Privacy

Last updated October 17, 2026.

Who this is

Path of Mastery is run by Aaron Lilla, personally. I am the one who decides what happens to your data. You can reach me only by email at aaronjlilla@gmail.com. The app is for Windows.

The short version

The app keeps your builds and game data on your computer. If you sign in with Discord, you can also sync builds and publish to the Marketplace, and then the items below are stored on our servers. I do not sell your data and I run no ads or trackers.

Signing in with Discord

When you sign in, Discord gives us the account details we use to identify you: your Discord user id, your name, your avatar and your email address. Sign-in is optional. The free tools work without an account.

What is stored on our servers when you are signed in

• Synced builds. The full build file, its name, class, level, main skill, folder, the name of the computer that saved it, and older versions. When you save a build, versions older than 90 days (other than the newest) and any beyond 50 per build are removed. A build you delete stays as a marker so your other computers delete their copy too; the app asks the server to remove markers, and revoked share links, older than 90 days when it syncs.
• Other synced items. Your list of shared items and item sets, and your cloud-saved builds, Atlas plans, loot filters, timelines, notes and checklists with their folders and revision history (the "cloud objects").
• Share links. If you make a share link for a build, a copy of that build is stored with a secret link. Anyone who has the link can open it. The page shows the build name, class, level, main skill and stats. You can revoke the link.
• Marketplace activity. Your creator profile (display name, bio, links, avatar), the posts and revisions you publish, your votes, saves, collections, follows, run preferences and completions, feedback messages with other players, reports you file, and the moderation records about your posts.
• Community builds, strategy sessions and the bulk board. A build you publish to the community list (with the author name you give). If you choose to share it, the result of a finished Wealth strategy session: strategy, league, hours, maps and net divine per hour, with no item names, stash or character names. Bulk listings you post (seller name, items, prices), plus your vouches, reports and offers on other listings.
• Feedback you send from the app. Your message, the kind, your app version and platform, and the contact you type in. Signed-out players can send feedback too; that feedback is anonymous, not linked to any account (see "Deleting your data"). For limits against abuse we store a one-way hash of your network address, never the address. A short note with the start of the message (500 characters) may be posted to a private Discord channel so I see it.
• App installations. Each copy of the app makes a key pair; the public key, a hash id, a label and when it was last seen are stored so the site can tell requests from your copy. The Account page lists them and lets you revoke them.
• Pro and billing. Your plan, its status, when the period ends, and the Stripe customer and subscription ids.
• Abuse and AI-use records. Request counters and rate limits; a coarse record of recent actions (read, vote, save, publish, report, feedback) per account and installation, which is cleared of anything older than 2 days each time the check runs; and, only if a human check is triggered, the check result and a clearance. A daily total of AI spend is kept for the whole service, not per person, and is not deleted.
• Notify-me emails. If you ask on the Download page to hear about a Mac or Linux release, we keep that address and platform for that message.

What is public

Only what you publish on purpose. A published Marketplace post is visible to everyone: the post content, your creator display name and profile, and vote totals (never who voted). A share link is visible to anyone holding it. Community builds show the build, its stats and the author name you chose, never your account id. Bulk listings show the seller name you chose.

What stays on your computer

• Builds you do not sync (saved in a folder you can pick), your loot filters and their settings, Wealth history and stash snapshots, leveling progress and guide settings, and Journey's character links. All of these are files in the app's data folder on your PC.
• Your pathofexile.com session for Wealth, kept encrypted with your operating system's key store. It is sent only to pathofexile.com, never to us.
• Your Discord sign-in token, kept with the same key store (if none is available it lives in memory and you sign in again next launch).
• The game log (Client.txt). Journey and the loot filter read it on your computer to see which areas you entered. It is not uploaded.

Uploading a build to another website

The Import/Export tab can upload a build to a third-party site: Maxroll, pob.codes, pobb.in, poe.ninja or poedb.tw. The app asks you first. If you confirm, it sends the whole build (passive tree, items, skills and notes) from your PC straight to that site, which gets whatever is in the build file and your IP address. Anyone with the link can open it. This is not part of our service, so we cannot delete it or take it back; ask that site.

The AI assistant

The assistant runs on your own Claude or ChatGPT account through that provider's command-line tool on your PC. Your sign-in stays with that tool; we never see it. When you use the assistant, it can read the build you have open (and, when you ask, Wealth or loot filter data) and sends it to the provider you chose. That provider's terms and privacy policy apply to what it receives.

Who else handles data

• Supabase hosts accounts and all synced data.
• Discord handles sign-in. It also hosts the private channel where feedback notes and AI spend alerts go (the spend alert contains only dollar amounts).
• Vercel hosts this website and its server code.
• GitHub serves the installer download.
• Cloudflare Turnstile runs a human check, only when our signals say an account looks automated. Cloudflare gets what a browser sends it for that check.
• TypeSafe runs "Jev", our small model that settles close calls. We send it a short text: the question being decided, an Atlas planning summary (points, priority mechanics, reachable options, an optional question of up to 500 characters), or a Marketplace item you publish, for a spam check (that includes your creator display name, since it is public). Your email and account id are not sent.
• Stripe processes payments, but only if paid Pro starts later. Pro is free for signed-in users during the open beta and no payment is taken now. If it starts, Stripe gets your email and plan, and we never see your full card number.
• The app also calls pathofexile.com, poe.ninja, the Path of Exile wiki and GGG's content servers from your PC for game data and prices, and checks pathofmastery.gg for updates. Those sites see your IP address like any website.

How long we keep it

We keep your data until you delete it or delete your account. The only automatic clean-ups are the ones named above: old build versions (on save), deleted-build markers and revoked share links (when the app syncs), and abuse-check action records older than 2 days. Human-check records and your other rows stay until you delete your account. The daily AI spend total is a service-wide number with no account attached, and stays. Stripe keeps payment records as the law requires.

Deleting your data

You can use the app without an account, sign out at any time, and delete your account yourself, from the Account page on this site or the app's account menu. Deleting it takes effect at once, with no waiting period. It removes: your account and Discord sign-in record (user id, name, avatar, email); your synced builds, versions, folders, share links and shared items; your cloud objects with their history; your creator profile, Marketplace posts and revisions, and everything other players hold on those posts (votes, saves, runs, feedback); your own votes, saves, collections, follows, completions and run records; feedback threads and messages in both directions; reports and moderation records about you or by you; your community builds and reports, strategy sessions, bulk listings, votes and offers; your AI authorizations and sessions; your human-check state; your app installations; your Pro subscription record; notify-me emails for your address; and the feedback you sent while signed in. Vote totals fall with the rows they are computed from. An active Pro subscription is cancelled with Stripe first, so you are not charged again. Builds saved on your computer are not touched.

Feedback you sent while signed out is anonymous: it is not tied to an account, so deleting your account cannot find it by account. The one exception is feedback whose contact field holds exactly your account email, which is removed with the account. To have any other signed-out feedback removed, email me at aaronjlilla@gmail.com with what you wrote and roughly when, and I will delete it. Stripe keeps its own records of past payments, as the law requires. Anything you sent to another website, such as a build upload, is outside our service (see above).

Cookies and local storage

This website keeps your sign-in session in your browser's local storage so you stay signed in, and a small flag in session storage on item pages. It sets no advertising or tracking cookies. The human-check page loads Cloudflare's script, which may set its own cookies.

Children

You must be at least 13 to use Path of Mastery, because Discord requires that to sign in, or older if the law where you live says so. We do not knowingly collect data from younger children. If you think we have, email me and I will delete it.

Changes to this policy

If I change this page, I update the date above. If a change affects what we do with your data in a way you would not expect, I will say so in the app or on the changelog.

Contact

Email aaronjlilla@gmail.com for any question or request about your data.