Privacy Policy

1. Information We Collect

When you use HiPath AI, we collect the following types of information:

• Account information: Your email address, display name, and avatar image when you sign up or sign in via Google OAuth.
• Learning progress: Your roadmap goals, quiz attempts, lesson completions, spaced repetition review data, skill scores, and project submissions. This data is core to providing you with personalized learning recommendations.
• Usage data: AI mentor conversations, tutor chat history, feature interactions, and page visits. This helps us improve the learning experience.
• Payment data: If you subscribe to Pro, your payment is processed by Stripe. We do not store or process credit card details — Stripe handles all payment information.
• Device and browser data: Basic technical data such as browser type, operating system, and IP address for security and analytics purposes.

2. How We Use Your Data

• To generate and adapt your personalized learning roadmap
• To provide AI-powered tutoring, mentoring, and coaching suggestions
• To track your learning progress and recommend review material via spaced repetition
• To communicate important updates, such as password resets or subscription changes
• To improve our AI models and refine the learning algorithms (in aggregate, never individually)
• To detect and prevent abuse of our services

3. Third-Party Services We Use

HiPath AI relies on several trusted third-party services to operate:

• Supabase — Authentication, database (PostgreSQL), and file storage for avatars.
• Stripe — Payment processing for Pro subscriptions. See their privacy policy at stripe.com/privacy.
• OpenAI / NVIDIA — AI model providers for roadmap generation, tutoring, and coaching. Queries are processed by their APIs but not used for model training.
• Resend — Transactional email delivery (welcome emails, password resets, notifications).
• Upstash — Redis-based rate limiting to protect our API from abuse.
• Sentry — Error tracking and performance monitoring to help us identify and fix bugs.
• Vercel — Hosting and deployment platform.

4. Data Retention

We retain your account data for as long as you maintain an active account. If you delete your account, your profile is immediately anonymized, and all associated learning data (roadmaps, quiz attempts, reviews, conversations) is permanently removed after a 30-day grace period. You can sign back in within those 30 days to cancel the deletion.

5. Your Rights

• Access: You can view and edit your profile data at any time from your Settings page.
• Export: You can request a full export of your data from the Settings page. We will provide it in JSON format.
• Deletion: You can delete your account and all associated data from the Settings page.
• Correction: You can update your profile information, email, and display name at any time.

6. Data Security

We implement industry-standard security measures, including encryption in transit (TLS) and at rest, Row-Level Security (RLS) policies on our database, and signed API requests. We never log or expose your credentials, API keys, or personal access tokens.

7. Children's Privacy

HiPath AI is not intended for users under the age of 13. We do not knowingly collect personal information from children. If we learn that a child under 13 has created an account, we will delete it promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the application. Your continued use of HiPath AI after changes constitutes acceptance of the updated policy.

9. Contact

If you have questions about this Privacy Policy or your data, please contact us at privacy@hipath.ai.