practices.”

Apple’s recent crackdown on vibe-coding apps hasn’t held up Lovable’s launch of its no-code AI app builder, which is now available as a mobile app on Apple’s and Google’s app stores.

The vibe-coding startup’s new mobile app is being pitched to would-be app builders as a way to code on the go via voice or text AI prompts that let you capture your ideas as they pop into your head. That means you can kick off Lovable to work on your random app idea from anywhere, letting its agent run autonomously after receiving your input.

The new app will also allow you to switch back and forth between your computer and phone to pick up where you left off on a given project and receive notifications when a build is ready for review.

The app’s arrival comes shortly after Apple addressed what vibe-coding apps can and can’t do on its App Store. The tech giant recently blocked updates to popular vibe-coding tools, including Replit and Vibecode, for violations of its developer guidelines.

Simply put, Apple wasn’t banning vibe-coding apps themselves, but it won’t allow apps that download new code or change their functionality, as that presents a security risk to end users. (It also means that Apple’s App Review team can’t properly vet the app during the approval process.)

Apple also temporarily removed the vibe-coding app Anything from the App Store for similar reasons, but the app returned after making changes earlier this month.  

To comply with Apple’s rules, the vibe-coding apps are no longer able to run their generated apps inside the host app. Instead, those app previews were moved to web browsers.

Lovable has also seemingly complied with these rules as its new app touts the ability to turn ideas into “working websites or web apps.”

The U.S. Supreme Court on Monday heard arguments in a landmark legal case that could redefine digital privacy rights for people across the United States.

The case, Chatrie v. United States, centers on the government’s controversial use of so-called “geofence” search warrants. Law enforcement and federal agents use these warrants to compel tech companies, like Google, to turn over information about which of its billions of users were in a certain place and time based on their phone’s location.

By casting a wide net over a tech company’s stores of users’ location data, investigators can reverse-engineer who was at the scene of a crime, effectively allowing police to identify criminal suspects akin to finding a needle in a digital haystack.

But civil liberties advocates have long argued that geofence warrants are inherently overbroad and unconstitutional as they return information about people who are nearby yet have no connection to an alleged incident. In several cases over recent years, geofence warrants have ensnared innocent people who were coincidentally nearby and whose personal information was demanded anyway, been incorrectly filed to collect data far outside of their intended scope, and used to identify individuals who attended protests or other legal assembly.

The use of geofence warrants has seen a surge in popularity among law enforcement circles over the last decade, with a New York Times investigation finding the practice first used by federal agents in 2016. Each year since 2018, federal agencies and police departments around the U.S. have filed thousands of geofence warrants, representing a significant proportion of legal demands received by tech companies like Google, which store vast banks of location data collected from user searches, maps, and Android devices.

Chatrie is the first major Fourth Amendment case that the U.S. top court has considered this decade. The decision could decide whether geofence warrants are legal. Much of the case rests on whether people in the U.S. have a “reasonable expectation” of privacy over information collected by tech giants, like location data.

It’s not yet clear how the nine justices of the Supreme Court will vote — a decision is expected later this year — or whether the court would outright order the stop to the controversial practice. But arguments heard before the court on Monday give some insight into how the justices might rule on the case. 

“Search first and develop suspicions later“

The case focuses on Okello Chatrie, a Virginia man convicted of a 2019 bank robbery. Police at the time saw a suspect on the bank’s security footage speaking on a cellphone. Investigators then served a “geofence” search warrant to Google, demanding that the company provide information about all of the phones that were located within a short radius of the bank and within an hour of the robbery. 

In practice, law enforcement are able to draw a shape on a map around a crime scene or another place of significance, and demand to sift through large amounts of location data from Google’s databases to pinpoint anyone who was there at a given point in time.

In response to the geofence warrant, Google provided reams of anonymized location data belonging to its account holders who were located in the area at the time of the robbery, then investigators asked for more information about some of the accounts who were near the bank for several hours prior to the job. 

Police then received the names and associated information of three account holders — one of which they identified as Chatrie.

Chatrie eventually pleaded guilty and received a sentence of more than 11 years in prison. But as his case progressed through the courts, his legal team argued that the evidence obtained through the geofence warrant, which allegedly linked him to the crime scene, shouldn’t have been used.

A key point in Chatrie’s case invokes an argument that privacy advocates have often used to justify the unconstitutionality of geofence warrants.

The geofence warrant “allowed the government to search first and develop suspicions later,” they argue, adding that it goes against the long-standing principles of the Fourth Amendment that puts guardrails in place to protect against unreasonable searches and seizures, including of people’s data.

As the Supreme Court-watching site SCOTUSblog points out, one of the lower courts agreed that the geofence warrant had not established the prerequisite “probable cause” linking Chatrie to the bank robbery justifying the geofence warrant to begin with. 

The argument posed that the warrant was too general by not describing the specific account that contained the data investigators were after.

But the court allowed the evidence to be used in the case against Chatrie anyway because it determined law enforcement acted in good faith in obtaining the warrant.

According to a blog post by civil liberties attorney Jennifer Stisa Granick, an amicus brief filed by a coalition of security researchers and technologists presented the court with the “most interesting and important” argument to help guide its eventual decision. The brief argues that this geofence warrant in Chatrie’s case was unconstitutional because it ordered Google to actively rifle through the data stored in the individual accounts of hundreds of millions of Google users for the information that police were looking for, a practice incompatible with the Fourth Amendment.

The government, however, has largely contended that Chatrie “affirmatively opted to allow Google to collect, store, and use” his location data and that the warrant “simply directed Google to locate and turn over the necessary information.” The U.S. solicitor general, D. John Sauer, arguing for the government prior to Monday’s hearing, said that Chatrie’s “arguments seem to imply that no geofence warrant, of any sort, could ever be executed.”

Following a split-court on appeal. Chatrie’s lawyers asked the U.S. top court to take up the case to decide whether geofence warrants are constitutional.

Justices appear mixed after hearing arguments

While the case is unlikely to affect Chatrie’s sentence, the Supreme Court’s ruling could have broader implications for Americans’ privacy.

Following livestreamed oral arguments between Chatrie’s lawyers and the U.S. government in Washington on Monday, the court’s nine justices appeared largely split on whether to outright ban the use of geofence warrants, though the justices may find a way to narrow how the warrants are used.

Orin Kerr, a law professor at the University of California, Berkeley, whose expertise includes Fourth Amendment law, said in a lengthy social media post that the court was “likely to reject” Chatrie’s arguments about the lawfulness of the warrant, and would likely allow law enforcement to continue using geofence warrants, so long as they are limited in scope.

Cathy Gellis, a lawyer who writes at Techdirt, said in a post that it appeared the court “likes geofence warrants but there may be hesitance to fully get rid of them.” Gellis’ analysis anticipated “baby steps, not big rules” in the court’s final decision.

Although the case focuses much on a search of Google’s location databases, the implications reach far beyond Google but for any company that collects and stores location data. Google eventually moved to store its users’ location data on their devices rather than on its servers where law enforcement could request it. The company stopped responding to geofence warrant requests last year as a result, according to The New York Times.

The same can’t be said for other tech companies that store their customers’ location data on their servers, and within arm’s reach of law enforcement. Microsoft, Yahoo, Uber, Snap, and others have been served geofence warrants in the past.