What we keep. What we don't.
Genetic data is unusually sensitive. Rather than promise abstractly that it's “safe,” here's what Pathway actually does with your DNA file — and, more importantly, what it doesn't do.
Claim 1
Your DNA file is parsed in your browser
When you upload your 23andMe or AncestryDNA archive, the decompression and parsing happen locally in the browser tab. The bulk of your file — hundreds of thousands of variants that Pathway does not use — never leaves your machine.
Claim 2
The raw genome file is never stored on our servers
There is no upload endpoint that receives your original file. Only the small set of variant calls Pathway actually scores is sent to the server — nothing else from the archive is transmitted or persisted.
Claim 3
Only a small set of variant calls is retained
Roughly 32 specific variants — the ones Pathway's scoring engine actually uses — are retained and tied to your account. These are the calls that appear on your report and drive your supplement stack. See the full list.
Claim 4
Per-user isolation is enforced at the database level
Every table that holds user data has row-level security enabled in Postgres, with per-operation policies scoped to the signed-in account. Even if an application-code bug tried to read another user's rows, the database would refuse. This is a defense-in-depth control that runs regardless of what the app layer does.
Claim 5
You can delete your data at any time
A single action in your settings screen removes your variant calls, your report, your supplement history, your tracker log, and your account itself. The one exception — a hashed consent audit row kept for legal reasons, with no way to link it back to a person from the hash alone.
What Pathway does not claim
A short list of things it would be easy to write on a marketing page — and that Pathway does not, because they aren't measurable or aren't independently verified:
- No claim of “bank-level” or “military-grade” anything — those terms don't have defined meanings.
- No compliance certifications advertised (HIPAA, SOC 2, GDPR) unless and until the underlying audit or legal work is actually done.
- No guarantee of absolute safety. No consumer product can honestly promise that.