Privacy

• Your account: your first name, email address and a scrypt hash of your password. We never see or store the password itself.
• Your study progress: the answers you give, flashcard reviews, mock exam and clinical station results, lessons completed, your exam date and study settings. This is what lets you pick up on another device.
• AI usage counts, daily and monthly, so we can apply the fair-use limit and your plan’s credits.
• Your plan and payments: which plan you’re on, until when, and for each payment the amount and Razorpay’s order and payment references. We never see or store card, UPI or bank details. Payment records are kept after an account is deleted, without the link to you, because the law requires them.
• Sign-in attempt counts, keyed by a one-way hash of your IP address or email address, to slow down password guessing and automated sign-ups. They’re cleared out after about a day.

Without an account, progress stays in your browser’s local storage on your device and never reaches us. Settings has an export button if you want your own copy either way.

• Vercel hosts the site and Neon hosts the database, both in Singapore.
• OpenAI or Anthropic receive the text of AI requests: your tutor questions, clinical station conversation, and the text of any PDF you upload to make questions or flashcards. We don’t keep uploaded PDFs; the text is sent for that one request and then discarded.
• Razorpay handles payments for Premium. Your name and email are passed to its checkout so you don’t have to type them; everything you enter there goes to Razorpay, not us.
• TypeSafe checks AI-written questions and marks clinical stations, so it receives that content too.
• Your browser handles voice input in clinical stations. Some browsers, Chrome among them, send that audio to their maker to turn it into text.

We don’t send your name or email with AI requests.

One cookie, which keeps you signed in. It’s HttpOnly (page scripts can’t read it) and lasts 60 days. No analytics, advertising or third-party cookies.

Everything travels over HTTPS, passwords are hashed, and the AI features only answer signed-in users. No system is perfectly secure, so please use a password you don’t use anywhere else.

You can export your progress at any time from Settings, and delete your account there too, under Delete account. Deleting an account removes it, its progress and its usage records from the database straight away. If you can’t sign in, or have any question about your data, email support@cherrybytelabs.com from the address you signed up with.

If we change what we collect or who processes it, we’ll update this page and the date at the top.