How we protect your family's data

Accounts are protected with email + password sign-in and optional Google sign-in. Sessions use industry-standard tokens stored in your browser.

Role-based access (student, parent, teacher, admin) is enforced on the server. Permissions are not trusted from the browser.

Student records, assignments, and submissions are stored in a managed Postgres database with row-level security so users can only read and write the rows they're entitled to.

File uploads (assignment submissions, professor photos) live in private storage buckets and are served via short-lived signed URLs — never via public links.

Path 2 Bright runs on the Lovable platform with traffic served over HTTPS. Secrets and API keys are stored server-side and are never bundled into the browser code.

This is a description of enabled capabilities, not a third-party certification.

We collect what's needed to run the school: account profile (name, grade level, parent email), enrollment and progress, assignment submissions, and quiz attempts.

Parent emails on student profiles are visible only to the student and to admins.

We use Lovable Cloud (database, auth, storage, edge runtime) and Lovable AI for tutoring/explainer features. Add other integrations here when enabled by Path 2 Bright.

Account and learning records are retained for the duration of your enrollment. To request export or deletion of your account data, contact us at the address below.

Lovable provides the platform controls (managed database, RLS, authentication, secret storage, HTTPS). Path 2 Bright configures the app's policies, content, and integrations. Families are responsible for keeping their account credentials private.

Found a vulnerability or have a privacy question? Email security@path2bright.com and we'll respond as quickly as we can.