Privacy Policy

1. Who is responsible

A Path is Formed by Walking Inc. is federally incorporated in Canada and based in Ontario. We operate Laurel and are responsible for personal information under our control. Our privacy contact is support@laurel.now. You can also write to us at 350 Bay St, Suite 1300B, Toronto, ON M5H 2S6, Canada.

2. Information we handle

We collect information you provide, information generated through learning, and technical information needed to operate Laurel.

• Account information: your Apple or Google account identifier, the name and email the provider supplies (including an Apple relay address), username, chosen campus, exam target date, account and session identifiers, and Terms/age acknowledgment with its acceptance time and Terms effective date. Authentication credentials are used to establish and protect your session.
• Learning information: examinations and study selections, delivered activities, answers, completion and activity times, feedback, saved progress, and derived mastery, readiness scores. These scores personalize study and support rankings; they are not official exam results.
• Privacy preferences: your recorded adult-status eligibility, optional-analytics choice, and associated acknowledgment and consent records. We do not collect or check your residence for analytics, and we do not ask for your birth date or precise location for this purpose. Your chosen campus and its directory location are separate from your residential location.
• Purchases and referrals: subscription status, store and entitlement identifiers, purchase-related events, referral codes and connections, and reward eligibility. Laurel does not receive your full payment-card number from an app-store purchase.
• Technical information: requests, IP addresses, device/app and operating-system information where supplied, error and security logs, and local storage needed for sign-in, preferences, and offline study. Optional product analytics is described separately below.
• Communications and website submissions: the information in support correspondence and ticket receipts (including reply email, message, and attached account/device context), waitlist submissions, beta applications, learner interest forms and organization capability requests, including name, email, school/program, expected exam month, device type, and availability where requested; a learner’s current or target credential, expected completion month and location; and an organization’s company, capability needed, geography, approximate number of people needed, and contact name and work email. Temporary forms may be removed while previously submitted information is still held under this policy.
• Reports and blocks: when you report another learner, we process your account identifier, reply contact, explanation and included account/device context, together with the reported account’s identifier and username at the time of the report. We keep report-delivery records and an account-linked block relationship. Report correspondence is handled through our support provider, Zoho Desk.

3. How we use information

We use this information to create and secure accounts, provide and synchronize learning, generate and improve educational material, estimate readiness, display leaderboards, administer subscriptions and referrals, respond to requests, arrange beta participation, and prevent misuse. We also keep records needed to comply with law and resolve disputes. Access by our team is limited to people who need it for these purposes.

We use reports and block records to investigate abuse, respond to concerns, enforce our rules and hide blocked usernames from the reporting learner’s leaderboard views. Blocking does not remove the other learner’s ranking, score or prize information, or by itself delete their account.

Optional analytics helps us understand how features are used and where the app needs improvement. Declining it does not prevent study, change your saved progress, or disqualify you from a competition. Essential learning records and security processing remain necessary to provide the service.

We do not sell personal information or use it for targeted advertising. We do not give identifiable learning information to employers for their purposes unless you make a separate choice. A materially different optional use will require a new notice and any consent required by law.

4. Leaderboards and other learners

Leaderboard participation is automatic for accounts meeting the displayed activity criteria. Other learners may see your username, campus affiliation, rank, current readiness score and monthly readiness change in global or campus leaderboards. Your answers, provider email and legal name are not leaderboard fields. Choose a username that does not identify you if you prefer; a campus and username can still make someone recognizable.

Your account can have referral relationships and associated reward status. We do not share your private study answers through referrals. Contact us with questions about access or disclosure, or use account deletion if you no longer want to participate in Laurel.

5. Optional analytics and your choice

Open the app menu, choose Profile, and find Help us improve Laurel. This optional analytics switch saves independently of the profile Save button. The minimum-age acknowledgment used to create an account is separate from analytics consent. Contact support@laurel.now to request correction of your recorded adult status.

Optional analytics is off unless you opt in through the separate optional sign-in checkbox or, when available for your account, the Profile switch. Selecting the sign-in checkbox records analytics consent and an adult-eligibility value on your account. Collection requires a record indicating that you are an adult and your explicit consent; it remains off if the record indicates you are a minor, eligibility is unknown or a permission check fails. We do not collect or check residence for analytics. You can leave the checkbox unchecked and continue studying, and you can turn analytics off in Profile. The Profile switch cannot enable analytics while adult eligibility is unconfirmed.

When permitted, we send PostHog a limited set of app-use and service events, such as screen visits and learning-completion outcomes, associated with your account UUID. Some events include study-filter use and your selected campus’s identifier, name, country, province or state, and city from our campus directory. Campus information describes your selected institution, not your home address, precise location or device location. We do not send personal names, email addresses, credentials, question text, answer content or raw error messages in these events. We do not record sessions or screen replays or use these events to build advertising audiences.

Switching off immediately stops new mobile event delivery. The choice is saved to your account when connectivity permits and is checked before server delivery to PostHog. A request already admitted may finish. If a change cannot synchronize, the app pauses mobile analytics and shows retry feedback; reconnect to apply the choice to server processing and other devices. Other devices refresh their local setting at their next check. Switching off does not itself erase earlier events; you can request deletion or delete your account.

6. Providers and international processing

We use service providers for hosting, databases and storage (including Railway), identity verification (Apple and Google), educational AI generation (including OpenAI), app distribution and subscriptions (including Apple and RevenueCat), support correspondence and ticket handling (including Zoho Desk’s Canadian service), and permitted product analytics (PostHog). We disclose the information needed for their role. An identity provider or app store also handles information under its own policy when you use its service.

Educational prompts and source/context material are processed by AI providers to produce learning content. Optional-analytics choices govern PostHog events, not the processing needed to provide requested learning features.

Information may be stored or processed outside your province or country, including in the United States. Our PostHog project uses its US service. Foreign courts, law enforcement or other authorities may have lawful access under local law. We use contractual and technical safeguards appropriate to the processing; contact us for information about our providers and cross-border practices.

We may disclose information where law requires it, to protect people and the service, or in a business transaction subject to appropriate confidentiality and continued privacy obligations. We do not treat such a transaction as permission for unrelated new uses.

7. Competition verification, when offered

If a cash competition is offered and you provisionally win, we may collect eligibility declarations, guardian involvement when required, contact and payment details, and redacted official evidence that you actually sat the NCLEX-RN after joining Laurel. Passing is unnecessary. The Competition Rules explain the acknowledgment and proof deadlines. We do not require a purchased results report.

Keep only the details needed to connect you to a completed sitting and its date. Redact candidate identifiers, scores, addresses, unrelated records and other unnecessary information. We use proof to resolve the claim, prevent duplicate or fraudulent claims, and apply any winning-month restriction identified in the applicable published schedule. A payment provider may separately require identity or tax information.

Redacted proof is deleted within 30 days after the claim is resolved, unless a dispute or legal obligation requires longer. We retain a minimal record of identity matching, the competition and winning month, verification/payment status, and any outstanding reservation for as long as needed to administer claims, prevent fraud, resolve disputes and apply any participation restriction in the applicable published schedule. This record does not require keeping the proof document or exam score. Prize publicity beyond disclosures required to administer or report the competition requires a separate choice.

8. Retention and deletion

We keep account and learning records while your account is active and needed to provide the service. Account deletion removes the account and its linked study records from our active application database and queues deletion of its PostHog information. Deleting optional analytics alone does not delete study progress.

Deleting your account removes your account-owned block relationships and report-delivery metadata from the active application database. Support-provider correspondence follows the support retention period described in this section. If another learner has reported your account, evidence in that report can remain after your account is deleted where needed to investigate the report, prevent abuse or resolve a dispute, subject to the retention limits described in this policy.

For optional analytics, we initiate provider deletion when the oldest events in a learner’s collection cycle reach 12 months. New collection pauses during that deletion. Deletion may also remove newer analytics for the same learner. We track provider completion and retry failures; delivery can resume only after completion and a permitted account preference. Provider processing is asynchronous, so physical removal can finish after the 12-month point or an account-deletion request.

Waitlist, beta application, learner interest and organization capability request records are deleted after 12 months without meaningful engagement, such as a renewed submission or substantive follow-up. Automated mail does not restart that period. Resolved support correspondence is deleted 24 months after resolution. Competition proof and minimal eligibility records follow the periods above.

Limited transaction, fraud-prevention, security, consent and dispute records may need longer retention where law or an unresolved matter requires it. An app store or purchase provider may retain its purchase ledger even after Laurel account deletion, and deleting an account does not cancel a subscription. Backups and provider security records follow their applicable retention cycles and may remain after deletion from active systems. We do not promise an immediate purge from every backup or a fixed provider-completion time. Data retained for these limited purposes is not a reason to continue optional analytics.

9. Access, correction and concerns

You can edit supported profile fields, change privacy choices, and request account deletion in the app. Contact support@laurel.now to request access, correction, deletion, information about processing, or withdrawal of consent. We may need proportionate identity verification and will explain any lawful limit on a request. Withdrawal may affect a feature that needs the information, but optional analytics is never required for study.

Laurel requires users to be at least 13 years old, or 14 in Quebec, and to have parent or guardian permission where required. If you believe an ineligible child has provided personal information, please contact us so we can investigate and address it.

We will respond to privacy requests within the applicable legal time limits. You may also contact the Office of the Privacy Commissioner of Canada or your relevant provincial or state privacy authority, including Quebec’s Commission d’accès à l’information. You do not have to give up these rights to contact us first.

10. Changes to this policy

We will publish changes with a new fixed effective date and provide additional notice for material changes. Where a new purpose or optional activity needs consent, we will obtain it before beginning that processing. This policy takes effect on publication on the effective date shown above.