Privacy Notice

This notice explains what personal data Pathforge collects, why we collect it, who we share it with, and the rights you have over it. Our users are mostly teenagers, so we have tried to write this plainly. If anything is unclear, email us and we will explain it.

1. Who We Are

Pathforge ("Pathforge", "we", "us", or "our") operates the Pathforge platform at pathforge.co.in. We act as the data controller for personal data collected through the Service. You can reach us at pathforge.co@gmail.com for any privacy question or request.

2. The Short Version

• We collect what we need to run your account and generate your guidance — no more.
• We do not sell your personal data, and we never have. We do not share it for cross-context behavioural advertising.
• Your content is not used to train third-party AI models. Our AI providers process your prompts to return a response and are contractually barred from training on them.
• You can export or delete your data at any time from your account settings.
• Payments are handled by Paddle — we never see or store your card number.

3. Personal Data We Collect

• Account data: name, email address, avatar, password (stored only as a salted hash), and the identifier returned by Google or GitHub if you sign in that way.
• Profile & onboarding data: grade, curriculum, GPA range, country, intended major, target universities, interests, and weekly study hours.
• Application content: essays, activity descriptions, resumes and LinkedIn exports, report cards and transcripts, and any other text or document you upload.
• AI interaction data: your chat and advisor prompts, the responses returned, and the credit consumed. Voice advisor sessions are transcribed to text so the model can respond; we retain the transcript with your conversation, not a recording of your voice.
• Progress data: Journey and quest progress, streaks, scores, your study planner and Routine entries (tasks, study blocks, reminders, habits, goals, timetable), reflections, and evaluation history.
• Communications data: direct messages, group and team chat content, reactions, pins, and files you send through Chats or Teams, plus the objectives and announcements created there.
• Recommender & counsellor data: the names and email addresses of teachers, professors, or counsellors you ask us to contact on your behalf, plus the content of what they submit through the recommender portal.
• Connected-account data: if you connect Google Calendar or GitHub, the access tokens and the specific data those integrations need (calendar events we create for you; public repository metadata you choose to import).
• Billing data: plan, subscription status, renewal date, transaction identifiers, and country for tax purposes. Card and bank details go directly to Paddle and are never stored by us.
• Support communications: messages you send through support, contact forms, or email.
• Usage & technical data: pages visited, features used, credit consumption, approximate location derived from IP, IP address, device and browser information, and error logs.
• Local storage: session tokens, preferences, theme, language, and onboarding state.

Please do not upload sensitive information you do not need us to have — for example medical records, government identity numbers, or financial statements. Our tools do not require them.

4. How We Use Personal Data, and Our Legal Basis

• To create and maintain your account, and to authenticate you — performance of our contract with you.
• To provide, personalise, and save your work across the platform — contract.
• To generate AI outputs from your inputs and to meter credit usage — contract.
• To process payments, renewals, and refunds through Paddle — contract and legal obligation.
• To contact recommenders and counsellors you have asked us to contact — contract and legitimate interests.
• To moderate content, detect fraud and abuse, enforce credit limits, and keep the Service secure — legitimate interests.
• To debug, monitor reliability, and improve existing features and build new ones — legitimate interests.
• To send service, security, and billing emails — contract.
• To send newsletters and marketing where you have opted in — consent, which you can withdraw at any time.
• To comply with law and to establish, exercise, or defend legal claims — legal obligation and legitimate interests.

5. AI Processing

When you use an AI feature, the relevant parts of your prompt and profile are sent to a large language model provider through our AI gateway so a response can be generated. Currently this includes models from Google (Gemini) and OpenAI (GPT), accessed via the Lovable AI Gateway.

• Your prompts and content are not used to train those providers' models.
• Providers may retain inputs briefly for abuse monitoring under their own enterprise terms, then delete them.
• We store your prompts and the outputs in your account so you can return to your work. You can delete individual items or your whole account.
• Prompts pass through an automated moderation step before processing, to block abusive or unsafe content.

6. Automated Scoring

Pathforge produces automated estimates — the College Readiness Score, Admissions Probability, Outcome Bands, and Journey Score — from the information you supply. These are informational and directional only. They do not determine access to any service, are not shared with universities or admissions bodies, and produce no legal or similarly significant effect on you. You can always see the inputs behind a score, change them, and re-run it, and you may contact us to ask how a result was produced.

7. Who We Share Personal Data With

We share personal data only with the categories below, and only as needed. We do not sell it.

• Lovable Cloud (Supabase) — application hosting, database, authentication, file storage, and serverless functions.
• Lovable AI Gateway, routing to Google and OpenAI — AI inference for advisor, essay, evaluation, and generation features.
• Paddle.com — Merchant of Record for all orders: payment processing, billing, invoicing, tax compliance, and refunds.
• Firecrawl — live web search and page retrieval for search-backed features. Your search query is sent; your profile is not.
• Google — sign-in, and Calendar access if you connect it.
• GitHub — sign-in, and repository metadata import if you connect it.
• Email delivery providers — transactional email such as verification, password reset, recommender requests, reminders, and newsletters.
• Your counsellor or teacher — if you connect to one, or join a class they administer, they can see your profile, progress, and submitted work. You can disconnect at any time.
• Other students you message or team up with — direct messages and team chats are visible to the other people in that conversation, by design. A counsellor connected to your team can see the team's metadata and an AI-generated activity summary, but has no way to read message content — there is no policy in our database that grants it, by design, not merely by convention.
• Recommenders you nominate — receive only the context needed to write and submit a letter for you.
• Professional advisers — legal, accounting, and compliance advisers, under confidentiality.
• Authorities — where required by valid legal process, or to protect rights, safety, or the integrity of the Service.
• A successor — in a merger, acquisition, or sale of assets, subject to this notice continuing to apply. We will notify you before your data becomes subject to a different policy.

8. Information About Other People

When you give us a teacher's, professor's, or counsellor's name and email so we can contact them for you, we use that information only for the request you initiated. We identify you as the requester, honour opt-outs and unsubscribes, and delete recommender contact details when the related request is withdrawn or your account is deleted. Please only nominate people you have a genuine reason to contact.

9. International Transfers

Personal data may be processed in countries other than your own, including the United States, the European Union, and India. Where personal data leaves a jurisdiction with transfer restrictions, we rely on appropriate safeguards — Standard Contractual Clauses, the UK Addendum, or an adequacy decision — and on our processors' own certified transfer mechanisms.

10. Retention

• Account and profile data — kept while your account is active.
• Your content and AI history — kept until you delete it or delete your account.
• Deleted accounts — deleted or irreversibly anonymised within 30 days, except where law requires retention.
• Backups — purged on our normal backup rotation, within 90 days.
• Billing and tax records — retained by Paddle and by us for the period required by applicable tax law, typically up to 7 years.
• Security, abuse, and moderation logs — retained up to 12 months.
• Support emails — retained up to 24 months.

11. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest at our hosting provider, Row-Level Security on every database table so one user cannot read another's rows, least-privilege server-side credentials, secrets held outside the codebase, signed webhooks, and access logging. No system is perfectly secure. If a breach affects your personal data and poses a risk to you, we will notify you and the relevant supervisory authority without undue delay and within the timeframes the law requires.

12. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy;
• Correct data that is inaccurate or incomplete;
• Delete your data ("right to be forgotten");
• Restrict or object to certain processing, including processing based on our legitimate interests;
• Receive data you provided in a portable, machine-readable format;
• Withdraw consent at any time, without affecting processing already carried out;
• Opt out of marketing at any time;
• Lodge a complaint with your local data protection authority.

Most of this is self-service: you can edit your profile, delete individual items, export your data, and delete your account from your settings. For anything else, email pathforge.co@gmail.com. We respond within one month and will never charge you or treat you differently for exercising a right.

India (DPDP Act)

If you are in India, you have the rights to access, correction, erasure, grievance redressal, and to nominate another person to exercise your rights in the event of death or incapacity. Grievances go to the same address above and we will acknowledge them promptly. Where you are a child under 18, we rely on verifiable parental or guardian consent, and we do not undertake tracking or behavioural advertising directed at children.

United States (California and other states)

We do not sell personal information and do not share it for cross-context behavioural advertising, including for anyone under 16. Residents of California and other states with comparable laws have rights to know, access, delete, correct, and to non-discrimination for exercising them. Use the same contact address to make a request; we will verify your identity through your account email before acting.

13. Children, Schools & Guardians

The Service is intended for high school students aged 13 and over. We do not knowingly collect personal data from children under 13; if we learn that we have, we delete it promptly. Users under the age of majority should have parental or guardian permission, and a parent or guardian may contact us to review, correct, or delete their child's data.

Where a school or counsellor organisation administers accounts, that institution decides which students are enrolled and is responsible for any notices or consents its own rules and local student-privacy laws require. We process student data on the institution's instructions for the educational purpose it selected, do not use it for advertising, and will return or delete it on request.

14. Local Storage

We use local storage for essential functionality — keeping you signed in, maintaining your session, remembering theme, language, and onboarding state, and protecting against abuse. These are never optional, since the Service cannot function without them. We do not use analytics or marketing cookies.

15. Changes to This Notice

We may update this notice from time to time. We will post the updated version here with a new "Last updated" date, and for material changes we will give notice by email or in-app before they take effect.

16. Contact

For privacy questions, requests, or complaints, contact pathforge.co@gmail.com or use our contact page. See also our Terms of Service, and Refund Policy.

← Back to home