Privacy Policy

Last updated: July 12, 2026

LearnPath ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our platform at learnwithpath.com ("Service"). LearnPath uses AI to curate free YouTube videos into structured learning paths and to generate exercises, summaries, and personalized recommendations.

1. Data We Collect

Information you provide:

• Account data: email address, display name, avatar selection, password (hashed).
• Learning preferences: topics of interest, preferred session length, skill level, learning style, preferred YouTube creators.
• User-generated content: notes you create on videos, feature suggestions, and other content you submit.

Information generated through use:

• Learning activity: exercise scores and answers (quizzes, fill-in-the-blank, flashcards, concept matching, sequencing, true/false), video completion status.
• Progress data: XP points, level, streak days, and spaced repetition review history.
• Certificates: earned upon completing learning paths.
• Leaderboard data: display name, avatar, XP total, level (publicly visible).
• Public learning path data: learning paths are public by default. A path's topic, node titles, progress percentage, and your display name may be publicly visible in our discovery directory and on individual path pages, and are accessible to anyone, including search engines. Other registered Pro users can clone (copy) the structure of a public path to their own accounts. You can opt a path out of this by enabling Private mode in your Settings. Your private notes, exercise answers, and email address are never made public. If you delete your account, your original paths are deleted, but copies already cloned by other users remain with their owners.
• Referral data: referral code and referral count (if you use the referral program).
• Subscription data: your plan (Free or Pro), billing period, and cancellation status. Payment card details are handled by Airwallex and are never stored by us.

Information collected automatically:

• Authentication data: session tokens managed by Supabase Auth to keep you signed in.
• Cookie preferences: your consent choices for optional cookies.
• Product analytics: pages viewed and in-app actions, collected in a privacy-preserving way as described in Section 4.
• Technical and error data: IP address, browser and operating system metadata, and server logs, used to deliver the Service, diagnose crashes, and prevent abuse.

2. How We Use Your Data

• Provide the Service: personalize learning paths, generate exercises and summaries, and track your progress.
• Improve the Service: analyze usage patterns to improve recommendations and features.
• Communicate: send account-related and transactional emails (such as receipts and important notices), and, if you have not opted out, marketing emails such as welcome messages, learning tips, and win-back reminders. Every marketing email includes a one-click unsubscribe link, and you can opt out of marketing at any time.
• Leaderboard: display your display name, avatar, level, and XP on the public leaderboard.
• Discovery and social learning: display public learning paths in our topic discovery directory, rank topics by popularity, and allow other users to clone path structures to accelerate their own learning.
• Secure the Service: monitor for errors, diagnose crashes, and prevent fraud and abuse.

3. Legal Basis for Processing (GDPR)

• Contract: processing necessary to provide the Service you signed up for, including your account, learning paths, and subscription.
• Consent: optional analytics cookies, session replay, and marketing emails - carried out only with your consent, which you can withdraw at any time.
• Legitimate interest: error monitoring, securing the Service, and preventing abuse.

4. Third-Party Services

We share data with the following processors and service providers to operate the Service:

• Supabase (database and authentication) - stores your account data, learning progress, and notes, and manages your sign-in session. Supabase Privacy Policy
• Google / YouTube (video content) - the Service uses YouTube API Services to search for and display videos, and embeds the YouTube player. By using the Service you agree to the YouTube Terms of Service. Your interaction with embedded YouTube players and the YouTube API is also subject to Google's Privacy Policy.
• Third-party AI service providers (content generation) - video transcripts, along with topic and level inputs, are sent to our AI providers to generate exercises, summaries, and learning recommendations. No account-identifying information (such as your name or email address) is included in these AI requests.
• PostHog (product analytics) - measures how the Service is used. We proxy analytics through our own domain (learnwithpath.com/ingest) so it is served first-party. For anonymous visitors, analytics runs in cookieless memory mode - no cookies or device storage are used - until you accept analytics cookies. After you accept, PostHog stores identifiers on your device for up to one year. Person profiles are created only for signed-in users. PostHog Privacy Policy
• Session replay - for signed-in users who have accepted analytics cookies, PostHog may record a replay of the interface to help us diagnose issues and improve usability. Sensitive inputs, such as passwords, are masked by the recorder and are not captured. This does not run for anonymous visitors or without analytics consent.
• Sentry (error monitoring) - collects error reports, including your IP address and browser and operating system metadata, so we can diagnose crashes. Sentry does not set tracking cookies. Sentry Privacy Policy
• Resend (email delivery) - sends transactional emails (such as account notices and receipts) and marketing emails (such as welcome messages, tips, and win-back reminders). Marketing emails always include a one-click unsubscribe link. Resend Privacy Policy
• Vercel (frontend hosting and CDN) and Fly.io (backend API hosting) - serve the Service and keep standard server logs, which include IP addresses. Data may be processed in the United States.

Payment Processing - Airwallex

• We use Airwallex as our payment processor for subscription payments.
• When you subscribe to Pro, Airwallex processes your payment card details. Your card details never touch LearnPath servers.
• Airwallex may collect: name, email, payment card information, and billing address.
• LearnPath does NOT store your payment card details - this is handled entirely by Airwallex, which is PCI DSS compliant.
• Airwallex's privacy policy: https://www.airwallex.com/privacy

5. Cookies

We use cookies and similar storage as described in our Cookie Policy. Analytics runs cookieless until you accept analytics cookies in the banner, and no marketing or advertising cookies are currently set. You can manage your cookie preferences at any time through the cookie settings link in the footer.

6. Data Retention

• Active accounts: data is retained as long as your account is active.
• Deleted accounts: when you delete your account in Settings, your data is deleted immediately.
• Backups: data may persist in encrypted backups for up to 30 days after deletion.

7. Your Rights (GDPR)

If you are in the European Economic Area (EEA), you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data ("right to be forgotten").
• Portability: request your data in a machine-readable format.
• Objection: object to processing based on legitimate interest.
• Restriction: request that we limit processing of your data.
• Withdraw consent: withdraw consent for analytics, session replay, or marketing at any time, without affecting processing carried out before withdrawal.
• Lodge a complaint: lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at support@learnwithpath.com or use the account deletion feature in your Settings.

8. Your Rights (CCPA)

If you are a California resident, you have the right to:

• Know: what personal information we collect and how it is used.
• Delete: request deletion of your personal information.
• Opt-out: opt out of the sale of personal information. We do not sell your personal information.
• Non-discrimination: we will not discriminate against you for exercising your rights.

9. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS), hashed passwords, Row Level Security (RLS) on all database tables, and JWT-based authentication. However, no method of transmission over the Internet is 100% secure.

10. International Transfers

Your data may be processed in countries outside your own, including the United States, where several of our processors operate. We ensure appropriate safeguards are in place, including standard contractual clauses where required by GDPR.

11. Children's Privacy

LearnPath is not intended for children under 13 years of age (or under 16 in the European Union). We do not knowingly collect personal information from children under these age thresholds. If you are under 13 (or 16 in the EU), please do not create an account or submit any personal data to us.

Users between 13 and 18 years of age (or 16 and 18 in the EU) may use the Service with the consent and supervision of a parent or legal guardian. The parent or guardian is responsible for monitoring the minor's use of the Service.

If you are a parent or guardian and believe your child has created an account or provided personal data without your consent, please contact us at support@learnwithpath.com and we will promptly delete the account and associated data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notification. The "Last updated" date at the top reflects the most recent revision.

13. Governing Law

This Privacy Policy is governed by the laws of the State of Israel, without regard to its conflict of law provisions.

14. Contact

For privacy-related questions or requests, contact us at support@learnwithpath.com.