Privacy Policy

What we collect

• Account details — your name, email address, and a password stored only as a salted hash (we never see your password).
• Study content — your conversations, questions asked, practice answers, written reasoning, bookmarks, course progress, the flashcards you write or make (with their Arabic side, if you add one) and each review of them — which card, how you rated it, and when — and the results generated for you.
• Images you upload for cards — a picture you upload to make image-occlusion cards from (a JPEG, PNG, WebP or GIF of up to 2 MB). We keep a re-encoded copy, at most 1600 pixels across, without the file’s metadata (such as the camera, or where a photo was taken). It is shown only to you: it never appears on a shared deck or in a deck you export, and it is never sent to an AI provider.
• Decks you choose to share — when you ask to share a deck of cards you wrote, a Med Guru administrator reads every card before it goes public. Once approved, the deck has a public page of its own, which anyone with its address can see without signing in and search engines may list. It shows the deck’s name, an author label you choose — something like “M3 student · Beirut”; we ask you not to use your name, and the form refuses emails, links, @handles and phone numbers — how many cards the deck holds, and its first few cards. If you are a partner in our creator programme, the page also carries your partner code, so sign-ups from it are credited to you. Signed-in students can add a copy of the whole deck to their own cards. Only cards you typed yourself can be shared — never an image, an imported card, or a card made from a question, a book page or a chat — and a card’s Arabic side is never shown. You can stop sharing at any time with Unshare, in the deck’s settings or under Shared decks on your account page: the page and its address go at once, and search engines drop it the next time they look. Copies other students have already added are theirs and stay.
• Usage and billing records — which AI features you used, the computed cost of each call (used to enforce your budget), your subscription status and periods, and a record of payments received (amount, currency, and the payment provider’s transaction reference).
• Technical data — server logs containing IP address, timestamps, and request details, kept for security and debugging.
• Usage analytics — which pages are viewed, which features are used, interface interactions (clicks and taps), performance measurements, and session recordings of how the interface is used. In recordings, everything you type and the content of your questions, answers, and study material is masked before it leaves your browser — we see the shape of a session, not your words. All of it is tied to a pseudonymous account identifier plus your role and subscription tier, never to your email or name.
• Error reports — when something breaks, we receive the technical error: what failed, on which page or endpoint, and in which browser. Never the content of the request.

We do not collect health data about you or anyone else, and you should not enter real patient information into the Service.

Why we use it, and on what basis

• To provide the Service you asked for — answering your questions, storing your history, tracking course progress, scheduling your card reviews, and putting a deck you choose to share on its public page (performance of our contract with you).
• To meter usage against your budget, take payment, and prevent abuse (performance of contract, and our legitimate interest in running the Service sustainably).
• To keep the Service secure and diagnose faults (legitimate interest).
• To send you reminders and offers about the Service by email — study nudges, what your plan includes, when a trial or offer is ending (our legitimate interest in telling our own account holders about the product they signed up for). Every such email carries a one-click unsubscribe link, and there is a switch for it on your account page. Service messages — login codes, receipts, and notices about your subscription — are not marketing and are sent as part of our contract with you.
• To understand how the Service is doing — sign-ups, subscriptions, revenue and study activity — from statistics about groups of students (legitimate interest).
• To measure which of our ads on Facebook and Instagram bring people to the Service, and to show those ads to people likely to find it useful — only if you allow advertising cookies (your consent, which you can withdraw at any time).
• To meet accounting and tax obligations (legal obligation).

Who we share it with

We use a small number of processors, and only what they need:

• Google (Gemini API) — receives the text of your questions and the retrieved study passages in order to generate answers. For cards it receives: with Make cards, the chat answer and the question before it (or the recent conversation) the cards are to be made from, with the book and page of each of its sources — it proposes cards, and only the ones you keep are saved; with Translate with AI, the card you are writing, which it returns in Arabic; with Ask the AI on a card, the card’s text, sent as the question of a new chat that then appears in your chat history. Images you upload are never sent to it. Google processes all of this as our provider under its API terms, which state that it is not used to train its models.
• Paddle — our payment processor and merchant of record. When you buy a subscription you deal with Paddle directly: it collects your payment and billing details under its own privacy policy, and returns to us only a customer reference, transaction id, amount, and status. Your card details never reach our servers.
• Our hosting — the database and file storage that run the Service, which we operate ourselves on rented infrastructure.
• PostHog — our product-analytics and monitoring provider, hosted in the EU. It receives usage events, masked session recordings, performance measurements, and error reports tagged with a pseudonymous identifier so we can see what is used, what is confusing, and what is broken. It never receives the content of your questions or answers, your email, or your name.
• Meta (Facebook and Instagram) — only if you allow advertising cookies. Meta’s Pixel then records which pages you visit here, and when you create an account, start your trial or buy a plan, we tell Meta that too — with your email address and our account id in hashed (one-way scrambled) form, your IP address and browser, and for a purchase its amount. Meta uses this to measure our ads and to find people similar to our students. It never receives your name, the content of your questions or answers, or anything about your study. If you decline, none of this is sent.
• Resend — our email delivery provider. It receives your email address and the content of the emails we send you — verification codes, receipts, reminders — and returns whether each one was delivered. It never receives your study content.
• Anthropic (Claude) — used by the Med Guru team to analyse how the Service is doing. It receives statistics computed from our database about groups of students — counts, totals and rates such as sign-ups, subscriptions, revenue and study activity — which, while the Service is small, can describe only a few people. For partners in our creator programme it also receives their partner code with the sign-ups, revenue and commission attributed to it. It never receives your name, your email address, the text of your questions or answers, or your card or billing details.

Apart from the providers listed above, and a deck you choose to share (which anyone can see — see above), we do not share your data with anyone else, except where the law requires it or to establish or defend legal claims. Because these providers operate internationally, your data may be processed outside your country; where required, transfers rely on the providers’ standard contractual clauses.

Cookies and local storage

Med Guru stores these things in your browser: a strictly-necessary httpOnly session cookie that keeps you signed in; a first-party analytics identifier (in local storage and a cookie) that lets our own product analytics tell visits apart; and a cookie that remembers your answer to the advertising-cookie question. If you would like the analytics identifier removed, clearing your browser data for med-guru.com deletes it, or email us and we will exclude your account. Paddle’s checkout may set its own cookies when you make a purchase, governed by Paddle’s policy.

Cards for offline study are kept in your browser only when you ask for them, or when a rating cannot be sent. When you press Download for offline on the Cards page, the app saves today’s cards (at most 200) and the pictures they show in your browser’s own storage (IndexedDB, a cache, and a flag in local storage), with a signed token that lets us date the ratings you make offline. Those ratings wait there until they can be sent — and so does a rating you make online when your connection drops. A browser holding any of this also gets a service worker, which keeps a copy of the app’s own code — no study content — so the cards open with no connection. The saved cards and pictures stay on the device until you log out, someone else signs in on that browser, or the app finds your session has ended; a download more than a week old is deleted the next time the app opens. A rating waiting to be sent holds no card text — just which card, how you rated it, when, and how long you took — and stays until it reaches us: logging out tries once more to send it, then deletes it, and someone else signing in on that browser deletes it unsent. Clearing your browser data for med-guru.com removes all of it, the service worker included.

Advertising cookies are off unless you allow them. If you do, Meta’s Pixel sets its own cookies (_fbp, and _fbc when you arrived from one of our ads) so Meta can connect a visit here to the ad that led to it; those cookies are Meta’s and are governed by its privacy policy. You can change your answer at any time — withdrawing it stops anything further being sent and deletes those cookies.

Change your advertising-cookie choice

How long we keep it

• Account and study content: until you delete your account, or ask us to delete it.
• A card or deck you delete in the app: taken out of everything you see at once, but kept with your account until the account is deleted — your streak and review statistics are counted from its reviews.
• Images you upload for cards: until you delete your account — there is no way yet to delete one on its own in the app.
• A deck you share: on its public page until you unshare it, delete it, or delete your account. Copies other students have already added stay in their accounts.
• Cards saved for offline study: on your device, not ours — see Cookies and local storage above.
• Payment records: as long as accounting and tax law requires, typically several years, even after account deletion.
• Server logs: a short rolling window for security and debugging.
• A record of which emails we sent you and whether they were delivered: for as long as you have an account.
• Analytics events and error reports: a limited period on our analytics provider; session recordings are automatically deleted after roughly a month.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, or provide it in a portable form. Email support@med-guru.com and we will respond within 30 days. You can object to our reminder and offer emails at any time without writing to us: use the unsubscribe link in any of them, or the switch on your account page. You can take the cards you wrote with you at any time: Export, in a deck’s settings, downloads them as a file Anki can import. Deleting your account removes your study content and personal details, your cards and uploaded images included; it does not remove payment records we must retain by law, or the copies other students already added of a deck you shared. If you are in the EU/UK and believe we have mishandled your data, you may also complain to your local data protection authority.

Security

Passwords are stored hashed, sessions use httpOnly cookies, access to study material requires an authenticated request, and administrative functions are restricted to administrator accounts. No system is perfectly secure; if a breach affects your data, we will notify you and any regulator as required.

Children

The Service is intended for medical students and professionals and is not directed at children. We do not knowingly collect data from anyone under 16; if you believe a child has given us data, contact us and we will delete it.

Changes

If this policy changes materially we will notify you by email or in the app before the change takes effect.