Privacy Policy

HiPath AI (“we”, “our”) is a personalized AI learning platform at hipathai.me. This policy explains what personal data we collect when you use HiPath AI, why we collect it, who we share it with, how long we keep it, and the choices you have. If you do not agree with this policy, please do not use the service.

1. Data we collect

Account data (via Clerk, our auth provider). When you sign up or sign in — including with Google Sign-In — we receive your Clerk user ID, name, email address, and profile picture. Google Sign-In shares only your basic profile (name, email, avatar) under standard OpenID scopes; we use it solely to create and secure your account, never for advertising.

Learning profile. Your onboarding answers: learning goal, current level, daily study time, schedule duration, motivation, and learning-style preferences.

Learning content and activity. Your generated roadmaps, phases, and lessons; lesson content; quiz questions, your answers, scores, and attempts; study progress and completion state; weak topics detected from quiz performance; spaced-repetition review schedule; daily study activity and minutes studied; gamification state (XP, level, streaks).

Tutor conversations. Messages you send to the AI tutor and its replies, stored so your mentor remembers context across sessions.

Preferences and support. Notification and appearance settings, account-deletion and data-export requests, and messages you send via the contact page.

Technical data. Authentication session cookies (Clerk), theme preference, on-device cache of your roadmap and drafts (browser localStorage), and standard server logs (IP address, pages visited, timestamps) used for security and debugging. When enabled, privacy-friendly product analytics (page views, feature funnels) help us improve the app.

We do not collect payment data (the service is free), precise location, contacts, or biometric data.

2. How we use your data

• Operate your account: sign-in, session security, and identifying your data.
• Generate your learning: roadmaps, lesson content, quizzes, and tutor replies are produced by our AI provider from your goal, level, and lesson content — never from your password or payment details (we hold neither).
• Personalize and adapt: weakness detection, spaced reviews, difficulty adaptation, and streak reminders use your activity history.
• Communicate: at most one streak-reminder email per day when enabled (opt out anytime in Settings).
• Improve and secure: aggregated analytics, error logs, and abuse prevention.

We do not sell your personal data and do not use it for third-party advertising.

3. Who we share data with (subprocessors)

We share data only as needed to run the service, under contracts that limit use to our instructions:

• Clerk — authentication and account data.
• Supabase — secure cloud database storing your account, learning data, and chats (row-level security; server-only service access).
• AI models — receives learning prompts (goals, lesson topics, quiz content) to generate roadmaps, lessons, quizzes, and tutor replies.
• Inngest — background job processing for generation and reminders.
• Vercel — hosting and delivery of the application.
• Resend — transactional and reminder emails.
• PostHog — product analytics (only active when configured).

We disclose data when required by law or to protect the safety, rights, or property of our users and the service.

4. Data retention and deletion

We keep your data while your account is active. You can export everything anytime via Settings → Download my data (JSON), and permanently delete your account — including profile, roadmaps, progress, chats, and streaks — via Settings → Delete account. Backups expire on their normal cycle after deletion. Server and analytics logs are retained for up to 12 months for security and debugging.

5. Your rights and choices

Depending on your region (including GDPR/UK GDPR and CCPA/CPRA rights), you may request access, correction, export, restriction, or deletion of your personal data, and may opt out of reminder emails in Settings. Contact us (below) and we will respond within 30 days. Withdrawing consent for core account data means closing your account, since the service cannot function without it.

6. Security

Traffic is encrypted in transit (HTTPS); database access is gated by row-level security plus server-only credentials; authentication sessions are managed by Clerk. No method is 100% secure, and you are responsible for keeping your sign-in credentials confidential.

7. Children

HiPath AI is not directed at children under 13, and we do not knowingly collect their data. If you believe a child provided data, contact us and we will delete it.

8. Cookies and local storage

We use essential cookies for sign-in sessions (Clerk) and remember preferences such as theme. Your browser's local storage keeps a cache of your roadmap and drafts for speed and offline reading. See our Cookie Policy for details and controls.

9. International transfers

Our subprocessors operate primarily in the US and EU. By using HiPath AI you consent to processing in these regions with appropriate contractual safeguards.

10. Changes to this policy

We will update the date above and, for material changes, notify you in-app or by email before they take effect.

11. Contact

Questions, access/deletion requests, or complaints: contact us or email privacy@hipathai.me. You also have the right to complain to your local data-protection authority.