What we collect, and what we don't.

The short version

MentorForge is a study-planning and scheduling tool. We collect the minimum we need to build your plan, nudge you at the right times, and keep your account secure. We do not sell your data, we do not run ads, and we do not train AI models on your study history. When you delete your account, we delete your data.

What we collect

At sign-up:

• Your email address and a hashed password (we never see the password in plain text).
• Your first name, so we can address you like a person.

During onboarding (all optional unless marked otherwise):

• CFA level, exam date, weekly hours, preferred study times — required for plan generation.
• Last name, credential type, primary study challenge, employer type, and how you heard about us — all optional, used to improve the product and personalize communications.

As you use the product:

• Study sessions you log, rebalances you run, and Calendar Coach windows you accept or skip.
• Survey responses you choose to answer in weekly digests or cap-hit prompts.
• Privacy-respecting page analytics via Plausible — no cookies, no cross-site tracking, aggregate only.

Calendar data

Calendar Coach needs to know when you're busy so it can find study windows in your real schedule. When you connect Google Calendar or Outlook we store:

• Event start and end times.
• Busy / free / tentative status.

We never store, read, or display:

• Event titles or descriptions.
• Attendees, organizers, or meeting links.
• Attachments, locations, or any other event content.

OAuth access tokens and refresh tokens are encrypted at rest. You can disconnect a calendar from your account settings at any time — we immediately stop syncing and delete the stored busy/free windows.

How we use your data

• Generate and maintain your study plan.
• Find study windows in your calendar and send notifications or emails about them.
• Send transactional email (welcome, weekly digest, cap-reached, receipts).
• Process payments via Stripe if you subscribe to All Access.
• Understand how people use the product so we can improve it.
• Respond to you when you contact support.

We do not sell your personal information. We do not use your data to train machine-learning models outside of MentorForge. We do not target advertising at you.

Third parties

We use a small number of service providers to run MentorForge:

• Supabase — authentication and database hosting.
• Vercel — application hosting.
• Stripe — payment processing for All Access subscriptions. We never see your full card number.
• Resend — transactional and digest email delivery.
• Google & Microsoft — OAuth providers for calendar sync and sign-in.
• Plausible — privacy-respecting analytics (no cookies, no IP storage).
• OpenPhone — the phone number we use for direct support. Only used if you reach out to us.

Your rights & account deletion

You can, at any time:

• Export or download the personal data we hold on you by emailing us.
• Delete your account from /app/account. Deletion cascades through our database and removes your profile, plan, calendar connections, study sessions, survey responses, and stored tokens.
• Disconnect a calendar without deleting your account — we stop syncing and remove cached busy/free windows immediately.
• Unsubscribe from the weekly digest via the link in the email footer.
• Email us to correct or remove a specific data point.

If you're in the EU, UK, or California and want to exercise formal rights under GDPR, UK-GDPR, or the CCPA, email us with your request and we'll respond within 30 days.

Retention

• Account and profile data: kept for as long as your account exists. Deleted on request.
• Calendar busy/free windows: re-synced regularly and expire automatically after they're no longer relevant for scheduling.
• Payment records: retained per Stripe's requirements and applicable accounting law.
• Support conversations: kept until the issue is resolved plus up to two years, then deleted.

Security

All traffic is served over HTTPS. Passwords are hashed; we never see them in plain text. OAuth tokens are encrypted at rest. Our database enforces row-level security so a user can only read their own rows. No system is perfect — if you discover a security issue, please email us at the address below and we'll respond quickly.

Children

MentorForge is built for working professionals preparing for adult financial credentialing exams. It is not intended for children under 16, and we do not knowingly collect data from them.

Changes to this policy

If we materially change this policy we'll update the "Last updated" date at the top and, for significant changes, email registered users before the change takes effect.

Contact

Questions, deletion requests, or data-export requests: email privacy@mentorforge.co. A real person reads the inbox.