Privacy

Account. Your email address, your display name, and — if you choose to share it — your clinical setting. That is the whole profile.

Learning activity. Your practice answers, review ratings, and the schedule of when each card is next due. This is what makes spaced review and your progress screens work.

Usage events. We record first-party events in our own database — an event name, such as a sign-in or a completed review, plus a few technical properties. Your email address is never stored inside an event.

Newsletter. If you subscribe, we store your email address and which page you signed up from.

Feedback. Messages sent through the feedback form are emailed to us. We do not keep a copy in the product database. A reply address, if you give one, is used only to reply.

Abuse limits. When you submit a public form, we briefly record your network address (IP) to limit abuse. These records are pruned automatically.

Four providers run the service, each only for its job: Supabase stores the database and handles sign-in. Resend delivers our emails. Vercel hosts the site and gives us aggregate page analytics that are not tied to your account. Stripe processes payments — your card number never touches our servers.

We use cookies to keep you signed in, plus one short-lived cookie that remembers your profile passed its setup check. Your theme choice is stored in your browser and never leaves it. There are no advertising or cross-site tracking cookies.

Account email — confirmation links and password resets — goes only to you, only when you trigger it. The newsletter goes only to people who subscribed. To stop receiving it, ask us through the contact page and we will remove your address.

Ask through the contact page and we will delete your account and the data tied to it. We will confirm when it is done.

If our practices change, this page and the date at the top change with them.

Anything unclear, or anything you think we got wrong — write to us through the contact page.