Privacy Policy

Last updated: 23 September 2026

1. Who we are

Stravoris (“Stravoris”, “we”, “us”, “our”) provides the Stravoris Practice App, a web application that lets medical students practise multiple-choice questions and track their progress. We are based in Ontario, Canada.

For any privacy question or request, contact us at privacy@stravoris.com.

This Privacy Policy explains what personal data we collect, why, how we use and protect it, who we share it with, and the rights you have. It applies to the Stravoris Practice App and its related sign-up and account pages (the “Service”).

2. The data we collect

We collect only what we need to run the Service.

Account data - when you create an account: your email address, a securely hashed password (we never store your password in readable form), and an optional display name.

Arrival data - when you create an account: the campaign or referral tags on the link that brought you here (for example utm_source or a referral code) and the address of the referring page, where your browser supplies them. We use this to learn which channels bring students to the Service. If your browser sends nothing, no arrival data is recorded, and your account works the same either way.

Usage data - as you use the Service: the questions you attempt, your answers and whether they were correct, notes you write, questions you save, and the progress and performance statistics we derive from this activity.

Time zone - as you use the Service: the time zone your browser reports when you sign in, or the one you choose on your Account page. We use it only so that your daily streak follows your own day rather than UTC. You can change it on your Account page at any time.

Purchase data - if you buy time: a record of each purchase (which pack, the amount and currency, and when), any refund or dispute on it, and a customer identifier from Link. We do not collect or store your card number or full payment details - Link handles those directly as the merchant of record (see Section 6). Link also collects your billing location to calculate the taxes that apply to your purchase.

Referral data - if you use the referral programme: your invite code, whose code you added (if any), and, for codes you have shared, how many friends have joined and how many have made a purchase. When a friend adds your code, they see your display name. You see only counts, never your friends’ names.

Technical data - collected automatically when you use the Service: your IP address, browser and device information, and standard server and security logs. This is generated by our hosting and infrastructure providers and is used to operate, secure, and troubleshoot the Service.

Cookies - we use only strictly necessary cookies, principally to keep you signed in (your authentication session). We do not use advertising or analytics tracking cookies. Because these cookies are essential to provide the Service you have asked for, they do not require separate consent under most privacy laws.

We do not intentionally collect any special-category data (such as health, racial, or biometric data) about you. Please do not enter such information into free-text notes.

3. How we use your data, and our lawful bases

Under the EU/UK GDPR we must have a “lawful basis” for each use. In plain terms:

To provide the Service - creating and maintaining your account, saving your practice activity, notes, and progress, and showing you your results. Lawful basis: performance of our contract with you.
To manage purchases and your access - adding the time you buy to your account, applying refunds and disputes, and keeping your access date accurate. Lawful basis: performance of our contract with you.
To run the referral programme - linking your account to the friend whose code you added, and crediting the time each of you earns. Lawful basis: performance of our contract with you.
To communicate with you about the Service - sending transactional messages such as email verification, password resets, payment receipts and notices, reminders before your access or free trial ends, and important service or security updates. You can turn reminder emails off at any time from your Account page or from the link in any reminder. Lawful basis: performance of our contract, and our legitimate interest in operating the Service.
To secure, maintain, and improve the Service - monitoring for abuse and errors, keeping the Service reliable, and understanding aggregate usage. Lawful basis: our legitimate interests in running a secure, reliable service.
To understand how people find the Service - measuring which channels and campaigns bring new accounts. Lawful basis: our legitimate interests in promoting the Service effectively.
To comply with law - meeting tax, accounting, and other legal obligations. Lawful basis: compliance with a legal obligation.

Marketing: we do not currently send marketing or promotional emails. If we introduce them in future, we will ask for your consent first and give you an easy way to opt out at any time.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

4. How long we keep your data

We keep your personal data only for as long as we need it for the purposes described in this Policy.

While your account is active - we keep your account and usage data so the Service works for you. We do not currently expire or automatically delete this data while your account exists.
Arrival data - kept while your account exists.
Time zone - kept while your account exists; you can change it at any time.
When you ask us to delete it - you can ask us to delete your account and data at any time (see Section 5). We action deletion requests promptly. Deleting your account removes your account and associated personal data (your practice history, notes, and saved items).
Lapsed accounts - if your access ends and you do not buy more time, we keep your account and practice history for 1 year from the day your access ended, so you can pick up where you left off by buying a pack. After that year we may delete the account and its data.
Free-trial record - to prevent repeated use of the free trial, we keep a hashed, non-reversible identifier derived from your email address after your account is deleted. It cannot be used to recover your email address or to contact you, and it records nothing beyond the fact that a free trial has been used.
Purchase records - we keep a record of your purchases, refunds and disputes, and Link keeps its own transaction records, for as long as required by tax and accounting law, even after your account is deleted.
Backups - our database provider (Supabase) keeps automated backups for a limited period as part of its service, after which they are rotated out. Data deleted from the live Service is removed from backups as those backups age out.

5. Your rights

Depending on where you live (for example, under the EU/UK GDPR, California’s CCPA/CPRA, or Canada’s PIPEDA), you have some or all of the following rights over your personal data:

Access - ask for a copy of the personal data we hold about you. You can also download your own notes and performance data at any time from the Account page (Your data -> Download).
Rectification - ask us to correct inaccurate data (you can edit your display name yourself).
Erasure (“right to be forgotten”) - ask us to delete your account and personal data. To request deletion, email privacy@stravoris.com from your account email address. We will delete your account and associated personal data. Please note: deleting your account is permanent. It removes your practice history and notes, and forfeits any unused time you have bought. If you are within the 14-day refund window described in our Terms, ask for your refund before asking us to delete your account. One exception applies: as described in Section 4 (Free-trial record), we keep a hashed, non-reversible identifier derived from your email address so the free trial cannot be used again. It cannot be used to recover your email address or to contact you.
Restriction and objection - ask us to limit or stop certain processing.
Portability - receive certain data in a portable format (our Account export provides your notes and performance as CSV files).
Withdraw consent - where we rely on consent, withdraw it at any time (this does not affect processing already carried out).
Complain - lodge a complaint with your local data protection authority. In Canada, that is the Office of the Privacy Commissioner of Canada; in the EU/UK, your national authority; in California, the California Privacy Protection Agency.

To exercise any right, email privacy@stravoris.com. We may need to verify that the request comes from you (for example, that it is sent from your account email). We aim to respond within the timeframe required by applicable law (generally within 30 days; we will tell you if we need longer).

We will not discriminate against you for exercising your privacy rights.

6. Who we share your data with (our processors)

We do not sell your data. We share it only with service providers (“processors”) who help us run the Service, under terms that require them to protect it and use it only to provide services to us.

Most of the providers below are our processors. Link is different: as the merchant of record, it sells you the pack, so it handles your payment data as an independent controller under its own privacy policy.

These are:

Supabase - authentication and database hosting. Supabase stores your account and usage data and handles sign-in, and its email service sends our account emails (such as sign-up verification and password resets).
Link, a service of Stripe - merchant of record for purchases. Link sells you the pack, processes your payment, calculates and collects tax, and issues receipts and refunds. We never see or store your full card number. See Link’s and Stripe’s privacy policies for how they handle payment data.
Vercel - application hosting and infrastructure. Vercel serves the app and processes request data in transit, and generates the technical and security logs described above.
Resend - email delivery and error monitoring. Resend delivers our account emails (such as sign-up verification, password resets and reminder emails) and receives our internal error reports when something goes wrong in the Service. An error report contains only an error type, a scrubbed error message and stack trace, the affected route or stage, and an opaque account reference; it does not include question content, your name, your email address, or your notes.

We do not use any advertising, analytics, or third-party tracking services. If we add a new processor that handles your personal data in future, we will update this Policy to name it.

We may also disclose data if required by law, to comply with legal process, to enforce our Terms, or to protect the rights, safety, and security of our users, the public, or Stravoris. If Stravoris is ever involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction; we will notify you and any successor will remain bound by this Policy.

7. International data transfers

We are based in Canada, and our processors may store and process data in Canada, the United States, the European Union, and other countries. This means your personal data may be transferred to, and processed in, countries other than where you live, whose data-protection laws may differ from yours. Where we transfer data out of the EEA or UK, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) offered by our processors.

8. How we protect your data

We take reasonable technical and organisational measures to protect your personal data, including encryption in transit, hashed passwords, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to address any incident appropriately and, where required, to notify you and the relevant authority.

9. Children

The Service is intended for users aged 16 and over (for example, senior high-school students studying medicine-related subjects, and above). It is not directed at children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us personal data, contact privacy@stravoris.com and we will delete it.

10. Changes to this Policy

We may update this Policy as the Service or the law changes. If we make material changes, we will update the “Last updated” date and, where appropriate, notify you (for example, by email or an in-app notice). Your continued use of the Service after an update means you accept the revised Policy.

11. Contact us

For any privacy question or to exercise your rights: privacy@stravoris.com.

Stravoris - Ontario, Canada.