Privacy Policy

What we collect

• Account: email address and sign-in details.
• Study activity: progress, quiz and exam attempts, streaks, and question reports you submit.
• Uploads: PDFs you upload and the study content generated from them.
• Mailing list (optional): your email if you sign up for study tips and launch updates.
• Device storage: some game scores are saved only in your browser.
• Support and billing: messages you send us and payment status, plan, purchase identifiers, and subscription dates needed to manage Pro access.

Purposes and legal bases

We process account, study, upload, and billing data to perform our contract with you: providing the app, saving progress, generating study material, and managing access. Our legitimate interests support security, fraud prevention, usage-limit enforcement, support, question review, and product improvement. Optional mailing-list messages and browser notifications rely on your consent. We retain records where necessary to meet legal obligations. We do not sell your personal information.

Services and data sharing

Lovable Cloud hosts account data, uploaded PDFs, study activity, and support records. Text extracted from uploaded PDFs is sent through Lovable’s AI service and its model providers to create summaries, flashcards, quizzes, and scenarios. Do not upload patient-identifiable or other sensitive information. If you choose Google sign-in, Google and Lovable process the sign-in request and share account information needed to authenticate you. Fonts are requested from Google Fonts, which receives network details such as your IP address and browser request information.

Paddle, our Merchant of Record, receives purchase and account information for product sales, subscriptions, payments, tax compliance, and invoicing. Checkout is provided by Paddle and may use its own cookies or browser storage; its handling is described in Paddle’s Privacy Policy. We do not store full payment-card details. Service providers for hosting, AI, and support process data as needed for their services. We may also share necessary records with professional legal or accounting advisers and authorities where required by law.

Visitor analytics

On the published site, button and link clicks are recorded for every visitor. Page visits, time on page, page speed, and errors are also recorded for every visitor, without cookies and without identifying anyone. Lovable’s analytics stores nothing on a visitor’s device, does not keep IP addresses, and cannot recognise returning visitors.

It records pages visited, where visitors came from, country, browser, operating system, device type, visit duration, page-loading speed, errors, and button and link clicks. Detailed data is kept for 90 days and daily summaries for a year. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it.

Cookies and browser storage

Sign-in uses essential browser storage to keep your session. A sidebar-preference cookie lasts up to seven days. Device-local arcade records and optional study-reminder settings remain in your browser until cleared. You can manage cookies and storage through browser settings; clearing sign-in storage signs you out, and clearing local records removes those device scores. There are no app-added advertising pixels or marketing cookies; third-party sign-in and checkout services control their own storage. Device read-aloud uses your browser’s speech service, which may use a remote voice provider depending on your device settings.

Retention and security

Account and study data are kept while needed to provide your account and saved progress. Uploaded shared curriculum is retained while used by the service and until removed by its administrator. Support records are kept while needed to resolve requests and disputes; billing records may be kept longer for applicable tax, accounting, and legal obligations. Mailing-list data is retained until you unsubscribe or request deletion; a minimal opt-out record may be retained to honour your choice. We delete or anonymise personal data when no longer needed, subject to required records and backup removal cycles.

We use appropriate technical and organisational safeguards, including encrypted connections and access controls. No storage or transmission method is completely secure. Providers may process data outside your country; where applicable, transfers rely on recognised adequacy decisions or contractual safeguards such as standard contractual clauses.

Your rights and choices

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing of your personal data. You can withdraw consent for optional emails and notifications at any time, without affecting earlier lawful processing. Use the unsubscribe link in mailing-list emails or contact EMTPrepPartner@gmail.com. You may complain to your local privacy regulator. For UK/EEA requests, we normally respond within one month; any lawful extension will be explained. We may need to verify your identity before fulfilling a request.

Changes

We'll update the effective date when this policy changes.