Privacy Policy
Effective date: May 22, 2026 · Last updated: May 22, 2026
1. Introduction
This Privacy Policy explains how Salvador Garibay Media LLC ("we," "us," "our") collects, uses, and protects your personal information when you use the Centra Path mobile application and related services (collectively, the "Service"). By using Centra Path, you agree to this Policy.
We've tried to write this in plain English. If anything's unclear, contact us using the information at the bottom of the page.
2. Information we collect
Information you provide directly
- Account information: your email address. We use a one-time password (OTP) for sign-in — we do not store traditional passwords.
- Profile information: your name, phone number, location, LinkedIn URL, portfolio URL, professional headline, professional summary, and profile photo if you provide one.
- Career data: work experience (companies, titles, dates, descriptions), education (institutions, degrees, fields of study, dates), and skills (name, level, category, years of experience).
- Documents: resumes, cover letters, and other documents you upload to the document vault. These are stored as files on our backend infrastructure.
- Application tracking data: companies you've applied to, roles, status, salary information, job descriptions, your private notes, and the timeline of events you record (status changes, interview scheduled dates, notes, document attachments).
- Reminders: reminders you create with titles, descriptions, and due dates.
Information collected automatically
- Usage analytics: events you trigger within the app (application created, status changed, document uploaded, AI feature used). We use this internally to improve the product. We do not sell this information.
- Device tokens: if you enable push notifications, we store your device's push token to deliver notifications. Tokens are linked to your account.
- Subscription state: via RevenueCat, we receive your subscription tier (free or Pro) and expiration date. We do not receive your payment details.
What we do NOT collect
- Payment card or banking information (handled by Apple, Google, and RevenueCat — never touches our servers)
- Your contacts, location beyond what you type in your profile, photos beyond the profile photo you upload, microphone, or camera
- Browsing history, advertising IDs, or behavior outside the app
3. How we use information
We use the information described above to:
- Provide the Service — display your data back to you, sync across devices, send password-less sign-in codes to your email.
- Power AI coaching features — when you tap an AI feature (resume suggestions, cover letter outline, interview prep), we send the resume text and job description you provide to OpenAI to generate suggestions. We do not retain a copy on OpenAI's side beyond what's required for them to deliver the response. You control when this happens.
- Send notifications — only the notifications you've enabled in your settings.
- Process subscriptions — verify your Pro status via RevenueCat to unlock paid features.
- Improve the product — analyze aggregated, anonymized usage patterns to make Centra Path better.
- Comply with legal obligations — respond to lawful requests from government authorities where required.
We do not use your data to train AI models, sell it to data brokers, or share it for advertising purposes.
4. Third-party services
Centra Path uses the following third-party services. Each has its own privacy practices.
OpenAI
We use OpenAI's GPT-4o-mini API to power the Pro-tier AI coaching features. When you trigger an AI feature, the relevant text (your resume, job description, etc.) is sent to OpenAI for processing. OpenAI's data usage policy is at openai.com/policies/api-data-usage-policies.
RevenueCat
We use RevenueCat to manage subscriptions across iOS and Android. RevenueCat receives a non-identifying user ID, your subscription tier, and your purchase events. Their privacy policy is at revenuecat.com/privacy.
Apple App Store and Google Play
When you purchase a subscription, the transaction is handled by Apple or Google. We do not receive your payment information. Their privacy policies govern that transaction.
Resend
We use Resend to deliver sign-in code emails. Resend processes your email address to send the message. Their privacy policy is at resend.com/legal/privacy-policy.
Hosting provider
Our backend is hosted on commercial cloud infrastructure (currently planned: Fly.io or Railway) in the United States. The hosting provider has access to encrypted data at rest but cannot decrypt it without our access keys.
5. Data storage and security
We store your data on US-based servers operated by commercial cloud providers. Data is encrypted at rest. Data is transmitted between your device and our servers over HTTPS (TLS 1.2 or higher).
We implement reasonable safeguards to protect your data, but no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
Document files you upload (resumes, cover letters, etc.) are stored on the backend's filesystem, isolated per user. Only you and authorized backend processes can access them.
6. Your rights
You have the following rights regarding your data:
- Access: request a copy of all the data we hold about you.
- Correction: update any incorrect information directly in the app, or by contacting us.
- Deletion: delete your account at any time through the in-app Settings. All of your data — profile, applications, documents, reminders, analytics — is deleted within 30 days.
- Export: request a portable export of your data in JSON format.
- Opt out of analytics: contact us to disable analytics event collection for your account.
- Subscription management: manage or cancel your subscription through your Apple ID or Google Account at any time. We do not handle subscription billing directly.
If you're a resident of the European Union, the United Kingdom, or California, you have additional rights under GDPR, UK GDPR, or CCPA respectively. We honor those rights for all users. Contact us to exercise them.
7. Children's privacy
Centra Path is not directed at children under 13 (or under 16 in jurisdictions where that is the applicable minimum). We do not knowingly collect information from anyone under those ages. If you believe a child has provided us with information, contact us and we will delete it promptly.
8. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you in the app and update the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance.