Privacy Policy

Last updated: Oct 4, 2026

MyPath is built with privacy as our number-one value. This policy explains what we collect, what we do with it, and, just as importantly, what we don't do.

MyPath is one platform with modules for each season of a counselor's career: Graduation (practicum and internship hours), Licensure (post-master's supervised hours), and Renewal (CE credits and credentials). One account covers all of them. This policy covers the whole platform; where a detail applies to a single module, we say so.

In plain English

We collect the minimum information needed to help you track your hours and credentials. We don't sell your data, share it with advertisers, or train AI models on it. When you delete your account, your data is permanently deleted.

What we collect

Account information:

Email address (used for sign-in and to send you magic links)
Display name (provided by you at signup, or from Google when you sign in with Google)
Which modules your account has access to

Tracking data, entered by you. Depending on which modules you use, this includes:

Licensure: license track details (state, license type, degree date), weekly hour entries, supervisor records (name, credentials, agency, dates, and an optional email address, used only if you request a supervisor review), activities and notes you choose to add, and supervisor review records if you request a review
Graduation (when it launches): program details and practicum/internship hour entries
Renewal (when it launches): credentials, CE activity records, and certificates you upload

That's it. We don't collect IP-address-based location data, browsing history, device fingerprints, or anything beyond what's necessary to make the app work.

What we do with it

We use your data for one thing: to show your own data back to you, and to email you when needed.

Specifically:

Display your hours, supervisors, credentials, and progress in the app
Send you magic-link emails so you can sign in without a password
Send you support replies when you contact us
In the Licensure module, send a review link to a supervisor's email address when you explicitly request it, and email you their response
Send you reminder and progress emails, which you can turn off in Settings
Generate the audit-ready exports you can download

We do not:

Sell your data, ever
Share it with advertisers or marketing platforms
Train AI models on it
Run analytics that track your behavior
Aggregate your data with other users', except to count how the service is used (for example, how many accounts, tracks, or hours exist in total). Those counts never identify you.

Who can see your data

You can see your data. Your data is yours.

MyPath has technical access to the database for the purpose of maintaining the service and responding to support requests. We do not browse user data casually. We look only when you ask for help that requires it.

People who help run MyPath may be given access to an admin console. For your account, it shows only counts of how the service is used, never your entries, notes, activities, certificates, memberships, or any other individual record. The people who help run MyPath can see each other's name, email address, admin role, access end date, and when each was last active. They can also see who granted each person's access, when, and the reason recorded for it. If you are invited to help run MyPath, they can see your email address, the invite's details, and the reason recorded for it.

Supervisors you link on MyPath. You can link your account with a supervisor's MyPath account. It always takes both of you: one of you asks, and the other approves. A linked supervisor sees the hours you attribute to them and any reviews you request from them. In the Licensure module, they see those hours by type: direct client contact, individual supervision, and group supervision. They never see your notes or your activities. Either of you can unlink at any time. Access ends right away, and no email is sent.

In the Licensure module, you can choose to share more with a linked supervisor. Sharing adds your overall progress toward licensure on each track where you've logged hours with them. It also adds the hours you logged with other supervisors on that track, by name and type, with each supervisor's credential and dates. Weeks with no supervisor recorded are included. Sharing is your choice, made for each supervisor separately. The option appears when you link a supervisor or approve their request. It starts checked, and you can uncheck it. Links made before sharing was available start with it off. You can turn sharing on or off, or unlink, any time in My Supervisors. Turning sharing off or unlinking takes effect immediately, and no email is sent. A supervisor only ever sees whether you share right now, never a history of your choices. Your notes and activities are never shown, whether you share or not.

In the Licensure module, a supervisor you send a review link to can see your name, your license track type, the date range you chose, and weekly totals, by type, of the hours you attributed to them. The link works for 30 days, or until you cancel the request. Once your supervisor responds, the link keeps showing what they reviewed until you remove the review in My Supervisors. The review email itself also lists the hours for that period by type, with each week's total, so a copy stays in their inbox. They never see your notes, your activities, your overall progress, or hours you logged with anyone else. Anyone the supervisor forwards the email or the link to could see the same summary, because the link itself is the credential. This only happens when you explicitly request a review.

No one else. Other users see your data only through a supervisor link you started or approved, or a review you requested. If you never link a supervisor and never request a review, no one else sees your hours. The database uses Row-Level Security policies that prevent any user from accessing another user's data, even at the database level. What a supervisor sees is prepared on our servers and never includes your notes or activities.

Where your data lives

MyPath runs on the following infrastructure providers, all based in the United States:

Supabase (database and authentication): stores your account and tracking data, hosted in US East
Vercel (application hosting): serves the app to your browser
Resend (email delivery): sends magic-link and support emails on our behalf
Google (OAuth, only if you sign in with Google): Google authenticates you and tells us your name and email; nothing else

These providers are bound by their own privacy policies. We've selected them specifically because of their privacy practices.

A note on HIPAA

MyPath is not a HIPAA-covered application. Here's why and what that means:

MyPath is intended for your personal record-keeping of hours and credentials. It tracks information about you (your hours, your supervisors, your CE activities), not about your clients.

You should not enter Protected Health Information (PHI) into this app. That includes client names, identifying details, diagnoses, session content, or anything that could identify a person you're treating. Activity and note fields are intended for general descriptions (e.g. "Individual therapy sessions" or "Group facilitation, treatment planning"), not for client-specific information.

If you keep your entries free of PHI, MyPath is a personal productivity tool, not a clinical record. We've designed the app around this assumption: it does not have the audit logging, business associate agreements, or other infrastructure that would be needed for a HIPAA-covered product.

If you have questions about what to write in your notes, err on the side of generality. Your licensing board cares about whether you logged the hours and worked with appropriate supervision, not about specific client details.

A note on AI

MyPath was built collaboratively with AI assistance, specifically Claude, an AI assistant by Anthropic. AI helped with code generation, design, and writing (including parts of this policy you're reading right now).

That said, here is our commitment regarding your data and AI:

We do not feed your data into AI tools for any purpose: not for product improvement, not for support troubleshooting, not for analytics, not for anything
We do not train AI models on your data: your entries are not part of any training set, ours or anyone else's
We have no AI features integrated into the app that read, analyze, or send your data anywhere
AI was used as a development tool only: the same way a developer might use a search engine or documentation. The code that handles your data runs on your behalf only.

If we ever add AI-powered features (for example, an AI assistant for compliance questions), we'll require explicit, opt-in consent, and we'll update this policy to disclose exactly what data the feature uses and how.

Cookies and tracking

We use a single session cookie set by Supabase to keep you signed in. We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts. We do not show ads.

How long we keep your data

Your data is kept as long as your account exists.

When you delete your account, your data is immediately and permanently deleted from our active database. Note that encrypted database backups maintained for disaster recovery may retain copies for up to 30 days, after which they are also permanently deleted. We cannot access these backups for any purpose other than restoring the database in a disaster.

If you help run MyPath, or someone invites you to, the admin console keeps a record of the admin actions you took, the invitations sent to your address, and any changes to your admin access, including your email address, after your account is deleted.

Your rights

You can, at any time:

Access your data: everything we have on you is visible to you in the app
Export your data: download your records from the app anytime
Correct your data: edit your name, profile, entries, and records directly in the app
Delete your account: self-serve from Settings, effective immediately

Children's privacy

MyPath is intended for adult mental-health professionals and graduate students. We do not knowingly collect information from anyone under 18.

Changes to this policy

If we change this policy materially, we'll email registered users about it and post the change in the app before it takes effect. The "Last updated" date at the top always reflects the current version.

Contact

Questions about this policy, or want to request something not covered here?

Email: hello@mypathapps.com