Privacy Policy

About this service

FreeUSMLE is an independent educational project. This notice covers its cloud question bank, account features and support communications. Contact the project operator at openmedicalprep@gmail.com.

This cloud version offers temporary guest practice and optional accounts. Supabase handles sign-in; Cloudflare hosts the application and stores saved study records in private storage associated with each account. The details below describe this cloud version, not a separate local-only study app.

Information you provide

If you create an account, we process your email address, optional display name, chosen exam, authentication information, and the time and versions of your policy acknowledgements. We ask you to confirm that you are at least 18; we do not need your date of birth.

Study records may include question and session identifiers, selections, graded results, timestamps, bookmarks, notes, highlights, session position and timing, and study-plan progress. We use these to resume practice and summarize your learning. Support messages contain whatever information you choose to send.

Do not enter patient-identifying information, medical records, government identifiers, payment-card details or confidential examination content. This service is not a patient-record system.

Technical information

Website and infrastructure services may process IP addresses, request times, requested pages, browser/device information, security events and errors to deliver and protect the service. Email providers process information needed to deliver verification and recovery messages, including delivery failures.

The reviewed study interface has no advertising pixels or optional analytics SDKs. Essential storage and provider security logging still exist. See the Cookies & storage notice; we do not describe guest use as completely anonymous.

Temporary guest practice

An encrypted copy of your guest visit is kept in this tab’s session storage and sent with study requests. The service opens it temporarily to provide the next question or save the next change. Guest activity is not saved to an account or a persistent personal database, and is not automatically moved into a new account.

Guest visits have a server-enforced four-hour idle expiry. The encrypted tab copy can preserve a visit through server-memory eviction, a restart or a deployment, but loss of browser storage, expiry or a change to the service’s encryption key can make it unavailable. Separate tabs can develop separate copies of a temporary history; guest use is not a secure examination system.

“End guest visit” clears the current guest cookie and this tab’s stored copy. It does not guarantee that every older copied token is revoked: a previously copied token may remain usable until its expiry. Browser session restoration can preserve tab storage or cookies. Clear site storage on shared devices when needed; this does not promise immediate erasure of every memory or backup copy.

This cloud service does not automatically upload history from a separate local-only app.

How we use information

We use information to provide practice, authenticate and recover accounts, save requested study activity, calculate educational progress summaries, answer support requests, prevent abuse and meet applicable legal obligations. Weakness rankings and retention labels are learning aids, not medical, licensing or employment decisions or validated score predictions.

Where a legal basis is required, processing may be necessary to provide the requested service, support legitimate interests in security and reliability, meet legal duties, or rely on consent for an optional feature where required. Rights and legal bases depend on the circumstances and applicable law.

Providers and sharing

Cloudflare hosts the website, security and essential image assets. Private per-account SQLite Durable Objects store sessions, progress, grading/review events and settings. Cloudflare D1 stores shared educational question content and source metadata, rather than personal study history.

Supabase handles account authentication, email/password credentials and associated sign-up metadata, including policy acknowledgements. Resend, through the authentication service, delivers account verification and password-recovery email. The application receives information needed to complete these sign-in flows.

We do not sell personal information or disclose it for targeted advertising in this version. Providers receive information needed for their service roles. Information may also be disclosed when legally required, to address security or legal claims, or as part of a lawful project transfer subject to applicable safeguards and notice.

Providers can process information in the United States and other locations. We do not promise that all data stays in your country. Links to official practice or other websites are third-party services with their own policies.

AI and private study information

AI tools have assisted the creation and review of educational material. The reviewed normal study interface does not invoke a live AI model to answer your questions or analyze your private notes. This does not make the educational material error-free. Any future feature that sends personal study information to an external AI service needs a clear description and any choices or consent required before it is enabled.

Retention and security

Saved account records support continued study, subject to capacity limits, applicable deletion requests and lawful retention needs. Signing out does not erase saved records. There is no promised automatic inactivity-deletion period or permanent-storage guarantee. Some information may need to remain for security, legal obligations or dispute handling. Provider backups and logs can follow separate retention cycles; removal from every backup is not instantaneous.

The public service uses HTTPS and account access controls. Private per-account storage is not end-to-end encryption and does not mean that only you can ever access it. Authorized operators and providers may need access to administer, protect or support the service. No system can guarantee absolute security.

Your choices and requests

You can practice as a guest, edit available account preferences, sign out and manage browser storage. Signed-in users can download their study records from the account page. This export contains the records made available by the study service; it does not include passwords, authentication tokens, provider security logs, other users’ records or unrevealed grading secrets. Individual block/progress downloads may also be available.

For access, correction, additional information, deletion, or another applicable privacy right, email openmedicalprep@gmail.com from the account address when possible. We verify ownership before acting and may request only the information needed for verification. Never send a password. Deletion is a manual request, not an automatic button or a promise of immediate erasure. We handle requests and applicable exceptions according to law.

Depending on your location, you may also have rights to restrict or object to processing, withdraw consent where used, or complain to a privacy regulator. We do not claim that this page itself establishes compliance with every privacy law.

Children and changes

Accounts are intended for adults aged 18 or older. The service is not directed to children under 13. If you believe a child has provided personal information, contact openmedicalprep@gmail.com so we can investigate and take appropriate action.

We update this page when practices change and identify the revision date. Material changes may need additional notice or acknowledgement. We do not treat an update as permission to begin a new optional data use without the notice or consent required by law.