Summary
Key points
- You can explore Pathway anonymously without an account, or sign in with Google to save assessments and monitor recourse plans.
- When signed in, your assessment data and recourse plans are stored in Supabase PostgreSQL protected by Row-Level Security (RLS) so only you can access your data.
- We request only basic Google profile information (name, email, avatar). We never request access to Google Drive, contacts, or external accounts.
- You have complete control: you can delete individual assessments or permanently purge all account data at any time from the Dashboard.
Who we are
Pathway is an open-source hackathon prototype and educational credit recourse simulation built by the Pathway contributors (“we”, “us”). For the processing described here, the Pathway contributors are the data fiduciary under India’s Digital Personal Data Protection Act, 2023, and the controller under GDPR-style laws. You can reach us through the channel in Contact and grievances.
What we process and why
Numbers you enter
The applicant tool asks for monthly income, credit card utilisation, debt-to-income ratio, number of open credit lines and counts of late payments, plus an optional display name. It does not ask for age, dependents or real-estate loans: the model does not use them.
We use these figures to calculate your simulated Pathway credit score, reason codes, recourse action plans, Monte Carlo uncertainty bands, and interest savings estimates.
Your numbers are in the page address
So that results can be shared and bookmarked, the numbers you enter, and the optional display name, are encoded in the page’s URL (the part after “?”). As a result they can appear:
- in your browser history and bookmarks;
- in any link you copy or share, where whoever receives it can read them;
- in the standard request logs kept by our hosting provider.
Our referrer policy stops your browser from sending this full address to other websites you open from Pathway; they see only our domain name.
Please do not enter your real name or exact figures you consider sensitive. Rounded or example numbers work just as well for exploring.
Optional AI rewrite
If you press “Rewrite in simpler words (AI)” and the site has an Anthropic API key configured, our server rebuilds the plain-language summary from your numbers and sends that summary to Anthropic’s API to reword it. The summary includes the display name and some figures, such as your score and the main reason. We do not store the request or the reply. Anthropic processes it under its own privacy policy (external website). If no key is configured, nothing is sent and you see the built-in text.
Technical data
Like any website, requests to Pathway pass through our hosting provider, Vercel, which may process request metadata such as your IP address, user agent, timestamps and the requested URL (including the part with your numbers) in logs, for security and operations. To prevent abuse of the AI rewrite, our server also keeps a short-lived count of requests per IP address in memory; it is never written to disk and expires within about a minute.
What we do not do
- We use no analytics, advertising or tracking tools, and build no profiles.
- We do not sell, rent or trade personal data, or share it for advertising.
- We make no decisions about you. The Pathway score is a simulation and is not used to decide anything outside this page.
Accounts and Google Authentication
Authentication is powered by Supabase Auth using Google OAuth. When you click “Continue with Google”, we receive your verified Google identifier, name, email address, and profile picture.
We do not receive or store your Google password, nor do we request permissions beyond standard OpenID Connect profile info.
Database storage and Row-Level Security
When signed in, assessments, recourse plans, simulations, pricing results, and recorded outcomes are persisted in Supabase PostgreSQL.
Every table enforces database-level Row-Level Security (RLS). Database policies verify that auth.uid() = user_id, preventing any user from reading or modifying another applicant’s assessments or simulations.
Legal basis and consent
India (Digital Personal Data Protection Act, 2023). We process the figures you voluntarily enter only for the purpose you enter them for, which is showing you results, and with your consent, which you give by entering them and pressing the buttons that use them. Optional storage, such as the money-cursor setting, is used only after you agree in the cookie banner.
EU and UK visitors (GDPR-style laws). Processing your entries is necessary to provide the tool you ask for. Host logs and rate limiting rely on our legitimate interest in keeping the Service secure. Optional functional storage relies on your consent.
You can withdraw consent at any time, as described in Your rights. Withdrawing it does not affect processing that already happened.
How long data is kept
- Your entries: we keep none. They exist in your browser and in any URLs you keep or share, until you delete them.
- AI rewrite requests: not stored by us. Anthropic retains data under its own policy.
- Host logs: kept by Vercel for the period set out in its privacy policy (external website), for security and operations.
- Rate-limit counts: in memory only, cleared within about a minute or when the server instance restarts.
pathway_consentcookie: 180 days.sb-<project>-auth-token: until you clear site data or withdraw consent.
International transfers
Vercel and Anthropic may process data on servers outside India, including in the United States, under their own safeguards and policies. Request logs, and the summary sent when you use the AI rewrite, may therefore be processed in those countries.
Security
- HTTPS everywhere, with HTTP Strict Transport Security.
- Security headers, including a Content Security Policy that allows only verified assets, protection against clickjacking, strict referrer policies, and disabled dangerous permissions.
- Row-Level Security (RLS) on PostgreSQL tables to ensure user data isolation.
- Server-side Zod validation of all numbers and UUID parameters.
- Same-origin checks, request size limits, and rate limiting on API endpoints.
No system is perfectly secure. If you find a problem, please report it through the contact channel.
Your rights & data deletion
Under India’s Digital Personal Data Protection Act, 2023, the GDPR, and similar international laws, you have the right to:
- Access all personal assessments, recourse plans, and simulations stored in your account.
- Have your data erased completely (“Right to be Forgotten”).
- Withdraw your consent and sign out at any time.
How to exercise them
- Erase account data: Use the “Permanently Delete My Data” button inside your Dashboard to immediately purge your profile, assessments, recourse plans, simulations, and outcomes from Supabase.
- Delete individual assessments: Click the trash icon next to any assessment in your Dashboard history.
- Withdraw cookie consent: Use Cookie settings in the footer.
For anything else, such as a question about host logs, use the contact channel. If you are not satisfied with our response, you may approach the Data Protection Board of India under the Act, or your local data protection authority.
Children
Pathway is not directed at anyone under 18, and we do not knowingly process children’s personal data. If you are under 18, please do not use the Service. If a child has entered personal data, the steps under Your rights remove it from the device; nothing is stored on our side.
Changes to this policy
We will update this policy when features or processing change, and change the “Last updated” date at the top. Earlier versions stay visible in the public history of the source repository (external website).
Contact and grievances
Pathway does not publish a personal email address. Questions, requests and grievances go through the project’s public GitHub issues (external website) (github.com/viralala/pathway-credit-recourse/issues). Please do not include personal or financial details in a public issue: describe your request in general terms and a maintainer will reply there with next steps.