Legal

Privacy Policy

Effective September 11, 2026 · PathFi LLC · Draft for review

What we collect

Your account details (email, name, sign-in method), the questions and context you submit for simulations, data from accounts you choose to connect, the files or messages you explicitly select where those connections are available, and standard usage analytics.

What we use it for

Running your simulations, personalizing your results, keeping your record, billing, and improving the product. Simulations are processed by the AI providers we build on, under agreements that bar them from training on your data. When a simulation needs live information, relevant search queries go to our web-search provider; they carry the question being researched, not your identity. We don’t sell your data. Ever.

Google data connections

Connecting Google Contacts and Calendar is separate from signing in with Google. We request read-only access and use your Google account email to label the connection. Contacts are shown for review; only people you choose to save become part of your PathFi context. For calendars you explicitly enable, we read event titles and times for the next 30 days, without descriptions, locations or guest lists. Selected context may be processed by our AI providers to answer your chats and run your simulations. We do not use Google user data to train general-purpose AI models. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Disconnecting Contacts and Calendar stops future use and removes the saved calendar snapshot; we request revocation from Google and retain encrypted cleanup credentials only if a retry is needed. People you saved can be removed in Settings. Earlier chats and reports keep context already used until those records are deleted under our retention policy.

Selected files and messages

Where enabled for your account, you can separately connect Google Drive, link a Gmail account, or connect Slack. Drive accesses files you select through Google Picker; it does not scan your whole Drive. Google’s per-file permission also permits creating or modifying selected files, but PathFi only reads them. Gmail imports the individual message you explicitly choose in the PathFi add-on, without browsing your mailbox or importing attachments. Slack imports the message you choose through its PathFi shortcut, not a channel or workspace archive. These connections do not automatically synchronize your mailbox or workspace. You review message content before saving and choose which saved sources a chat and its simulations can use. Selected material may be processed by our AI providers for that work. Records derived from these sources remain private: they are not published through PathFi’s sharing features, sent to public web searches, or automatically added to shared training or evaluation datasets.

Selected-source retention and removal

Copied file and message content expires for use after at most 24 hours from retrieval. Drive may retrieve a fresh copy when a selected file is used; expired messages must be selected again. Physical removal of expired copies runs asynchronously and may take longer. Backup copies follow the retention schedule below. Source references, including titles, links, selection dates, and version metadata, remain in your saved-source library until you remove the source, disconnect the provider, or delete your account. Earlier chats, simulations, and private outcome records can retain information already used until those records are deleted; removing a source does not rewrite earlier answers. The original file or message stays with its provider. Unlinking Gmail in PathFi removes its account binding and saved email sources and prevents new imports until you link again. It does not uninstall the Gmail add-on or disconnect Google Drive. You can uninstall the add-on separately in Google Workspace.

What’s public

Only PathFi’s own forecasts and what you explicitly choose to share. Your questions, simulations, and record are private by default. If you create a share link, only that report (or its anonymized receipt, if you pick that mode) becomes visible to people with the link, and you can turn a link off anytime. If you claim a public profile or list an agent on the leaderboard, the stats you publish there are visible until you unpublish them.

Sensitive decisions

The questions you bring PathFi can involve your health, relationships, finances, or career. We treat every question as confidential regardless of topic: it’s used to run your simulation and maintain your private record, nothing else. We never use the content of your decisions for marketing, and no human reviews it except to resolve an issue you raise with us.

Connected accounts

Settings lists the connections currently available to your account. These may include market accounts (Polymarket, Kalshi), financial accounts through Plaid, Google Contacts and Calendar, and selected-file or selected-message connections described above. Availability may differ during rollout. PathFi uses this data for context; it does not move funds, place trades, send email from your mailbox, or change files or events. Review each connection’s permissions before authorizing access. Stored credentials are encrypted; temporary Gmail message-access tokens are used for the selected import and are not retained as mailbox credentials. Disconnect or unlink an account in Settings to stop future use in PathFi. Provider revocation may require a retry; saved-context retention and Gmail add-on removal are described above.

Who we share it with

Service providers who help us run PathFi (hosting on AWS, payments via Stripe, the AI and web-search providers named above), under contracts limiting them to our instructions. Authorities, when the law genuinely requires it. And if PathFi is ever acquired or merged, your data transfers with the service under this policy’s protections. Nobody else — no advertisers, no data brokers.

Cookies and analytics

We use essential cookies to keep you signed in and first-party analytics to understand how PathFi is used. No third-party advertising cookies, no interest-based ad tracking. Where your region requires it, a cookie-settings control appears in the footer. Notifications — like an alert when one of your forecasts resolves — are sent only if you turn them on, and every marketing email has an unsubscribe link.

Retention and deletion

We keep account and decision records while your account is active, subject to the shorter selected-content expiry described above. Delete your account and we remove your data from the active service within 30 days, except what the law requires us to keep. Access-restricted recovery backups may retain earlier copies until their scheduled expiry: daily backups for up to 35 days and weekly backups for up to one year. Expired or removed selected content is not available for ordinary product use while awaiting physical deletion or backup expiry.

Where it lives

Data is stored on AWS in the United States, encrypted in transit and at rest. Sign-in runs on AWS Cognito. Payment details live with Stripe; we never see card numbers.

Your rights

Access, export, correct, or delete your data anytime: privacy@pathfi.ai. We respond within 30 days. EU/UK customers have GDPR rights (including objection and portability; our legal bases are contract, legitimate interests, and consent); California customers have CCPA rights. We don’t sell or share your data for targeted advertising, so there’s nothing to opt out of.

International transfers

PathFi runs in the United States. If you use it from the EU, UK, or elsewhere, your data is transferred to the US; for regions that require it, we rely on Standard Contractual Clauses.

Children

PathFi isn’t for anyone under 18, and we don’t knowingly collect their data. If you believe a minor has an account, email us and we’ll delete it.

Changes and contact

If we make material changes, we’ll email you before they take effect and update the date at the top. Questions or requests: privacy@pathfi.ai · PathFi LLC, United States. You can also lodge a complaint with your local data-protection authority.