Privacy Policy

Account information. When you create an account, we collect your email address and a password. We use Supabase Auth to manage authentication.

Athlete profile. You provide information about the athlete: name, graduation year, position, club, league or circuit, GPA, and target college divisions. This information personalizes your dashboard and timeline.

School and coach contacts. You enter or import a list of college programs and coach email addresses you're tracking. This data is stored in your account and is not shared with colleges, coaches, or third parties.

Gmail data. See the section below.

Usage analytics. We collect data about how the product is used — for example, how often features are clicked and which steps in onboarding are completed — via PostHog. These events are tied to your account by a random internal ID, not by your name or email address, so they identify an account without identifying a person. We never send PostHog email content, names, athlete profile details, or coach contacts. It is used solely to improve the product.

Error reports. When the app encounters an error, we may collect a technical report (stack trace, browser type, URL) via Sentry. These reports do not include email content.

Path To Sign connects to your Gmail account to help you manage your college recruiting correspondence. This section describes exactly what we access and what we do with it.

Permissions we request. When you connect Gmail, Google asks you to grant Path To Sign three permissions. We request these and no others:

• gmail.readonly — to find and display the recruiting threads in your mailbox.
• gmail.send — to send the replies you write or approve, from your own address, so coaches see the message coming from you.
• gmail.modify — to keep replies attached to the correct thread and to update message state (such as read status) when you act on a thread inside Path To Sign.

What we access. We scan your mailbox for emails from college athletic staff — specifically emails from .edu addresses and email addresses you have identified as coaches — and we store the content, headers, and metadata of those threads only. To be precise about what the permission itself allows: gmail.readonly is granted by Google at the mailbox level, so restricting the scan to recruiting correspondence is a limit we impose in our own code rather than one Google enforces on us. Messages outside that filter are not stored, shown, or sent anywhere.

What we do with it. We surface those threads inside Path To Sign so you can view, reply to, and track your recruiting correspondence. We use the content of recent messages to generate AI-drafted reply suggestions via OpenAI. Those suggestions are shown to you for review; you decide whether to edit and send them.

What we do not do. We do not:

• Sell, rent, or share your Gmail content with any third party for marketing or advertising purposes
• Use your Gmail content to train AI models or improve services beyond Path To Sign
• Read your Gmail messages for any purpose other than operating, debugging, and improving Path To Sign itself. When you request an AI draft, we retain the generated draft along with the message text that was used to produce it, and a small number of authorized personnel may review those records to diagnose failures and improve draft quality. No one reviews your mailbox outside that process.
• Store, display, or send anywhere any message that falls outside your college recruiting correspondence — our scan is limited to .edu domains and the coach addresses you specify

Revoking access. You can disconnect Gmail at any time from Settings → Gmail. Disconnecting immediately revokes our access token with Google and stops any further syncing — we cannot read your mailbox again unless you reconnect. Recruiting threads that were already synced remain in your Path To Sign account so your correspondence history stays intact. If you want that stored email data deleted as well, email us at privacy@pathtosign.com and we will delete it within 30 days, or delete your account entirely (see Your Rights below).

How long we keep it. Synced threads, messages, and AI draft records are retained for as long as your account is active, because they are the record of your recruiting correspondence. They are deleted within 30 days of an account-deletion or data-deletion request, except where we are required to retain something to comply with law or to resolve a dispute.

Google API compliance. Our use of Gmail data complies with the Google API Services User Data Policy, including the Limited Use requirements.

We use the information we collect to:

• Provide and operate the Path To Sign service
• Personalize your dashboard, timeline, and next-action recommendations
• Generate AI-assisted email drafts for your review
• Send transactional emails (account confirmation, password reset) via Resend
• Diagnose and fix technical errors (Sentry)
• Understand how the product is used (PostHog)

We do not use your information for advertising. Path To Sign is ad-free.

Your data is stored in a Supabase Postgres database hosted in the United States. We implement row-level security (RLS) so each user's data is isolated and inaccessible to other users. OAuth tokens are encrypted at rest. We use HTTPS for all data in transit.

No security system is perfect. If you believe your account has been compromised, contact us immediately at privacy@pathtosign.com.

Disconnect Gmail. You can revoke Path To Sign's access to your Gmail at any time from Settings → Gmail. This immediately cuts off our access and stops all syncing. Threads already synced stay in your account unless you also ask us to delete them — see Gmail Data above.

Delete your account. You can request deletion of your account and all associated data by emailing privacy@pathtosign.com. We will complete deletion within 30 days.

Data export. You can request a copy of the data we hold about you by emailing privacy@pathtosign.com.

Path To Sign is designed for use by families, where a parent or guardian typically creates and manages the account. The athlete — who may be a minor — may also use the product.

We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe we have inadvertently collected information from a child under 13, please contact us at privacy@pathtosign.com and we will delete it promptly.