What we store, and how it's protected

Building a gameplan does require a free account, because the whole point is that it saves and comes back to you every time you sign in.

Once you are signed in, the work you do in the app saves to your private row in our database so it can come back on your next visit. That includes:

• Your intake answers: age range, the state or states you live in, branch, military job, service era, and current status. Earlier versions of the intake also asked for your city or town (optional). We no longer ask for it, and it was never used in your plan. If you gave one, it is removed from your saved plan the next time you open VetPath while signed in.
• Your separation month, if you give it. It is optional, and it is used only to put real dates on your timeline, on your calendar feed if you subscribe, and in the check-in emails if you opted in to them. Its one other use: if you are on active duty and left the question about how far out separation is blank, it fills in that answer.
• Your VA disability rating, if you tell us.
• Your employment and housing situation, including if you indicate housing is unstable.
• Sex and race or ethnicity, if you choose to answer. Both questions are optional.
• Your goals, priorities, and pay target.
• The note you can add at the end of the intake, in your own words. It is shown back to you on your plan, and on your printout only if you tick the box. The plan's rules do not read it.
• Your generated gameplan and which steps you have checked off.
• Your Pathfinder answers and, if you use the resume scanner, the resume text you paste in.
• The notes you add to your plan from your profile or a task, up to 4,000 characters each.
• The dates you open VetPath while signed in - just the date, not the time or the pages you looked at. We only ever count these as totals, to learn whether people come back.
• If you get check-in emails, a record of which ones we sent and when, so no one gets the same email twice.
• Display settings like your theme and text size.
• If you use the feedback box, the note you write and the page you sent it from. If you used a "Report an error" link, the note also names the item you were reporting, shown to you above the box before you send. Notes are linked to your account when you are signed in, anonymous when you are not, read by the founders, and never published.
• If you first arrived from one of our flyers, QR codes, or shared links, the campaign tag on that link (for example "vso" for the sheet we hand to veteran service posts), plus the site that referred you. If you arrived through an app's built-in browser (like Facebook's) that hides the referring site, we note just the app's name as the channel instead. If the link came from a partner office, such as a county veterans service office or a transition counselor, it also carries a short random partner code, and we note when you first used it. This tells us which outreach actually reaches veterans. It records how you found us - never what you did on other sites.
• If you open one of the free accredited-help links in your plan (the VA's representative search, a county veterans service office, or a veterans service organization's service officers), a yes and the date you first did. Nothing about who you contacted or what you did on those sites.

Your password is never seen or stored by us. Sign-in is handled by our authentication provider, which stores only a hashed version that cannot be read back.

Every one of those questions is optional. You can build a useful plan without answering any of them. We ask only because some programs are specifically aimed at those groups, and skipping the question means we cannot point you to those programs. We do not use this information for anything else.

• Supabase hosts our database and handles sign-in. Your saved plan and your login live there, in Amazon Web Services' West US (Oregon) region.
• Resend delivers our emails: account emails like password resets, and check-in emails if you have them on. It receives your email address, your first name, and the email itself, which can mention your transition phase and how many steps you have checked off - nothing else from your plan.
• GitHub Pages serves the website itself. Like any web host, its servers log the IP addresses that request pages.
• GoatCounter counts page views anonymously so we can tell which pages actually help. No cookies, no personal identifiers - it cannot tell who you are, and neither can we. Explained plainly below.

Fonts and icons are served from this site directly, not from a font network, so no additional service learns that you visited.

Nobody else. No data brokers, no advertising networks, no lead buyers.

Each partner office gets a private report with counts only: how many accounts came through its code, and how many of those built a plan, checked off a step, gave a separation date, reached the pre-discharge claim window, opened a free accredited-help link, or said yes to email check-ins, plus the total number of steps checked off once at least five people have checked one. Any count from 1 to 4 shows as "<5", so small groups are harder to single out. Partners see totals, never a list of people. The report has no way to show a name, an email address, an answer, or a plan, and partners never get access to our database.

A partner code changes nothing about your plan. The plan is the same, and free, with or without one.

• We do not sell, rent, or trade your information.
• We do not run advertising scripts, tracking pixels, or cross-site tracking of any kind. The only measurement on this site is the anonymous page counter described in the next section.
• We do not use your answers to train any AI model. Your plan is produced by fixed rules we wrote, not by a language model.
• We do not share anything about you with the VA or any government agency, and they do not see your account. If a county or state veterans service office hands out VetPath, it sees only the counts-only partner report described above.

Sponsored connections are not live. Down the road, VetPath may list home-buying professionals who know the VA home loan, such as lenders and real estate agents, as clearly labeled sponsored options. If that launches, these rules hold:

• Nothing about you goes to a partner unless you choose to contact them, and you decide what to share.
• Partners pay to be listed. They never pay for your contact details, and never per loan or per sale.
• Sponsorship never changes your plan, what it recommends, or the order of anything in it.
• It covers home buying only - never VA claims, benefit decisions, or business financing.
• This page changes before any of it goes live.

If we ever add advertising measurement, you will be able to switch it off for your device on the do not sell or share my information page, which works today and needs no account. We cannot look anyone up in the counter, and neither can anyone else - there is nothing personal in it to look up. It never sees what you type, your answers, or your plan; those follow the rules in the sections above. If your browser sends a Do Not Track or Global Privacy Control signal, we do not count the visit at all. GoatCounter publishes its own privacy policy at goatcounter.com/help/privacy.

Every safeguard, and what we have not done yet, is listed on our security page.

To delete your account entirely, open your profile and choose Delete my account. It removes your login and everything saved to it - plan, answers, notes, visit dates, email history, and feedback you sent while signed in - right away. We do not ask for a reason. If you would rather we do it, email us and we will. Delivery records our email provider keeps for a limited time, and short-lived service logs at our hosting provider, expire on their own schedule. What deletion covers.

• Your account and everything saved to it: for as long as the account exists, and gone right away when you delete it. We do not delete inactive accounts on a timer today; if that changes, this page changes first.
• Feedback sent while signed out: it has no link to any account, and it holds only the note you wrote and the page you sent it from.
• The anonymous page counter: totals only, with nothing in them that points back to you.
• Email delivery records at Resend and request logs at our hosting providers: kept by those services for a limited time and deleted on their own schedule.