Privacy Policy

1.Who we are

Pathly AI (“Pathly”, “we”, “us”) is a guidance and planning service that helps young people discover what they want to do and turn it into a roadmap, daily priorities and coaching.

For users in the European Union, Pathly is the data controller for the personal data described in this policy. Legal entity name and address: [to be added before launch].

Contact for privacy questions and requests: [contact email to be added before launch].

2.What we collect

We collect only what we need to run Pathly for you:

• Account information: your first name, email address, password (stored only as a secure hash) or Google sign-in identifier, language, time zone, and confirmation that you are 13 or older.
• Onboarding answers: what you tell us about your interests, strengths, values, situation (such as country, age or birth year, education level, available time and budget) and the scenarios you respond to.
• Goals and progress: the directions you explore, goals, roadmaps, milestones, tasks, experiments, weekly reviews and the progress you record.
• Coach messages and workspace content: your conversations with the AI coach and the drafts, plans, checklists and summaries you create.
• Subscription and payment records (paid plans only): your plan, billing period, payment status, amounts and dates. Payments are processed by Whop; Pathly never receives or stores your card number.
• Technical and security data: session cookies that keep you signed in, and limited security logs such as sign-in attempts, used to protect your account.
• Optional usage analytics: limited first-party events about how features are used (for example, that a page was opened). These events are stored in our own database, contain no free-text personal content, and are used only to improve Pathly. We don't use third-party advertising or tracking scripts.

3.Why we use it

We use your information to:

• Provide the service: create your account, run onboarding, generate your discovery summary, build and adapt your roadmap, and power the AI coach (performance of our contract with you).
• Send service emails: account verification, password resets and, if you choose, reminders and summaries. You can change email preferences in Settings.
• Keep Pathly secure: prevent abuse, fraud and unauthorized access (our legitimate interest in protecting users and the service).
• Improve Pathly: understand which features help, using limited usage analytics (our legitimate interest, or your consent where the law requires it).
• Meet legal obligations, such as responding to lawful requests.

4.How AI processing works

When you use the AI coach or the workspace, your message and the relevant context (for example, your goals, your roadmap and related onboarding answers) are sent to our configured AI provider only to generate a response for you.

Your data is never used for advertising. Our AI provider is Anthropic; under its commercial terms, content sent through its API is not used to train its models.

AI responses can be wrong, incomplete or out of date. Pathly does not use AI to make decisions about you that have legal or similarly significant effects. You decide what to act on.

5.What we never do

• We do not sell your personal data.
• We do not build advertising profiles or show you targeted ads.
• We do not share your personal data with advertisers or data brokers.

6.Who we share data with

We share personal data only with service providers that help us run Pathly, such as hosting and database providers, an email delivery provider and our AI provider. They may process data only on our instructions and under contracts that require them to protect it. Our providers are: Vercel (hosting), Neon (database), Whop (subscriptions and payments), Anthropic (AI features), Resend (email delivery) and Google (only if you choose to sign in with Google).

We may also disclose information if required by law, to protect someone's safety, or as part of a merger or acquisition, in which case this policy would continue to apply to your data.

7.Age requirements and minors

You must be at least 13 years old to use Pathly. Pathly is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that an account belongs to a child under 13, we will delete it.

Many of our users are under 18, so we take extra care: we collect only what's needed, show no ads, and keep the tone supportive. If you're under 18, we encourage you to involve a parent or guardian in important decisions and to talk with them about how you use Pathly.

Parents and guardians can contact us at [contact email to be added before launch] with questions or to ask us to access or delete a minor's data.

8.Your rights and choices

Depending on where you live, you have the right to:

• Access the personal data we hold about you.
• Export your data in a portable format. Export is available in Settings.
• Correct inaccurate information. Most of it can be edited directly in the app.
• Delete your account and personal data. Deletion is available in Settings.
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.
• Choose which emails and reminders you receive.

9.How long we keep data

We keep your data while your account is active. When you delete your account, we delete or anonymize your personal data within a limited period, except where we must keep certain records for legal, security or fraud-prevention reasons. Exact retention periods will be specified here before launch.

Backups are kept for a limited time and are overwritten on a rolling basis.

10.Security

We use reasonable technical and organizational measures to protect your data, including:

• Encryption in transit (HTTPS) for all connections.
• Passwords stored only as salted hashes, never in plain text.
• Session tokens stored in hashed form, and rate limiting on sign-in and other sensitive actions.
• Access to personal data limited to people who need it to run the service.

11.International transfers

Our service providers may process data in the United States and other countries. When personal data from the European Union is transferred outside it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

12.Notes for users in the United States

Children's privacy (COPPA): Pathly is not directed to children under 13 and requires users to confirm they are at least 13. If you believe a child under 13 has given us personal information, contact us and we will delete it.

State privacy laws: we do not sell personal information or share it for cross-context behavioral advertising. Residents of states with privacy laws (such as California) can exercise their rights using the options in this policy.

13.Notes for users in the European Union and France

Under the GDPR, we process your data on the legal bases described above: performance of our contract with you, our legitimate interests, your consent where required, and legal obligations.

In France, where processing is based on consent, users under 15 need the joint consent of a parent or guardian. How this applies to Pathly will be confirmed before launch.

You have the right to lodge a complaint with your data protection authority. In France, this is the CNIL (Commission nationale de l'informatique et des libertés).

14.Cookies and local storage

We use a small number of first-party cookies: a session cookie to keep you signed in, a cookie that remembers your language, and — if you start discovery without an account — a cookie that links your answers to your browser so you don't lose them (they move into your account when you sign up, and unclaimed answers are deleted after 30 days; nothing is kept if you're under 13). To measure how many people complete each step (anonymous counts only), we also set a random identifier that contains nothing about you; we don't record your answers, IP address or device details with it, we don't do it for question-level events if you're under 18, we skip it entirely if your browser sends Global Privacy Control, and these events are deleted after 13 months. Your light or dark theme preference is stored in your browser's local storage. We don't use advertising or third-party tracking cookies.

15.Changes to this policy

We may update this policy as Pathly evolves. If we make significant changes, we will let you know in the app or by email before they take effect. The date at the top shows when it was last updated.

16.Contact

Questions or requests about your privacy: [contact email to be added before launch].