Privacy Policy

1. About this policy

ShiftPath ("ShiftPath", "we", "us") is an independent project operated from Kazakhstan. This policy explains what information we collect when you use shiftpath.org and the ShiftPath application, why we collect it, who processes it on our behalf, and what you can ask us to do with it.

If anything here is unclear, or you want to exercise any of the rights described in section 9, write to hello@shiftpath.org. We answer within 30 days.

2. Who may use ShiftPath

ShiftPath is intended for people aged 16 and over. We do not knowingly collect information from anyone under 16. If you believe a person under 16 has created an account, write to hello@shiftpath.org and we will delete it.

3. What we collect

Account information. When you sign in with Google, we receive your email address, your name, and your profile picture if your Google account has one. We do not request access to your Google Drive, contacts, calendar, or any other Google service, and we never see your Google password.

Learning data. The career paths you select, the roadmaps generated for you, which lessons and modules you have started and completed, the dates of those completions, and the messages you exchange with the AI tutor.

Job-search activity. The role titles and filters you search with, and which job listings you open from ShiftPath. We use this to show how the roles you are learning for relate to what employers are currently asking for.

Technical and usage information. Pages visited, features used, approximate location derived from your IP address, device type, operating system, and browser. This comes from Google Analytics and from Vercel's analytics, and from ordinary server logs.

What we do not collect. We do not collect payment information — ShiftPath is free — and we do not ask you to upload identity documents. We do not buy personal data from third parties.

4. Why we use it, and on what basis

We use your account and learning data to run the service: to create and maintain your account, generate courses, remember your progress across sessions and devices, and show you job listings relevant to what you are learning. For users in the EU, UK, and other jurisdictions with similar rules, the legal basis for this is performance of our agreement with you.

We use technical and usage information to understand how the product is used and to improve it, and to detect abuse and fraudulent activity. The legal basis is our legitimate interest in operating and improving the service, and, where analytics cookies are involved, your consent.

We use your email address to send you messages that are necessary to operate the service, such as security notices or a confirmation that your data has been deleted. We do not currently send newsletters or marketing email. If we introduce them, they will be opt-in and you will be able to unsubscribe at any time.

5. Who processes your data

We do not sell your data, rent it, or share it with advertisers or data brokers. The following providers process data on our behalf or receive data as a necessary part of the service:

Supabase — authentication and database. Your account and learning data are stored in Supabase's us-east-1 region (Northern Virginia, United States).

Vercel — hosting and content delivery for the website and application, plus aggregated traffic analytics.

Google (Gemini API) — generation of roadmaps and lesson material. We send what is needed to produce the material: the role and topic you selected, and any text you type into the AI tutor. We do not send your name or email address. Because ShiftPath uses the paid tier of the Gemini API, Google does not use this content to improve its own models.

Google Analytics — usage analytics, using cookies as described in section 7.

YouTube (Google) — some lessons embed YouTube videos. When a video loads, Google receives your IP address and may set its own cookies, under Google's privacy policy rather than ours.

Adzuna and The Muse — job listing data. We send the search terms (such as a role title and location) needed to retrieve listings. We do not send them your name, email address, or account identifier.

Zoho Mail — our email provider, if you write to us.

We may also disclose information where we are legally required to, for example in response to a lawful court order, or where it is necessary to protect the safety, rights, or property of ShiftPath, our users, or the public.

6. Where your data is stored

Your account and learning data are stored in the United States, and our other providers may process data in the United States and the European Union. If you are located in Kazakhstan, the EU, or the UK, this means your data is transferred outside your country. By creating an account you accept this transfer; you can withdraw from it at any time by asking us to delete your account.

7. Cookies

ShiftPath uses a small number of cookies and similar technologies:

Necessary cookies keep you signed in. These are set by Supabase when you log in, and the service cannot work without them.

Analytics cookies are set by Google Analytics (_ga and similar) and tell us how many people visit, where they come from, and which parts of the product they use. They do not tell us who you are by name.

Third-party cookies from YouTube may be set by Google when a lesson video loads.

You can block or delete cookies in your browser settings. Blocking necessary cookies will prevent you from signing in.

8. How long we keep it

We keep your account and learning data for as long as your account exists. If you ask us to delete your account, we delete it and its associated data within 30 days and confirm by email. If an account has been inactive for more than 24 months, we may delete it after notifying you at your registered email address. Aggregated analytics data, which does not identify you, may be retained longer.

9. Your rights

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is inaccurate;
• delete your account and the data associated with it;
• stop processing your data for analytics purposes;
• export your learning data in a machine-readable form.

Write to hello@shiftpath.org from the email address associated with your account, and we will respond within 30 days. You can also revoke ShiftPath's access to your Google account at any time from your Google Account Permissions page — note that this stops future sign-ins but does not itself delete data already stored.

If you are in the EU or the UK, you also have the right to lodge a complaint with your national data protection authority.

10. Security

Data is transmitted over encrypted connections (HTTPS/TLS) and stored in encrypted form by Supabase. Access to the production database is limited to the person operating ShiftPath. Database access rules restrict each account to its own records.

We are a small project, not a certified security organisation: we do not run formal security audits, and no service can promise that a breach is impossible. If a breach affects your data, we will tell you by email and describe what happened.

11. Changes to this policy

We may update this policy as the product changes or as the law requires. The date at the top always shows the current version. If a change materially affects how we handle your data, we will notify you by email or with a notice in the application before it takes effect.

12. Contact

hello@shiftpath.org