Privacy policy

This policy explains what personal data Argonaut QBanks ("Argonaut", "we", "us"), which runs Argonaut USMLE, collects, why, and what you can do about it. Short version: we collect what we need to run a question bank that adapts to you, we don't sell your data, and we don't use advertising trackers.

Who we are

Argonaut QBanks, Oakwood Lane, Kensington, London, United Kingdom, is the data controller for personal data processed through Argonaut USMLE. You can reach us at support@argonautusmle.com.

What we collect

Account details. Your name, email address and password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name, email address and profile picture from Google.

Profile. Your username, country, target exam, exam date and medical school, if you choose to give them.

Study data. What you answer and how: the choice you pick, changes of mind, time taken, confidence, struck-out options, highlights, marked questions, notes, flashcards, test history and Daily Challenge results. This is what ARGO uses to find your weak spots.

Payments. Payments are handled by Stripe. We never see or store your full card number. We keep a record of what you bought, when, the amount, and your Stripe customer ID.

Messages. What you send us when you email support or report a problem with a question.

Technical data. Our hosting and database providers log basic request data (IP address, browser type, pages requested, timestamps) to keep the service secure and working.

How we use it

• To run your account and give you the service you signed up for.
• To power ARGO: analysing your answers to estimate your strengths and weaknesses and choose what you practise next.
• To show anonymous, aggregated peer statistics (for example, "62% answered correctly").
• To show your display name, username, country, score and streak on the Daily Challenge leaderboard. Use a username you're happy to be public.
• To take payments and keep the records the law requires.
• To send emails you need, such as sign-in links, password resets and receipts. We don't send marketing email without your consent.
• To keep the service secure, prevent abuse (such as account sharing or content scraping) and fix problems.

We rely on these legal bases where they apply: performing our contract with you, our legitimate interest in running and improving a secure service, your consent where we ask for it, and legal obligations such as tax records.

AI features

Some optional features use Anthropic's Claude to generate content, such as flashcards and ARGO-written questions. To do that we send the relevant question content and, for question writing, a summary of the topics you find hardest. We don't send your name or email address. Anthropic processes this data on our behalf and doesn't use it to train its models.

Who we share it with

We don't sell or rent your personal data. We share it only with service providers that help us run Argonaut, under contracts that limit what they can do with it:

• Supabase: database, authentication and email delivery.
• Vercel: website hosting.
• Stripe: payment processing.
• Google: sign-in, if you choose "Continue with Google".
• Anthropic: AI features, as described above.

We may also disclose data if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

Our providers store and process data in the United States. Where data moves across borders, we rely on the safeguards the law provides, such as standard contractual clauses.

Cookies and local storage

We use only the cookies needed to keep you signed in. We store a few preferences on your device, such as your light or dark theme and, if you play the Daily Challenge without an account, a random guest token so your result can move to your account when you sign up. We don't use advertising or cross-site tracking cookies.

How long we keep it

We keep your data while your account is open. When you delete your account, your profile, study data, notes and flashcards are deleted. Anonymous, aggregated statistics (such as how many people answered a question correctly) stay, because they can't identify you. Records of your payments stay with Stripe, our payment processor, for as long as tax and accounting laws require, usually up to seven years.

Your rights

Depending on where you live (including under the GDPR, UK GDPR and California law), you can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent you've given. You can edit your profile and delete your account yourself in Settings. For anything else, email support@argonautusmle.com and we'll respond within 30 days. If you're unhappy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live.

Security

Data is encrypted in transit, access is restricted by row-level security so each account can only read its own data, and staff access is limited to what's needed to run the service. No system is perfectly secure, but we take it seriously and will tell you if a breach affects you.

Children

Argonaut is for medical students and graduates. It isn't meant for anyone under 18, and we don't knowingly collect data from children.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect.

Contact

Questions or requests about your data: support@argonautusmle.com, or write to Argonaut QBanks, Oakwood Lane, Kensington, London, United Kingdom.