Privacy Policy

Who is responsible

PurepathAI is the project and brand name for the programming learning service at purepathai.dev, intended for programming learners worldwide. It is not represented as a registered company. Registration as an autónomo in Spain is planned; the operator’s legal name and address remain TO BE CONFIRMED. For support and privacy requests, email purepathaidev@gmail.com. EU representative and data protection officer details, if legally required, remain to be determined.

Data and purposes

We process account email, password hash, invitations and sign-in sessions to provide and secure your account. We store learning goals, experience, chosen language, code, exercise answers, tutor conversations, generated paths, assessments and progress to deliver your requested learning service. Account and learning data are needed to use these features; optional analytics are not required.

AI assessment adapts your learning path. It can be inaccurate; it is not an accredited qualification or an employment or admission decision. Do not enter passwords, API keys, confidential code or sensitive personal information in goals, code or conversations.

We store your access (free trial dates, subscription plan, status and paid period, and Stripe customer and subscription references) and records of AI usage against the daily limit. Payment card details are handled by Stripe checkout rather than entered into Purepath forms. Server security, error and operational records help prevent abuse and diagnose failures. Administrators can review learner activity and aggregate pilot engagement.

When you create an account we record where your first visit came from: the campaign parameters of the link you followed (such as utm_source), a referral code, or the name of the site that linked to us, never its full address. Administrators use it to compare how promotion channels perform.

Legal bases

Where GDPR applies, providing accounts, requested AI learning features and subscriptions relies on performance of a contract or steps you request before entering it. Legally required accounting records rely on legal obligations. Security and service reliability may rely on legitimate interests, subject to necessity and balancing against your rights. Optional browser analytics and browser diagnostics rely on your consent, independently of account registration. Server-side PostHog product analytics are disabled by default. Operational records and pilot monitoring still require documented necessity and an appropriate legal basis.

Recipients and AI processing

OpenAI receives the relevant learning context, code and conversation content needed to generate or evaluate learning material when AI features are used. OpenAI states that API data is not used for model training by default; retention depends on the endpoint and account configuration. Do not assume zero retention.

Configured providers include Vercel (web hosting and, when permitted, page view analytics), Hetzner (backend infrastructure), OpenAI (AI), Stripe Managed Payments (checkout and merchant of record, currently disabled), PostHog (usage events), Sentry (error diagnostics) and Langfuse (AI operational traces). Optional browser collection is controlled in Cookie settings. Server-side PostHog product analytics are disabled by default. Necessary server diagnostics and AI operational traces are configured separately from browser choices. The operator must verify enabled providers, their legal entities, locations, contracts and retention before launch.

We may disclose information where law requires it or to protect service security, subject to applicable law. Sharing progress creates a link accessible to anyone who has it; consider what you choose to publish. Removing a link cannot remove copies already made by others.

Feedback links open a Google Form on Google’s site; what you write there is processed by Google under its terms. A link may fill in your email, your goal, the topic and the task you are giving feedback on, never your answers or code.

International transfers

Providers may process information outside your country, including outside the EEA. Where required, transfers need an applicable adequacy decision or appropriate safeguards such as standard contractual clauses and any necessary supplementary measures. The actual mechanisms and a way to request a copy of safeguards must be confirmed for each enabled provider before publication.

Retention and security

The sign-in cookie lasts up to 14 days. Browser privacy choices expire after 180 days. Account, learning, payment, server-log and provider retention schedules, deletion handling and any legally required exceptions: TO BE CONFIRMED. We do not currently promise automatic account deletion or a self-service export feature. Passwords are stored as hashes and sign-in cookies are HttpOnly; no system can guarantee absolute security.

Your rights

Where applicable, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw optional browser consent through Cookie settings at any time; this does not invalidate prior lawful processing. Rights can have legal exceptions. GDPR requests normally require a response within one month, with permitted extensions where justified. Send requests to purepathaidev@gmail.com. We may ask for information reasonably needed to verify your identity. Do not send your password.

You may complain to your competent data protection authority, including the authority where you live, work or where an alleged infringement occurred. If the operator is established in Spain, the relevant authority may be the AEPD.

Children and changes

Registration does not ask you to confirm that you are 18 or collect a date of birth. Removing that check does not remove applicable protections for children. Where parental authorisation is legally required, it must be obtained before the relevant processing. A parental-authorisation and age-assurance process has not yet been implemented and remains an outstanding requirement. If you have concerns about a child’s account or data, contact purepathaidev@gmail.com so we can investigate. We will date material revisions and seek renewed consent where optional processing changes. See the Cookie Policy for browser storage and choices.