Privacy Policy
Effective date: July 26, 2026 · Version: 1.2
This Privacy Policy explains how English Pathway processes personal data. It applies to the website, authenticated account areas, learning sessions, and the English Assistant.
Operator: English Pathway Privacy contact: heac.creative@gmail.com Support contact: heac.creative@gmail.com Governing law: El Salvador
Data categories and purposes
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Account | Email, name, authentication identifiers, OAuth provider metadata when enabled | Create and secure your account | While the account exists, subject to legal obligations |
| Profile & learning | Level, daily goal, preferred mode, native language, chapter/activity results, SRS items | Personalize lessons and show progress | While the account exists |
| Tutor memory | Short session summaries and bounded notes | Resume tutor context | Summaries expire after 365 days; notes remain until you delete them |
| English Assistant | Conversation titles, message text, prompt metadata | Provide chat history and improve session quality | While the account exists unless you delete conversations |
| Technical | Essential session cookies, theme preference | Sign-in, security, accessibility | Per session or until cleared |
| Optional analytics | Consent-scoped event names and bounded properties | Aggregate product quality metrics | Up to 24 months, then eligible for deletion |
| Security telemetry | Abuse-prevention signals without learner content | Protect accounts and APIs | Up to 24 months |
Authentication
Email/password authentication is always available when enabled by the operator. Google sign-in is offered only when configured in Supabase and exposed in the UI. GitHub sign-in follows the same rule when enabled.
Voice, text, and AI processing
The browser requests microphone access only after a user gesture in voice mode. The application uses a microphone stream for the active voice experience and stops its tracks when the session ends. The application does not store raw audio or a full tutor transcript in its learner memory tables.
ElevenLabs may process voice conversations when configured. When ElevenLabs is not configured, OpenAI may process realtime voice conversations and embedding requests for shared curriculum retrieval. OpenAI also processes English Assistant prompts and responses. Supabase hosts authentication, relational data, and shared curriculum retrieval.
Text mode is a functional alternative and does not request microphone access. Optional browser speech features used by activities follow the browser's own permission behavior.
Shared curriculum and private data
The curriculum knowledge base is shared canonical content and is not copied per learner. Progress, preferences, SRS data, tutor summaries, learner memory, and English Assistant conversations are user-scoped with database row-level security. Server endpoints derive user identity from the authenticated session and do not trust a client-supplied user ID.
Analytics and cookies
Optional product analytics run only after you choose Allow analytics in the cookie banner. You can switch back to essential-only storage from Settings. Security telemetry that protects the service may be recorded without marketing identifiers or learner content.
See the Cookie and Storage Policy for details on local storage keys and essential cookies.
International transfers
Data may be processed in countries where Supabase, OpenAI, ElevenLabs, or OAuth providers operate. The operator relies on provider terms and applicable transfer safeguards. Contact the privacy email for jurisdiction-specific information.
Your choices and rights
You can use text mode, decline optional analytics, export private tutor data from Settings, delete private tutor summaries and memory notes from Settings, and delete English Assistant conversations in the chat UI.
Requests for access, correction, account deletion, or other privacy rights should be sent to the privacy contact above. The operator will respond within timelines required by applicable law.
Changes
When we publish a new version of this policy, we update the version and effective date shown on this page. Material changes may require renewed acceptance before continued use of authenticated features.