Privacy Policy

• Your email address — used to create and sign in to your account. If you sign in with Apple or Google, we receive the identity token they issue and the email address associated with it (Apple lets you hide your real address; the relay address works the same way for us).
• Content you submit — skills and practice hours, daily activity logs, work experience and education entries, books you have read, job vacancy postings you paste or link for analysis, and family/kids' education-track data if you use those features. This content is your career record; you own it.
• Basic usage data — which screens and features are used inside the product, and crash reports from the iOS app.

We do not collect data about you from other sources or buy data about you.

Your data is used to power the features you see in the product itself: your skill record and knowledge sphere, career and vacancy matching, learning recommendations, shared streaks with friends, and family education planning. We do not use it for advertising.

Activity descriptions you log, the text of a CV you upload, and job postings you submit are processed by an AI model (Anthropic's Claude, via the Anthropic API) solely to extract structure: skills, experience and education entries, classifications and matches. The extracted results are stored in your own account. This text is not used for advertising, and we do not train models on it.

You can connect your account to an AI assistant such as Claude through our MCP connector. This works only after you explicitly authorize the connection on our consent page. An authorized assistant can read your record (skills, activities, career history, tracked vacancies) and log new entries — acting as you, within your account. You can revoke this access at any time; revoking it invalidates the assistant's tokens. We do not see or store your conversations with the assistant — only the specific requests it makes to your record.

The SFT iOS app can import workouts from Apple Health (HealthKit), but only when you explicitly opt in and select which workouts to import.

• What we receive and store — the workout type and duration of the workouts you select, and nothing else. We do not receive heart rate, routes, or any other health metric.
• Why — to convert training time into logged activities and skill hours on your own profile.
• Limits — health data is never used for advertising, never shared with third parties, and is deleted together with your account.

Reading Apple Health data requires your permission through the iOS HealthKit prompt, and you can revoke that permission at any time in iOS Settings.

Your record is stored in our own database on infrastructure we operate (hosted on DigitalOcean in the United States). Encrypted backups are stored off-site. Access to your records is enforced by our API: each account can read and write only its own data, plus the specific things friends choose to share with each other.

• Anthropic — processes the text described in "AI processing" to power extraction and analysis features.
• Stripe — processes payments for Pro subscriptions. Card details are entered directly with Stripe; we never see or store full card numbers.
• Apple and Google — issue the sign-in identity tokens if you choose to sign in with them, and deliver push notifications (Apple) to your devices.
• Resend — delivers transactional email (for example, a friend-request notification). Every such email includes a working unsubscribe link.
• PostHog — processes product analytics events. Health data is never sent to PostHog.

We keep your data for as long as your account exists. You can permanently delete your account and all associated data at any time from Profile → Danger Zone inside the app. This removes your profile, skills, activity logs, experience and education entries, books, job analyses, family data and device tokens.

If you prefer, email us and we will delete your account and data on your behalf.

We do not sell your personal data to third parties, and we never have.

Education-track information about children entered by a parent in the Family feature is private. It is visible only to the parent who entered it and to their linked spouse. It is never shown publicly, never shared with other users, and never sold. The product itself is not directed at children under 13.

Traffic between the apps and the backend is encrypted in transit. Access control is enforced server-side on every request. Backups are encrypted before they leave our infrastructure.

For privacy questions or data-deletion requests, email contact@startfrom.today.

If we make material changes to this policy, we will update the date at the top of this page and, where appropriate, notify you in the app.