1. Introduction & Scope
Welcome to Pathubs (pathubs.com). Pathubs is an educational platform offering structured career roadmaps, interactive topic workspaces, technical guides, a Data Analyst Studio with analytical execution tools, and a local learning companion called Nova.
This Privacy Policy explains what information we collect, how it is processed, who we share it with, and how you can exercise control over your personal data. It applies to all visitors and registered learners of the Pathubs website and its features.
Please review this policy alongside our Terms & Conditions and Cookie Policy.
Core Privacy Principle: You can explore roadmaps, read guides, inspect architectural diagrams, practice in interactive sandboxes, and run analytical queries without creating an account. Where features can run entirely in your local browser, we avoid transmitting your data to remote servers.
2. Who Operates Pathubs
Pathubs is operated as an independent educational digital project originating in India. For questions concerning this Privacy Policy, your personal data, or data protection practices, you can contact the project maintainer at supportpathubs@gmail.com.
Pathubs is currently maintained as an independent web project without a registered corporate entity or statutory Data Protection Officer designation. If and when the project incorporates or registers as a formal corporate entity, this section will be updated with the registered entity name, address, and statutory designations.
3. Information We Collect
We categorize the information handled by Pathubs into four distinct groups, distinguishing clearly between data that remains strictly on your device and data that is stored on our servers.
A. Information You Voluntarily Provide
- Account Credentials & Profile: If you register an account, authentication is processed through Supabase Auth. Supported sign-in methods include Google OAuth and email/password. We receive your unique user ID (UUID), email address, and, if supplied by you or your OAuth provider, your display name and avatar URL. If no avatar is supplied, an avatar is generated deterministically using a pseudonymous seed. Passwords are salted, hashed, and managed exclusively by Supabase; Pathubs never receives or stores plaintext passwords. We do not warrant that all accounts possess verified real names or avatars.
- Feedback & Support Messages: When you submit feedback via our global feedback modal, topic reaction cards, or footer support form, we collect the feedback category, satisfaction rating, your text message, topic title (if applicable), page URL, and submission timestamp. Submitting an email address is entirely optional; feedback forms can be submitted anonymously.
- Voluntary Financial Contributions: If you choose to support Pathubs via our Support Us page, payments are handled by Razorpay. Pathubs receives and records transaction confirmation metadata: Razorpay Order ID, Payment ID, contribution amount, currency, payment status, and the email address entered during checkout. Pathubs never collects, processes, or stores your credit card numbers, CVVs, PINs, UPI PINs, or banking credentials.
B. Learning Progress & Workspaces
Learning data is handled differently depending on whether you are browsing as a guest or signed in to an authenticated account:
- Guest Learners (No Account): Progress (completed topics, completed milestones) and bookmarks are stored strictly within your browser's local storage (skillpath_progress_v1_guest and skillpath_bookmarks_v1_guest). This data persists between sessions on that specific browser and device, but is not transmitted to our servers. If you subsequently register or sign in, this guest progress is automatically migrated to your cloud account.
- Authenticated Learners (Signed In): When logged in, your learning progress is mirrored to our Supabase database across user-owned tables: completed topic IDs, career track completion percentages, bookmarked resources, your recent learning history (capped at the 20 most recent items), milestone quiz scores, and saved Data Analyst Studio workspaces.
C. Technical, Operational, and Bot Verification Data
- IP Address & Request Headers: When your browser calls server endpoints (such as feedback submissions, Studio mission evaluations, account sync, or payment verification), your IP address and standard HTTP headers (such as user-agent) are inspected by edge proxies (Cloudflare and Vercel) and our application for rate limiting and defense against automated attacks.
- Bot Verification (Cloudflare Turnstile): On public interactive forms, Cloudflare Turnstile validates client interaction tokens to protect against spam bots without tracking your browsing activity across unrelated websites.
- Rate Limiting Counters: Short-term request frequencies are tracked via Upstash Redis (or an in-memory fallback) to safeguard endpoints against denial-of-service attempts. These counters are ephemeral and reset automatically within minutes to hours.
D. Analytics & Telemetry (Strictly Consent-Gated)
Only if you provide explicit, affirmative consent through our Cookie Consent Manager, Google Analytics 4 (GA4) collects pseudonymous usage metrics (page views, session duration, approximate country/city-level geography, and device type). All analytics events pass through a client-side filter that strips personal identifiers (names, emails, user IDs, auth tokens) before transmission. Search terms are truncated to 40 characters and sanitized of numeric patterns and URLs.
4. Browser Storage & Cookies
Pathubs uses client-side browser storage (localStorage) and first-party cookies to deliver core learning functionality, manage authentication, and record your privacy preferences.
localStorage Keys (First-Party)
| Storage Key | Scope & Audience | Purpose & Behavior |
|---|---|---|
| pathubs_cookie_consent_v1 | All Visitors | Stores your necessary, analytics, and marketing consent preferences. Contains zero personal data. |
| skillpath_progress_v1_guest | Guest Visitors | Stores topic completions on the local device. Remains until browser storage is cleared; migrated on login. |
| skillpath_bookmarks_v1_guest | Guest Visitors | Stores bookmarked learning resources locally on the device. Migrated to cloud upon login. |
| skillpath_progress_v1_[userId] | Authenticated Users | Local cache of roadmap topic checkmarks and career progress, synchronized with Supabase. |
| skillpath_bookmarks_v1_[userId] | Authenticated Users | Local cache of bookmarked curriculum items, synchronized with Supabase. |
| skillpath_history_v1_[userId] | Authenticated Users | Maintains up to 20 recently visited curriculum topics for convenient resume navigation. |
| skillpath_sync_queue_v1_[userId] | Authenticated Users | Queues offline progress updates so changes are reconciled when network connectivity resumes. |
| pathubs_studio_workspace_v1_* | Studio Users | Local drafts of SQL queries, Python scripts, and editor layout preferences. |
| pathubs_companion_first_visit_seen | All Visitors | Simple flag ('1') recording whether Nova's welcome introduction has been shown. |
Cookies
- Supabase Authentication Cookies (sb-*-auth-token): Secure session cookies set by Supabase to maintain your logged-in state across page reloads.
- Google Analytics (_ga, _ga_*): Third-party analytics cookies placed by Google only if you affirmatively grant analytics consent.
- Google AdSense: Advertising cookies that may be set by Google only if you affirmatively grant marketing consent.
Local Browser Storage Warning: Guest progress and local drafts reside entirely inside your browser profile. If you clear site data, use incognito mode without logging in, or switch devices, locally stored guest progress will be permanently lost. To preserve progress permanently across devices, log in to an account.
5. Feature-Specific Data Processing
A. Career Roadmaps & Milestone Quizzes
When exploring roadmaps, learning content is fetched statically or rendered client-side. Interactive tools (such as join visualizers, formula calculators, and SQL prediction sandboxes) execute entirely in your browser without transmitting your input parameters or playground queries to our servers.
When an authenticated user completes a milestone quiz, Pathubs records the completion and score in user_quiz_results using an upsert procedure that preserves your personal-best score for that milestone. Retaking a quiz does not overwrite a higher existing score, and Pathubs does not store an endless chronological archive of past failed attempts.
B. Nova — Learning Companion
Nova is a hybrid learning assistant embedded in the Pathubs interface that combines client-side curriculum matching with an optional AI technical mentor:
- Hybrid Local & AI Mentor Processing: For roadmap navigation and standard curriculum lookups, Nova matches queries locally against Pathubs's static topic registry. When you ask open-ended coding, SQL, Python, or architecture questions, your prompt and brief page context are sent to our server-side endpoint (POST /api/companion/chat), which uses Google Gemini API to generate an educational response with automatic fallback to local deterministic guidance if the AI service is unavailable.
- Zero Persistent Chat History on Servers: Pathubs does not store your Nova chat transcripts in any database. Conversation turns exist only in ephemeral browser state during your active session and are cleared when you reset the chat or reload the page.
- Status of Companion Quests & Rewards: While companion database tables (companion_profiles, companion_quests, reward_ledger) exist in our database schema, the server-side quest-claim endpoint (/api/companion/quests/claim) is feature-gated off by default in production (COMPANION_REWARDS_ENABLED=false). XP accumulation, daily streak claims, and virtual quest rewards are currently inactive and not available as a live service.
C. Data Analyst Studio
The Data Analyst Studio allows learners to practice data analysis using fictional synthetic datasets (such as “NovaCart Q1 2026”), which contain zero real-world personal information.
- In-Browser Analytical Execution: Everyday exploratory analysis runs locally on your computer. SQL queries are executed in-memory using DuckDB-Wasm (WebAssembly). Python and Pandas scripts execute locally using a WebAssembly runtime. Spreadsheet operations and data visualizations run entirely in your browser.
- Server-Side Mission Evaluation: When you formally submit an analytical mission for evaluation, your deliverable payload—including your primary SQL query, executive report text, and evidence artifacts—is transmitted via POST /api/studio/evaluate to our server. The server verifies your findings against public datasets and confidential hidden validation cohorts to compute an objective score. Hidden validation datasets and grading mechanisms are confidential and never returned to the client. Submissions are capped at 64 KB, rate-limited, and cached temporarily for idempotency.
- Workspace Cloud Persistence: For authenticated learners, workspace state (draft SQL queries, selected tables, and pinned evidence) is synchronized to our Supabase database via /api/studio/workspace so you can resume work across devices.
D. Blog & Educational Articles
Articles on the Pathubs blog are rendered statically from Markdown/MDX content. There are no public comment threads, user discussion boards, or newsletter forms. Viewing articles does not record personal data beyond standard, consent-gated analytics.
E. Feedback & Support Submissions
Feedback submitted via our platform is sent via POST /api/feedback and stored in our database (student_feedback). If configured, notifications may be forwarded to our support inbox via Resend. Forms are protected by Cloudflare Turnstile bot verification and edge rate limiting. Feedback is not tied to your authenticated account unless you choose to provide an email address. We do not provide guaranteed support service levels or response time commitments.
F. Voluntary Financial Contributions
Pathubs is completely free to use. Users who wish to support hosting costs can make voluntary contributions via Razorpay. Pathubs receives and logs the Razorpay Order ID, Payment ID, contribution amount, currency, timestamp, payment status, and donor email. Sensitive payment data (card numbers, CVVs, net banking credentials) are submitted directly to Razorpay over encrypted channels and are never seen or stored by Pathubs.
6. Purposes of Processing
We process information strictly for the following operational and educational purposes:
- Educational Delivery: Rendering roadmaps, topic guides, sandboxes, quizzes, and synthetic studio workspaces.
- Progress Synchronization: Saving roadmap topic checkmarks, personal-best quiz scores, bookmarks, and Studio workspaces across devices for logged-in users.
- Mission Grading: Evaluating Studio mission submissions on the server against objective validation benchmarks.
- Security & Abuse Prevention: Enforcing request rate limits, verifying bot challenges via Cloudflare Turnstile, and safeguarding server infrastructure.
- Platform Improvement: Analyzing aggregated, consent-gated usage metrics via GA4 to understand topic popularity and guide curriculum updates.
- Compliance & Accounting: Maintaining mandatory statutory records of financial contributions in accordance with applicable Indian tax and financial reporting laws.
7. Legal Bases for Processing
Where data protection regulations require an articulated legal basis for personal data processing, we rely on the following:
| Processing Activity | Legal Basis | Operational Context |
|---|---|---|
| Account registration & cloud progress sync | Contract / Service Request | Necessary to deliver the cross-device persistence and account features you explicitly request. |
| Studio mission grading | Service Delivery | Necessary to evaluate your submitted analysis against hidden validation benchmarks. |
| Platform security, rate limiting, and bot defense | Legitimate Interests | Necessary to protect platform stability, availability, and prevent automated abuse. |
| Responding to voluntary feedback | Consent / Legitimate Interests | You voluntarily submit feedback; we process it to improve platform curriculum. |
| Voluntary contributions & transaction records | Legal Obligation / Contract | Processing the voluntary gift and fulfilling statutory financial record-keeping requirements. |
| Telemetry, analytics, and advertising scripts | Explicit Consent | Strictly gated behind your prior affirmative opt-in via our Cookie Consent Manager. |
8. Analytics & Advertising
Google Analytics 4 (GA4)
Pathubs uses Google Analytics 4 with Google Consent Mode v2. By default, telemetry storage is set to denied. No analytics cookies are placed, and no telemetry pings are transmitted unless you grant affirmative consent in our Cookie Consent Manager.
- PII Redaction: Our client-side analytics wrapper automatically scrubs parameters matching email patterns, user UUIDs, authorization tokens, passwords, and phone numbers before dispatch.
- Sanitized Search Logging: Internal search queries logged to analytics are truncated to 40 characters and stripped of URLs, email addresses, and 4+ digit numeric sequences.
- No Cross-Site Profiling: We do not transmit authenticated user IDs to Google Analytics. Data collected represents aggregate, pseudonymous interaction patterns.
Google AdSense Integration
The Pathubs codebase contains an integration with Google AdSense (ca-pub-5347975347622910). The advertising script is strictly loaded only if you grant marketing consent. If marketing consent is denied, the script is neither downloaded nor executed. Active serving of advertisements also depends on Google's publisher review and site approval status; the presence of configuration code does not imply that commercial advertising is actively being served on every page.
You can adjust or revoke your cookie choices at any time by clicking “Cookie Preferences” in the website footer.
9. Third-Party Service Providers
We engage third-party infrastructure providers to support the platform. Each provider processes data strictly within the scope of its technical role:
| Provider | Role on Pathubs | Data Handled | Privacy Information |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, and cloud storage | Account email, user UUID, hashed passwords, OAuth profile tokens, cloud progress records, Studio workspaces, feedback submissions | Supabase Privacy |
| Google LLC | Analytics (GA4) & Advertising (AdSense) | Pseudonymous browsing events, device category, sanitized search terms (strictly consent-gated) | Google Privacy |
| Cloudflare, Inc. | Bot defense (Turnstile) & Edge CDN | IP address, browser headers, and interaction tokens for automated bot challenge verification | Cloudflare Privacy |
| Razorpay Software Pvt Ltd | Payment gateway for voluntary donations | Billing information and payment credentials processed directly on Razorpay; Pathubs receives only order/payment IDs, amount, and donor email | Razorpay Privacy |
| Upstash, Inc. | Serverless Redis for distributed rate limiting | Temporary, pseudonymous IP-based request frequency counters | Upstash Privacy |
| Resend, Inc. | Transactional email notifications | Feedback notification emails forwarded to platform maintainers | Resend Privacy |
| DiceBear | Avatar generation | Deterministic, pseudonymous username seed to produce profile avatars; no personal data transmitted | DiceBear Privacy |
10. Data Sharing & Disclosure
Pathubs does not sell, rent, lease, or trade personal data to third parties for commercial or marketing purposes.
We disclose data only in the following limited circumstances:
- Operational Service Providers: To the third-party infrastructure providers listed in Section 9 solely to operate and secure the platform.
- Legal & Regulatory Compliance: If required by a court of competent jurisdiction, law enforcement agency, or statutory government authority under applicable Indian law.
- Platform Protection: To investigate, prevent, or take action regarding potential terms violations, security breaches, or attacks against our infrastructure.
11. International Data Transfers
Pathubs is operated from India. However, our infrastructure partners (including Supabase, Google, Cloudflare, Upstash, and Resend) operate servers and edge networks across multiple global regions, including the United States, the European Union, and the Asia-Pacific region.
By accessing Pathubs or registering an account, you acknowledge that your information may be processed and stored on servers located outside your jurisdiction of residence, where data protection laws may differ from those of your home country. Our service providers maintain their own technical and contractual data safeguards as described in their respective privacy documentation.
12. Data Retention & Deletion
We retain personal data only for as long as necessary to fulfill the purposes described in this policy:
| Data Category | Retention Period | Deletion Mechanism |
|---|---|---|
| Authenticated Account & Progress Records | Retained for the active lifetime of your account. | Self-service deletion available immediately via My Progress (POST /api/user/delete). |
| Local Browser Storage (localStorage) | Persists on your device until manually cleared. | Cleared by you in your browser settings or by clicking Reset Progress on the platform. |
| Feedback Submissions (student_feedback) | Retained as long as necessary to improve the curriculum. | Subject to administrative pruning. Feedback submitted without email is anonymous. |
| Rate Limiting Counters (Upstash/Memory) | Ephemeral; expires in 1 to 60 minutes. | Automatic time-to-live (TTL) expiration. |
| Voluntary Contribution Records (platform_contributions) | Retained for statutory tax and accounting audit periods under Indian financial laws. | Independently retained by law; not deleted when a learner deletes their educational account. |
Self-Service Account Export & Erasure: Authenticated learners can download a complete, machine-readable JSON copy of all their personal learning data via the Export Learning Data button (GET /api/user/export) on My Progress. Learners can also permanently delete their account and associated learning records directly via the Delete Account option (POST /api/user/delete), requiring confirmation. Deleting your learning account does not delete independently retained statutory tax records for voluntary financial contributions.
13. Data Security & Rate Limiting
We maintain comprehensive technical and architectural safeguards to protect your data:
- Transport Encryption: All platform traffic is encrypted in transit using HTTPS (TLS 1.2+).
- Row-Level Security (RLS): Supabase database tables enforce PostgreSQL Row-Level Security policies ensuring that authenticated learners can read and write only their own records.
- Privileged API Isolation: Server-side operations requiring privileged service keys are executed in server-only Node.js routes and are never bundled into client-side JavaScript.
- Content Security Policy & Security Headers: Strict CSP directives, HSTS (max-age=63072000), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and restrictive referrer policies protect against clickjacking and cross-site scripting.
- Edge Rate Limiting: Endpoints are protected by IP-based rate limiting (5 requests per minute short window, 20 requests per hour long window) with trusted edge header validation (cf-connecting-ip, x-real-ip). A relaxed loopback test allowance (120 req/min) is strictly restricted to local development addresses (127.0.0.1, ::1) and cannot be triggered by external public requests.
Security Disclaimer: While we implement rigorous technical safeguards, no internet transmission or electronic storage architecture is completely immune to vulnerabilities. We cannot guarantee absolute security and encourage learners to protect their device credentials.
14. Your Privacy Rights & Legal Framework
A. India — Digital Personal Data Protection Act, 2023 (DPDP Act)
Pathubs is operated from India. We design our data practices in alignment with the principles of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
As of October 2026, the DPDP regulatory framework operates under a notified, phased implementation schedule. Subject to the specific rules and provisions in force for digital platforms, Data Principals in India may have rights regarding:
- Summaries of personal data processed and processing activities.
- Correction and updating of inaccurate personal data.
- Erasure of personal data that is no longer necessary for the specified purpose.
- Grievance redressal regarding data handling practices.
- Withdrawal of previously provided consent.
Clarity on Data Portability: The DPDP Act, 2023 does not establish an express statutory data portability mandate. Pathubs provides a self-service JSON export tool (/api/user/export) as an elective convenience and transparency feature, rather than as a statutory portability compliance obligation.
B. European Economic Area & United Kingdom (GDPR / UK GDPR)
Pathubs is an informational and self-study platform operated from India. We do not maintain establishments in the EU or UK. While we respect core international privacy principles—including consent-gated tracking, data minimization, and self-service account erasure—we do not represent that Pathubs holds formal GDPR certifications. Visitors accessing the platform from the EEA or UK can exercise rights to access, rectification, and erasure by using our self-service features or emailing supportpathubs@gmail.com.
C. How to Exercise Privacy Rights
- Self-Service Export: Download your complete personal learning data archive at any time from My Progress.
- Self-Service Erasure: Permanently delete your account and personal learning data directly from My Progress.
- Cookie & Telemetry Preferences: Manage analytics and marketing consent via the “Cookie Preferences” button in our website footer.
- Manual Inquiries: For specialized inquiries, write to supportpathubs@gmail.com with the subject line “Privacy Inquiry”. We aim to acknowledge privacy requests within 72 business hours.
15. Children's Privacy
Pathubs is an educational platform intended for university students, adult professionals, and self-directed adult learners. We do not knowingly collect personal data from children under the age of 18 without appropriate parental or legal guardian consent, consistent with the child data protection provisions under India's DPDP framework.
If you believe a minor has registered an account or submitted personal information without required guardian consent, please notify us at supportpathubs@gmail.com so we can investigate and promptly delete the associated account records.
16. Changes to This Policy
We may update this Privacy Policy periodically to reflect evolving platform features, technical integrations, or statutory legal requirements. Whenever revisions are published, the “Last Updated” date at the top of this document will be amended accordingly.
For significant updates that fundamentally alter how personal data is handled, we will post a prominent notice on the platform homepage or via the user dashboard. Your continued use of the platform following the posting of an updated policy signifies your acknowledgment of the changes.
17. Contact Information
For questions, feedback, or concerns regarding this Privacy Policy or Pathubs data handling practices, please contact us:
Platform: Pathubs (pathubs.com)
Maintainer Contact: supportpathubs@gmail.com
Subject Line for Privacy Matters: “Privacy Rights Request — Pathubs”
Response Target: We endeavor to review and respond to legitimate privacy inquiries within 30 calendar days.