Privacy Policy

Last updated: 8 July 2026

1. Who we are

Stravoris (“Stravoris”, “we”, “us”, “our”) provides the Stravoris Practice App, a web application that lets medical students practise multiple-choice questions and track their progress. We are based in Ontario, Canada.

For any privacy question or request, contact us at privacy@stravoris.com.

This Privacy Policy explains what personal data we collect, why, how we use and protect it, who we share it with, and the rights you have. It applies to the Stravoris Practice App and its related sign-up and account pages (the “Service”).

2. The data we collect

We collect only what we need to run the Service.

Account data - when you create an account: your email address, a securely hashed password (we never store your password in readable form), and an optional display name.

Usage data - as you use the Service: the questions you attempt, your answers and whether they were correct, notes you write, questions you save, and the progress and performance statistics we derive from this activity.

Billing data - if you subscribe: your subscription status and a customer identifier from our payment processor. We do not collect or store your card number or full payment details - those are handled directly by Stripe, our payment processor (see Section 6). Stripe also collects your billing location (country and, in Canada, province) to calculate the taxes that apply to your purchase. We receive only the information needed to know whether your subscription is active.

Technical data - collected automatically when you use the Service: your IP address, browser and device information, and standard server and security logs. This is generated by our hosting and infrastructure providers and is used to operate, secure, and troubleshoot the Service.

Cookies - we use only strictly necessary cookies, principally to keep you signed in (your authentication session). We do not use advertising or analytics tracking cookies. Because these cookies are essential to provide the Service you have asked for, they do not require separate consent under most privacy laws.

We do not intentionally collect any special-category data (such as health, racial, or biometric data) about you. Please do not enter such information into free-text notes.

3. How we use your data, and our lawful bases

Under the EU/UK GDPR we must have a “lawful basis” for each use. In plain terms:

To provide the Service - creating and maintaining your account, saving your practice activity, notes, and progress, and showing you your results. Lawful basis: performance of our contract with you.
To manage subscriptions and payments - starting, renewing, and cancelling your subscription, and keeping your access accurate. Lawful basis: performance of our contract with you.
To communicate with you about the Service - sending transactional messages such as email verification, password resets, a reminder before a free trial ends, payment receipts and notices, and important service or security updates. Lawful basis: performance of our contract, and our legitimate interest in operating the Service.
To secure, maintain, and improve the Service - monitoring for abuse and errors, keeping the Service reliable, and understanding aggregate usage. Lawful basis: our legitimate interests in running a secure, reliable service.
To comply with law - meeting tax, accounting, and other legal obligations. Lawful basis: compliance with a legal obligation.

Marketing: we do not currently send marketing or promotional emails. If we introduce them in future, we will ask for your consent first and give you an easy way to opt out at any time.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

4. How long we keep your data

We keep your personal data only for as long as we need it for the purposes described in this Policy.

While your account is active - we keep your account and usage data so the Service works for you. We do not currently expire or automatically delete this data while your account exists.
When you ask us to delete it - you can ask us to delete your account and data at any time (see Section 5). We action deletion requests promptly. Deleting your account removes your account and associated personal data (your practice history, notes, and saved items).
Lapsed or cancelled accounts - if your access ends (for example, your trial or subscription lapses and you do not resubscribe) we may remove inactive accounts and their data after a period of inactivity. We are introducing automated time-based removal for this, and until it is fully in place we remove such data on request or periodically.
Billing records - we and Stripe retain transaction and invoice records for as long as required by tax and accounting law, even after your account is closed.
Backups - our database provider (Supabase) keeps automated backups for a limited period as part of its service, after which they are rotated out. Data deleted from the live Service is removed from backups as those backups age out.

5. Your rights

Depending on where you live (for example, under the EU/UK GDPR, California’s CCPA/CPRA, or Canada’s PIPEDA), you have some or all of the following rights over your personal data:

Access - ask for a copy of the personal data we hold about you. You can also download your own notes and performance data at any time from the Accountpage (Your data -> Download).
Rectification - ask us to correct inaccurate data (you can edit your display name yourself).
Erasure (“right to be forgotten”) - ask us to delete your account and personal data. To request deletion, email privacy@stravoris.com from your account email address.We will delete your account and associated personal data. Please note: if you have an active subscription, cancel it first (Account -> Manage subscription) so it is not left billing a closed account; deletion is permanent and removes your practice history and notes.
Restriction and objection - ask us to limit or stop certain processing.
Portability - receive certain data in a portable format (our Account export provides your notes and performance as CSV files).
Withdraw consent - where we rely on consent, withdraw it at any time (this does not affect processing already carried out).
Complain - lodge a complaint with your local data protection authority. In Canada, that is the Office of the Privacy Commissioner of Canada; in the EU/UK, your national authority; in California, the California Privacy Protection Agency.

To exercise any right, email privacy@stravoris.com. We may need to verify that the request comes from you (for example, that it is sent from your account email). We aim to respond within the timeframe required by applicable law (generally within 30 days; we will tell you if we need longer).

We will not discriminate against you for exercising your privacy rights.

6. Who we share your data with (our processors)

We do not sell your data. We share it only with service providers (“processors”) who help us run the Service, under terms that require them to protect it and use it only to provide services to us. These are:

Supabase - authentication and database hosting. Supabase stores your account and usage data and handles sign-in, and its email service sends our account emails (such as sign-up verification and password resets).
Stripe - payment processing. Stripe handles your card details and subscription billing; we never see or store your full card number. See Stripe’s privacy policy for how they handle payment data.
Vercel - application hosting and infrastructure. Vercel serves the app and processes request data in transit, and generates the technical and security logs described above.
Resend - email delivery and error monitoring. Resend delivers our account emails (such as sign-up verification and password resets) and receives our internal error reports when something goes wrong in the Service. An error report contains only an error type, a scrubbed error message and stack trace, the affected route or stage, and an opaque account reference; it does not include question content, your name, your email address, or your notes.

We do not use any advertising, analytics, or third-party tracking services. If we add a new processor that handles your personal data in future, we will update this Policy to name it.

We may also disclose data if required by law, to comply with legal process, to enforce our Terms, or to protect the rights, safety, and security of our users, the public, or Stravoris. If Stravoris is ever involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction; we will notify you and any successor will remain bound by this Policy.

7. International data transfers

We are based in Canada, and our processors may store and process data in Canada, the United States, the European Union, and other countries. This means your personal data may be transferred to, and processed in, countries other than where you live, whose data-protection laws may differ from yours. Where we transfer data out of the EEA or UK, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) offered by our processors.

8. How we protect your data

We take reasonable technical and organisational measures to protect your personal data, including encryption in transit, hashed passwords, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to address any incident appropriately and, where required, to notify you and the relevant authority.

9. Children

The Service is intended for users aged 16 and over (for example, senior high-school students studying medicine-related subjects, and above). It is not directed at children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us personal data, contact privacy@stravoris.com and we will delete it.

10. Changes to this Policy

We may update this Policy as the Service or the law changes. If we make material changes, we will update the “Last updated” date and, where appropriate, notify you (for example, by email or an in-app notice). Your continued use of the Service after an update means you accept the revised Policy.

11. Contact us

For any privacy question or to exercise your rights: privacy@stravoris.com.

Stravoris - Ontario, Canada.