1. What we collect

Account information. Your email address (used for passwordless sign-in) and the specialty you select.

Season data you enter. Programs you track, statuses, deadlines, signal allocations, interview dates, checklists, notes, criteria and scores, and expenses you log. This is logistics data about your application process — it is yours, and it is visible only to you.

Payment information. Payments are processed by Stripe. We receive confirmation that a purchase occurred and its amount; we never receive or store your card number.

Usage analytics. We use Plausible, a privacy-focused, cookie-free analytics service that collects aggregate usage statistics (page views, feature-use events). It does not use cookies and does not track you across other sites.

2. What we deliberately do not collect

We do not collect, request, or store your application materials — no personal statements, letters, transcripts, scores, or CVs. We do not collect health information. CycleDoc is not a healthcare service and is not subject to HIPAA. We do not access ERAS®, AMCAS®, or NRMP® systems or accounts.

3. How we use your information

To provide the service; to send sign-in links and purchase receipts; to send deadline and interview reminder emails only if you turn reminders on (every reminder includes an unsubscribe link); to understand aggregate product usage; and to respond when you contact us. We do not sell or rent personal information, and we do not use it for third-party advertising.

4. Who processes data on our behalf

Supabase (database and authentication hosting), Vercel (application hosting), Stripe (payments), Resend (email delivery), and Plausible (analytics). Each receives only what its function requires.

5. Your data, your controls

From Settings you can, at any time and without contacting us: export your complete season data (JSON) and delete your account, which permanently removes your data from our systems. California residents have rights under the CCPA/CPRA — including access, deletion, and correction — which the controls above satisfy; you may also exercise them, or ask anything else, by emailing support@cycledoc.io. We honor equivalent requests from any user regardless of location. We do not discriminate against users who exercise privacy rights.

6. Retention and security

We keep your data while your account is active and delete it when you delete your account (backup copies purge within 30 days). Data is encrypted in transit; database access is restricted per-user through row-level security.

7. Age requirement

CycleDoc is for users 18 and older. We do not knowingly collect information from anyone under 18.

8. Changes

If this policy changes materially, we will note the new effective date here and, for significant changes, notify you by email.