Privacy policy
Pathfolio ("we", "us") is a personal finance learning app operated by Jared Ng, in Victoria, Australia. This policy explains what we collect, why, and your choices. Contact: [email protected].
What we collect
| Information | Why | Where it's stored |
|---|---|---|
| Email address and password (the password is stored only as a secure hash) | To create and sign in to your account, and to send account emails such as sign-up confirmation and password reset codes | Supabase (our backend provider); account emails are sent through Resend |
| Username | Shown to friends and on leaderboards | Supabase |
| Your public profile: username, Sprout's outfit and pet, level and XP, streak and badges | Shown to any other signed-in user who opens your profile, for example from a leaderboard, their friends list or a friend request (never to anyone you've blocked or who has blocked you). Your email, coins, hearts and answers are never shown | Supabase |
| Learning progress: sessions completed, quiz answers and mistakes, streak, hearts, coins, badges, daily goal, wardrobe and pet choices, app preferences | To run the app, save your progress and sync it across devices | Supabase |
| Friends: who you've sent requests to, and who's accepted | The friends and leaderboard features | Supabase |
| Blocks and reports: who you've blocked, and any report you send (the reason and any note you add) | To keep blocked people apart, and so we can review reports. The person you report isn't told who reported them | Supabase |
| Push notification token (only if you turn notifications on) | To send reminders you asked for | Supabase, and Google Firebase Cloud Messaging to deliver them |
| Crash and error reports: device model, OS and app version, what the app was doing when it failed. We configure these not to include your name, email, user id or IP address | To find and fix bugs | Sentry |
| Emails you send us | To answer your questions | Forwarded by Cloudflare to our support inbox |
We do not collect your location, contacts, photos, or any financial account information. We don't use advertising, sell your data, or track you across other apps and websites.
Background music and some settings (like music on/off) are stored only on your device.
How we use it
Only to provide and improve Pathfolio:
- running your account and progress;
- the social features you use;
- reminders you've switched on;
- fixing problems.
We don't use your data for automated decisions about you, and we don't build advertising profiles.
Who we share it with
Only these service providers, which process data on our behalf under their own security and privacy terms:
- Supabase: database and sign-in. Data is currently hosted on Amazon Web Services in Mumbai, India.
- Resend: sends account emails (sign-up confirmation and password reset). It receives your email address and the email's contents.
- Google Firebase: push notification delivery.
- Sentry: crash reporting.
- Cloudflare: hosts this website and forwards emails sent to our support address.
- Expo (EAS): building and delivering app updates. It doesn't receive your account data.
We'll disclose information if the law requires it. If Pathfolio is ever sold or merged, your data would transfer under this policy, and we'd tell you first.
Some providers store or process data outside Australia. Where that happens, we rely on their contractual safeguards.
How long we keep it
- Your account data: kept while you have an account.
- When you delete your account: your profile, progress and friend connections are removed straight away.
- Backups: deleted data may persist in backups for up to 30 days.
- Crash reports: kept for 90 days.
- Reports: a report about an account, including the username at the time, is kept for up to 12 months after we resolve it, even if either account is deleted, so we can deal with repeat abuse. If you delete your account, reports you sent no longer link to you.
Your choices and rights
- Delete your account at any time in the app: Profile → Account settings → Account security → Delete account.
- Notifications: turn them off in the app or in your phone's settings.
- Access or correct your data: email us at [email protected] for a copy of it, or to correct it. Depending on where you live, you may have further rights (for example under the Australian Privacy Principles, the GDPR, or Californian law), including complaining to your local privacy regulator (in Australia, the OAIC).
Children
Pathfolio is not intended for children under 13. We don't knowingly collect data from them. If you believe a child has an account, contact us and we'll delete it.
Security
- Data is encrypted in transit (HTTPS).
- Access is restricted so each user can read only their own private data.
- Coins, progress and answers are checked by our server, not trusted from the app.
No system is perfectly secure, but we take reasonable steps to protect your information.
Changes
If we change this policy, we'll update the date above. If the changes are significant, we'll also tell you in the app.