Draft privacy policy

Who is responsible?

[Responsible person or organisation] operates Path and is the data controller. Contact: Ian.gopath@gmail.com. The responsible person or organisation must be confirmed before this policy is finalised.

What information we collect

For an account, Path collects your email, first name, age, language, life stage and onboarding answers. Your private conversations, personal memories, evidence, reflections, experiments and chosen directions are stored to support your journey. Passwords are handled by the authentication service, not displayed to Path.

Why we use your information

We use your information to provide your account, personalise questions, save your progress and keep the service secure. We do not sell your data or use it for advertising. The owner must confirm the legal basis for each purpose, including service delivery, security and any optional consent, before finalising this policy.

AI processing and service providers

Path sends conversations and relevant profile context to Lovable AI Gateway, currently configured to use an OpenAI model. Lovable Cloud supports accounts and storage. Stripe processes optional donations when live payments are available; Path does not store card numbers.

AI requests ask the provider not to store responses, but this is not a guarantee about provider logs, training or retention. Provider agreements, exact model routing, subprocessors, processing locations and any safeguards for transfers outside the EEA still need owner verification.

Public chat and browser storage

Try Path keeps your guest conversation and first Blueprint in your browser until you explicitly save them privately to your account. Each question, final reflection and correction sends the current session history to Lovable AI. A secret-hashed network or signed-cookie identifier, signed session grant and service-only counters allow two guest sessions per 24 hours, at most 12 user messages per session, one final generation with one malformed-output repair, and up to six item corrections within the message limit. Expired counters are removed on later session claims. Counters store no conversation text. Shared images include only broad categories, not answers or personal details. Clear the guest session to remove its local draft. Path does not deliberately log guest text; hosting and AI-service logs and retention still require owner verification.

The public Nod chat does not retrieve your private memories. Its chat history and your language choice are saved in your browser. Clear chat removes that browser history. Messages are still sent to the AI service when you submit them.

Path’s funnel measurement stores only daily totals for hero clicks, demo starts, completed reflections, accounts created and share clicks. It uses no analytics cookies, visitor identifiers, IP addresses, answers, names, emails or page URLs. Browser tracking respects Do Not Track and Global Privacy Control. Account totals are counted when a new account record is created, not when an existing user signs in. Totals older than 90 days are removed on the next counted event. Separate hosting and security logs may still exist.

How long information is kept

Private conversations and journey data currently remain stored until you delete them or request deletion; no automatic expiry is configured. Deleting a conversation removes its messages but does not remove separate memories. Forgetting a memory removes its evidence and excludes it from future personalisation, while a minimal forgotten record remains to prevent old information returning.

Account deletion is not yet available as a self-service button. Request it through the Contact page. The owner must set retention periods for inactive accounts, contact messages, payment records, logs and backups and confirm when deleted data disappears from backups.

Your GDPR rights

You can request access to your data, correction, deletion, restriction of processing and, where applicable, data portability or object to processing. If processing relies on consent, you can withdraw it. We may need to verify your identity. Requests should normally receive a response within one month; lawful extensions and exceptions may apply.

You can complain to the Swedish Authority for Privacy Protection (IMY), or your local supervisory authority.

Age limits and guardians

Path is for ages 13 and over. Ages 13–17 should discuss using Path with a guardian. Where law requires guardian consent, obtain it before using the service. Sweden’s consent age for consent-based online services is 13; other countries may have a higher threshold. Path does not currently verify guardian consent. Age alone does not determine your goals or life stage.

Security and your choices

Private records are restricted to their account owner. No system is perfectly secure. Use a strong password, do not share account access and avoid sending sensitive information about yourself or others. You can review and correct memories in your account and delete individual conversations.

Changes and questions

This draft describes the current implementation and its unresolved details. Material changes will be explained on this page. Use the Contact page for questions or requests about your data.