Privacy Policy

Last updated: 2026-05-25

This policy describes what data Ace the NCLEX (the "App") collects, why we collect it, and the choices you have. We aim for plain English. If anything is unclear, email hello@acethenclex.com and we'll explain.

Who runs this app

Ace the NCLEX is operated by Richard Bell ("we", "us"). Ace the NCLEX is a web application at acethenclex.com, used in your browser. There is no mobile app to install, though you can add the site to your home screen. Contact: hello@acethenclex.com.

What we collect

Information you give us directly

Account info: email address, password (stored as a hash, never plaintext), and the profile info you choose to add (preferred name, NCLEX exam type, target exam date, weekly study-hours commitment).
Bundle codes you redeem (used once to flag your account for the Book Buyer discount).
Pass-guarantee refund requests: the form you submit — exam date, state, proof type, contact email, and any notes you add.
Waitlist email (if you signed up on our coming-soon page before the app launched).

Information generated by your use of the app

Question attempts: which questions you answered, what you picked, whether it was correct, how long you spent. Drives your readiness score, adaptive mock CAT engine, and the "questions you got wrong" review pool.
Mock exam sessions: CAT engine internal state (theta, confidence), outcomes, and per-question attempts within the mock.
Flashcard reviews: FSRS spaced-repetition state for each card you reviewed (stability, difficulty, scheduled next review).
AI tutor messages you send to "Ask Ace" — both the message and the AI's response.
Audio plays of rationales (counted toward daily limits on the free tier).
Subscription state: tier (Free / Pro Standard / Pro Book Buyer), renewal date, and whether a subscription is active. Synced from Stripe, who process our payments.
Activity streaks and badges: daily activity timestamps used to compute streak counts and award milestone badges.

Information collected automatically

Device and diagnostic data: your browser sends standard information such as browser version and screen size, which we use to render the site correctly. We run no analytics SDK and no advertising or tracking pixels.
Push notification token (only if you add the site to your home screen and accept notifications) — used to send study reminders you have opted into. Revoke it at any time in your browser or device notification settings.

What we do NOT collect

No precise location.
No contacts, photos, microphone, camera, or HealthKit data.
No third-party advertising or cross-app tracking identifiers (no IDFA use).
No browsing history outside our app.

Why we collect it

Make the app work. Account auth, question delivery, mock CAT scoring, flashcard scheduling, AI tutor responses, subscription gating.
Personalize your study plan. Pace recommendations based on your exam date and weekly hours; weak-area drilling based on your wrong-answer history.
Process pass-guarantee refund requests. Verify your activity meets the criteria and issue the refund through Stripe.
Improve content quality. Aggregate question attempt data lets us spot questions that everyone is missing (usually a content bug, not a hard question).
Notifications. Reminders you've opted into.

Who we share data with

Supabase hosts our database, authentication, edge functions, and file storage. Data stays inside the Supabase project we control.
Stripe handles all subscription billing. Your card details go directly to Stripe and never reach our servers; Stripe sends us an event when your subscription changes state.
OpenAI processes Ask Ace messages (both your input and the response). We send only the message text, no account identifiers. Used to generate the tutor reply, then discarded.
ElevenLabs generates Ace's voice from rationale text. We send only the text to be spoken.
Resend sends transactional emails (refund request confirmations, waitlist signups). We share the recipient email and message content.

We do not sell your data. We do not share it for advertising. We do not use it to build profiles outside the app.

How long we keep it

Account data and question attempts: kept while your account is active.
AI tutor message content: retained for 90 days, then automatically deleted from our database.
Subscription state: retained while your account exists, and per Stripe's retention policy for the payment records they are legally required to keep.
Server logs: retained for up to 30 days for security and debugging.
Pass-guarantee request records: retained 7 years for legal/financial recordkeeping (tax and audit purposes).

Your rights

Access: request a copy of all data we hold about you. Email hello@acethenclex.com from your account email. We respond within 30 days.
Correction: profile fields are editable directly in the app (Me tab). For anything else, email us.
Deletion: in-app, Me tab → Reset my progress (clears all in-app data while keeping your account). For full account deletion, email us — we'll delete your account and associated data within 30 days. Some records (refund history) may be retained per the retention schedule above for legal compliance.
Withdraw consent: stop using the service and request deletion as above. Turn off notifications in your browser or device settings.
California / EU rights: CCPA, GDPR, and similar laws give you specific rights (data portability, opt-out of "sale" — which we don't do anyway, right to be forgotten). Email us to exercise any of them.

Children

Ace the NCLEX is intended for nursing students (typically 18+). We do not knowingly collect data from anyone under 13. If we learn we have, we delete it.

Security

Data in transit is encrypted with TLS. Data at rest is encrypted using Supabase's infrastructure (PostgreSQL with disk-level encryption). Passwords are hashed using bcrypt. We follow least-privilege principles for internal access. No system is perfectly secure, but we take reasonable steps.

Changes to this policy

If we change this policy meaningfully, we'll update the "Last updated" date above and, for material changes, notify you in-app. Continued use of the app after a change indicates acceptance.

Contact

Questions, requests, or concerns: hello@acethenclex.com.