Privacy Policy

1. Overview

DocPrep (docprep.netlify.app) is a static, open-access question bank. We respect your privacy and collect minimal data. This policy explains what data we handle and how.

2. Data We Do NOT Collect

• No personal information when browsing (no tracking, no analytics cookies)
• No IP address logging beyond standard server logs
• No behavioral tracking or fingerprinting
• No advertising identifiers

3. Data Collected with Your Consent (Optional Account)

If you choose to create an account (via Google OAuth or email magic link), we store:

• Auth data: Email, name, profile picture (from Google), or email only (magic link) — managed by Supabase Auth
• Bookmarks: Question IDs you save
• Personal notes: Your private notes on questions
• Difficulty ratings: Your Easy/Medium/Hard ratings per question
• Collections: Your custom question collections
• Suggestions: Content suggestions you submit (with optional name)

4. How We Use Your Data

• Auth data: To identify you and persist your session
• Bookmarks/notes/ratings: To show your saved content across devices
• Suggestions: To improve the question bank
• We do not sell, rent, or share your data with third parties

5. Data Storage & Security

• All user data stored in Supabase (PostgreSQL + Auth)
• Data encrypted at rest and in transit (TLS 1.2+)
• Row Level Security (RLS) ensures users only access their own data
• We do not store passwords — authentication is handled by Supabase/Google

6. Third-Party Services

• Supabase: Database, Auth, Storage (privacy policy: supabase.com/privacy)
• Google OAuth: If you sign in with Google (privacy policy: policies.google.com/privacy)
• Netlify: Hosting, CDN, form handling (privacy policy: netlify.com/privacy)
• Pagefind: Client-side search index (runs entirely in browser, no data sent)

7. Cookies & Local Storage

• theme: LocalStorage key storing 'light' or 'dark' preference
• docprep-auth: Supabase Auth session token (HttpOnly cookie via Supabase)
• sourceFilter: SessionStorage for source file filter preference
• No third-party tracking cookies

8. Your Rights

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Erasure: Delete your account and all associated data
• Portability: Export your bookmarks/notes in JSON
• To exercise these rights, email docprepaiims@gmail.com

9. Data Retention

• Account data: Retained until you delete your account
• Supabase Auth retains session data per their policy
• Anonymous suggestions: Retained for content improvement

10. Children's Privacy

DocPrep is intended for medical students (typically 18+). We do not knowingly collect data from children under 13. If you believe a child has provided data, contact us for deletion.

11. Changes

We may update this policy. Material changes will be posted on this page with an updated date.

12. Contact

Privacy questions: docprepaiims@gmail.com