Privacy Policy
Effective Date: October 31, 2025
Last Updated: 2026-10-26
We respect your privacy and are committed to protecting your personal information.
What We Collect
Account Info: Email, name, military background (if applicable)
Resume Data: Work history, skills, education, certifications
Usage Analytics: Pages visited, features used, device type
Payment Info: Handled by Stripe (we never see your credit card)
How We Use Your Data
We use your data to:
- Provide personalized career roadmaps
- Power Cipher AI with career context
- Track training progress and unlock features
- Improve the platform
We do NOT sell your data to third parties.
Google user data
Google user data. If you connect Google Calendar, Cyber Wingman asks for permission to create events on your calendar (scope calendar.events). We use it only to add the roadmap milestones you choose to export, and to delete those same events if you ask us to when you disconnect. To do that we store the Google ID of each event we create. We do not read, list, change or delete any of your other events. If you connect Google Drive, we ask for drive.file, which lets us create and edit only the resume documents we create for you. We do not access your other files. Access tokens are encrypted and stored on our servers, are used only for these exports, and are never sold or shared. You can disconnect at any time in Settings, which deletes the stored tokens and, if you choose, also removes the events Cyber Wingman added. You can also revoke access at myaccount.google.com/permissions. Cyber Wingman's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Third-Party Services
We use these services to operate the platform:
- Supabase Auth: Authentication
- Stripe: Billing & payments
- Supabase: Data storage
- Anthropic/OpenAI: AI features (Cipher, resume optimization)
- Stream Chat: Community messaging
- Vercel: Hosting
Your Privacy Rights
You can:
- Access and export your data anytime
- Delete your account (data removed within 30 days)
- Opt out of email notifications
- Disconnect TryHackMe/Credly integrations
GDPR & CCPA rights available upon request.
Data Security
We implement:
- HTTPS encryption for all data in transit
- Encrypted storage (Airtable)
- API key rotation and access controls
- Rate limiting to prevent abuse
We cannot guarantee 100% security (no system is completely secure)
Age Requirements
Users must be 13 years or older.
If you are between 13-17, you must have parental consent to use Cyber Wingman.
Parents: Contact support@cyberwingman.ai to review your child's account or request deletion.
Cookies & Tracking
We use cookies for:
- Authentication (session management)
- Analytics (understanding how users navigate the site)
- Feature preferences (dark mode, sidebar state)
You can disable cookies in your browser, but some features may not work.
Data Retention
Active accounts: Data retained indefinitely while your account is active
Deleted accounts: Data permanently removed within 30 days of deletion request
Backups: May persist in encrypted backups for up to 90 days
Legal obligation: We may retain certain data if required by law (e.g., tax records)
California Residents (CCPA)
Your CCPA Rights:
- Right to Know: Request what data we collect about you
- Right to Delete: Request deletion of your personal information
- Right to Opt-Out: We do NOT sell your personal information
- Non-Discrimination: We won't discriminate for exercising your rights
To exercise these rights, email: support@cyberwingman.ai with subject "Privacy Request"
International Users & Data Transfers
Cyber Wingman is based in the United States (Hawaii).
If you access our services from outside the US: Your data may be transferred to and processed in the United States.
By using our services, you consent to this transfer and processing.
EU Users: We comply with GDPR. Contact us to exercise your data protection rights.
🔒 View full Privacy Policy above or share this page: cyberwingman.ai/privacy