Back to LearnPath
  • Terms of Service
  • Privacy Policy
  • Cookie Policy
  • Refund Policy
  • Accessibility

Legal

Privacy Policy

Last updated: October 6, 2026

LearnPath ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our platform at learnwithpath.com ("Service"). LearnPath uses AI to curate free YouTube videos into structured learning paths and to generate exercises, summaries, and personalized recommendations.

Who is responsible for your data (the "controller"): Shai Feldboy, an Israeli sole proprietor (osek patur), Kaplan 60, Kiryat Ono 5529360, Israel. Contact: support@learnwithpath.com.

1. Data We Collect

Information you provide:

  • Account data: email address, display name, avatar selection, password (hashed).
  • Learning preferences: topics of interest, preferred session length, skill level, learning style, preferred YouTube creators.
  • Goals and background you type: what you want to learn and why, what you already know, and any project you describe when you set up a path.
  • User-generated content: notes you create on videos, feature suggestions, and other content you submit.

Information generated through use:

  • Learning activity: exercise scores and answers (quizzes, fill-in-the-blank, flashcards, concept matching, sequencing, true/false, and written answers, with the AI feedback on them), video completion status.
  • Adaptive path data: the level you are on, the skills you have shown or marked for more practice, your taps such as "too easy" or "need more practice", and the number of tries on quizzes and level-ups.
  • Progress data: XP points, level, streak days, and spaced repetition review history.
  • Certificates: earned upon completing learning paths.
  • Leaderboard data: display name, avatar, XP total, level (publicly visible).
  • Public learning path data: learning paths are public by default. A path's topic, node titles, progress percentage, and your display name may be publicly visible in our discovery directory and on individual path pages, and are accessible to anyone, including search engines. Other registered Pro users can clone (copy) the structure of a public path to their own accounts. You can opt a path out of this by enabling Private mode in your Settings. Your private notes, exercise answers, and email address are never made public. If you delete your account, your original paths are deleted, but copies already cloned by other users remain with their owners.
  • Referral data: referral code and referral count (if you use the referral program).
  • Subscription data: your plan (Free or Pro), billing period, and cancellation status. Payment card details are handled by Airwallex and are never stored by us. If you start a free trial, we also keep the trial dates, your time zone (for the dates in our emails) and a one-way hash of a card identifier from Airwallex, so each card gets one free trial. We never see or store the card number.

Information collected automatically:

  • Authentication data: session tokens managed by Supabase Auth to keep you signed in.
  • Cookie preferences: your consent choices for optional cookies.
  • Product analytics: pages viewed and in-app actions, as described in Section 4.
  • Technical and error data: IP address, browser and operating system metadata, and server logs, used to deliver the Service, diagnose crashes, and prevent abuse.

2. How We Use Your Data

  • Provide the Service: personalize learning paths, generate exercises and summaries, and track your progress.
  • Improve the Service: analyze usage patterns to improve recommendations and features.
  • Communicate: send account-related and transactional emails (such as receipts and important notices), and, if you have not opted out, marketing emails such as welcome messages, learning tips, and win-back reminders. Every marketing email includes a one-click unsubscribe link, and you can opt out of marketing at any time.
  • Leaderboard: display your display name, avatar, level, and XP on the public leaderboard.
  • Discovery and social learning: display public learning paths in our topic discovery directory, rank topics by popularity, and allow other users to clone path structures to accelerate their own learning.
  • Secure the Service: monitor for errors, diagnose crashes, and prevent fraud and abuse.
  • Help when you are stuck: if a path stops making progress (for example a level cannot be built), our team gets an internal alert with your email, account ID, path topic and level so we can fix it or contact you.
  • Check AI quality: we review AI requests and answers, and samples of built paths, to find and fix mistakes in the content.

Automated decisions

The Service uses AI and fixed rules to grade some answers (including written answers), to decide when you move to the next lesson or level, and to choose the lessons you see. These decisions only shape your learning path and certificates; they have no legal or similarly significant effect on you. If you think one is wrong, write to us and a person will review it.

3. Legal Basis for Processing (GDPR)

  • Contract: processing necessary to provide the Service you signed up for, including your account, learning paths, AI-generated exercises and grading, free trial and subscription.
  • Consent: analytics cookies, session replay in the EU, EEA, UK and Switzerland, and marketing emails where the law of your country requires consent (including the EU, EEA, UK, Switzerland and Israel) - carried out only with your consent, which you can withdraw at any time.
  • Legitimate interest: error monitoring (including short error replays), securing the Service, preventing abuse and trial misuse, checking AI quality, product analytics without device storage, session replay outside the EU, EEA, UK and Switzerland, and, where the law allows it without consent, marketing emails to existing users, which you can opt out of at any time.
  • Legal obligation: keeping payment and invoice records as tax and accounting laws require.

4. Third-Party Services

We share data with the following processors and service providers to operate the Service:

  • Supabase (database and authentication) - stores your account data, learning progress, and notes, and manages your sign-in session. Supabase Privacy Policy
  • Google / YouTube (video content) - the Service uses YouTube API Services to search for and display videos, and embeds the YouTube player. Search words built from your path topic and its skills are sent to YouTube. We store public data about videos we show (such as video ID, title, channel, duration and transcript) and refresh or delete it as YouTube's rules require. We do not access your YouTube or Google account. The embedded player is provided by YouTube, which may show its own ads and set its own cookies (see our Cookie Policy). If you ever granted an app access to your Google account, you can revoke it at Google's security settings page. By using the Service you agree to the YouTube Terms of Service. Your interaction with embedded YouTube players and the YouTube API is also subject to Google's Privacy Policy.
  • Third-party AI service providers (content generation and grading) - to build your path, generate exercises and summaries, choose lessons and grade answers, we send our AI providers video transcripts, your topic and level, the goals and background you typed, and your exercise answers (including written answers and the questions you missed). Your name and email address are not included in these requests. Some quality checks of shared exercises also run through an AI provider and contain no data about you.
  • Web search provider - on days when YouTube's search is unavailable, the same search words (your path topic and skill names, never your name or email) may be sent to a web search provider to find YouTube videos.
  • PostHog (product analytics) - measures how the Service is used. We proxy analytics through our own domain (learnwithpath.com/ingest) so it is served first-party. For anonymous visitors, analytics runs in cookieless memory mode - no cookies or device storage are used - until you accept analytics cookies. After you accept, PostHog stores identifiers on your device for up to one year. Person profiles are created only for signed-in users: when you sign in, your account ID and email address are sent to PostHog so your activity is linked to your account. Our server also logs each AI request and its answer in PostHog, linked to your account ID, so we can check AI quality and cost; these logs can contain the goals and answers you typed. PostHog Privacy Policy
  • Session replay - PostHog may record a replay of how the app's pages are used (clicks, scrolling, navigation, and what the screen shows) to help us find and fix problems. What you type into fields, passwords and payment details are not recorded; card details are entered on Airwallex's own page, which is never recorded. In the EU, EEA, UK and Switzerland (or when we cannot tell your country), nothing is recorded unless you accept analytics cookies. Elsewhere, recording runs on signed-in pages by default, based on our legitimate interest, and stops when you turn analytics off in Cookie Settings. Recordings are kept for up to 30 days. Details are in our Cookie Policy.
  • Sentry (error monitoring and performance) - collects error reports, performance traces of page loads and API requests, browser console warnings and errors, and short screen recordings of the moments around an error, together with your IP address, your account identifier (user ID and email when you are signed in), and browser and operating system metadata, so we can diagnose crashes and slow pages. Error recordings hide the text and images on the screen and are sent only when something breaks, in every region. Server logs from our backend are also sent to Sentry; they reference your account by user ID only. Sentry does not set tracking cookies. Sentry Privacy Policy
  • Resend (email delivery) - sends transactional emails (such as account notices and receipts) and marketing emails (such as welcome messages, tips, and win-back reminders). Marketing emails always include a one-click unsubscribe link. Resend Privacy Policy
  • Vercel (frontend hosting and CDN) and Fly.io (backend API hosting) - serve the Service and keep standard server logs, which include IP addresses. Data may be processed in the United States.

Payment Processing - Airwallex

  • We use Airwallex as our payment processor for subscription payments.
  • When you subscribe to Pro, Airwallex processes your payment card details. Your card details never touch LearnPath servers.
  • Airwallex may collect: name, email, payment card information, and billing address.
  • LearnPath does NOT store your payment card details - this is handled entirely by Airwallex, which is PCI DSS compliant.
  • Airwallex's privacy policy: https://www.airwallex.com/privacy

5. Cookies

We use cookies and similar storage as described in our Cookie Policy. Analytics runs cookieless until you accept analytics cookies in the banner, and no marketing or advertising cookies are currently set. You can manage your cookie preferences at any time through the cookie settings link in the footer.

6. Data Retention

  • Active accounts: data is retained as long as your account is active.
  • Deleted accounts: when you delete your account in Settings, we cancel any subscription or trial and immediately delete your account, profile, paths, progress, answers and notes from our database. We keep only: (a) records of payments, detached from your account, for as long as tax and accounting laws require (in Israel, up to 7 years); (b) the trial card hash above, so the same card cannot start a second free trial; and (c) what Airwallex keeps under its own legal duties.
  • Our service providers: analytics, session recordings, AI request logs, error reports and email-delivery records held by PostHog, Sentry and Resend are deleted on their normal schedules (session recordings within 30 days). If you want them deleted sooner, email us and we will delete them.
  • Backups: data may persist in encrypted backups for up to 30 days after deletion.

7. Your Rights (GDPR)

If you are in the European Economic Area (EEA), you have the right to:

  • Access: request a copy of the personal data we hold about you.
  • Rectification: request correction of inaccurate data.
  • Erasure: request deletion of your data ("right to be forgotten").
  • Portability: request your data in a machine-readable format.
  • Objection: object to processing based on legitimate interest.
  • Restriction: request that we limit processing of your data.
  • Withdraw consent: withdraw consent for analytics, session replay, or marketing at any time, without affecting processing carried out before withdrawal.
  • Lodge a complaint: lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at support@learnwithpath.com or use the account deletion feature in your Settings.

8. Your Rights (Israel)

Under the Israeli Protection of Privacy Law, you may ask to see the personal data we hold about you and ask us to correct or delete data that is wrong, incomplete or out of date. You do not have to give us any data by law; we need your email to create an account, and the Service uses the data described above to work. Write to support@learnwithpath.com.

9. Your Rights (CCPA)

If you are a California resident, you have the right to:

  • Know: what personal information we collect and how it is used.
  • Delete: request deletion of your personal information.
  • Opt-out: opt out of the sale of personal information. We do not sell your personal information.
  • Non-discrimination: we will not discriminate against you for exercising your rights.

10. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS), hashed passwords, Row Level Security (RLS) on all database tables, and JWT-based authentication. However, no method of transmission over the Internet is 100% secure.

11. International Transfers

Our main database is hosted in the European Union (Germany), and LearnPath is run from Israel, which the European Commission recognizes as giving adequate protection. Your data may also be processed in other countries, including the United States, where several of our processors operate. We ensure appropriate safeguards are in place, including standard contractual clauses where required by GDPR.

12. Children's Privacy

LearnPath is not intended for children under 13 years of age (or under 16 in the European Union). We do not knowingly collect personal information from children under these age thresholds. If you are under 13 (or 16 in the EU), please do not create an account or submit any personal data to us.

Users between 13 and 18 years of age (or 16 and 18 in the EU) may use the Service with the consent and supervision of a parent or legal guardian. The parent or guardian is responsible for monitoring the minor's use of the Service.

If you are a parent or guardian and believe your child has created an account or provided personal data without your consent, please contact us at support@learnwithpath.com and we will promptly delete the account and associated data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notification. The "Last updated" date at the top reflects the most recent revision.

14. Governing Law

This Privacy Policy is governed by the laws of the State of Israel, without regard to its conflict of law provisions.

15. Contact

For privacy-related questions or requests, contact us at support@learnwithpath.com or by mail at Kaplan 60, Kiryat Ono 5529360, Israel.