Privacy Policy

1. Information we collect

Information you give us when you create an account: your email address and a password (which is stored as a cryptographic hash, not in plain text).

Information you create while using the Service: exam log entries (such as procedure type, date, modality, your role, and any free-text notes you choose to add) and account preferences (such as your light/dark theme choice).

Information collected automatically:standard server logs (IP address, browser type and version, pages visited, timestamps), error reports (technical details of crashes or bugs we encounter), and security telemetry from our infrastructure providers (such as Cloudflare’s bot-protection signals). We use this information to operate, secure, and improve the Service.

What we do not collect: we do not collect, store, or process Protected Health Information (PHI), patient identifiers (names, MRNs, dates of birth, addresses, phone numbers), payment card numbers, government IDs, biometric data, precise geolocation, or your contacts. The Service has no fields for any of this.

2. How we use information

We use the information described above to:

• Create and operate your account.
• Provide, maintain, and improve the Service (including debugging, customer support, and product development).
• Send transactional emails like sign-up confirmations, password resets, and account or security notices.
• Send marketing emails about product updates, new features, and content we think you may find useful. You can opt out at any time using the unsubscribe link in any marketing email or by contacting us.
• Detect, prevent, and respond to security incidents, fraud, and abuse.
• Comply with legal obligations.

3. Subprocessors

We use the following vendors (“subprocessors”) to run the Service. Each one is bound by their own privacy and security obligations.

• Supabase— hosts our database, handles authentication, and stores your account data and exam logs.
• Vercel— hosts the AxialProgress website and processes server logs.
• Cloudflare— provides DNS, content delivery, and security services (including bot protection). Cloudflare may collect IP addresses, request headers, and related security signals.
• Resend— delivers transactional and marketing emails on our behalf.
• Sentry— collects error reports so we can find and fix bugs. Error reports may include technical context such as the URL, browser type, and an obfuscated user identifier.
• Discord— receives operational notifications when notable events happen (such as a new sign-up). These notifications include a limited subset of metadata (such as an email address); they do not include your exam logs or password.
• Google Analytics 4— helps us understand how the Service is used so we can improve it (which pages are visited, how visitors arrive, what devices they use). Google Analytics receives a pseudonymous identifier, page URLs, basic device and browser metadata, and a truncated IP address. We do not configure Google to share this data with advertising products and we do not use it for cross-site tracking. See Google’s privacy policy for details. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on.

We will update this list as our infrastructure changes. We do not sell your personal information to third parties, and we do not share it for cross-context behavioral advertising.

4. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and understand how the Service is used. For details, see our Cookie Policy.

5. How long we keep your information

We keep your account information and exam logs for as long as your account is active. If you delete your account, we will permanently delete your data from our active systems within 30 days, subject to limited backup retention for security and disaster recovery (typically up to 90 days).

Server logs and error reports are retained for a shorter period (generally 30 to 90 days) and then deleted or anonymized.

6. Security

We use commercially reasonable technical and organizational measures to protect your information, including HTTPS for data in transit, encryption at rest where supported by our subprocessors, password hashing, role-based access controls, and row-level security in our database. No system is perfectly secure, however. If we become aware of a security incident affecting your data, we will notify you in accordance with applicable law.

7. Your choices and rights

You can:

• Access the information in your account at any time by signing in.
• Update or correct your information from your account settings.
• Export your exam logs as a CSV file.
• Delete your account, which will permanently delete your data from our active systems as described above.
• Opt out of marketing emails at any time using the unsubscribe link in any marketing email or by contacting us. You will continue to receive transactional emails relating to your account.

8. California residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”). These include:

• The right to know what personal information we have collected about you and how we use and share it.
• The right to request deletion of your personal information.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of your personal information. We do not sell or share your personal information for cross-context behavioral advertising.
• The right not to be discriminated against for exercising any of these rights.

To exercise any of these rights, contact us using the “Contact us” section below. We may need to verify your identity before fulfilling certain requests.

9. Children

The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it.

10. International users

The Service is intended for users located in the United States. If you access the Service from outside the United States, you do so at your own initiative and you understand that your information will be transferred to and processed in the United States.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. If the changes are material, we will give you notice (for example, by email or by a banner inside the Service) before they take effect.

12. Contact us

If you have questions about this Privacy Policy or want to exercise any of your rights, please contact us through the contact form or by mail at:

AxialProgress, LLC
3400 Cottage Way, Ste G2 #27497
Sacramento, CA 95825