Privacy Policy

1. The short version

We collect what we need to run your review: your account details and your study activity. We don't sell your data, and your scores are private unless you opt in to the leaderboard. If you allow it, we also use Meta's (Facebook's) ad tool to see whether our Facebook and Instagram ads bring people to BoardPal. Sections 2 and 6 explain exactly what it sees.

2. What we collect

• Account details: your name (or nickname), your full name if you choose to give it, email address, password (stored as a hash — we never see it), timezone, and an optional Telegram handle if you choose to share one.
• Profile photo, if you add one: we shrink it to a small square and remove its hidden details (such as where it was taken) before saving it. Photos are stored at a public web address so they can show on the leaderboard. You can remove it anytime in Settings.
• Study activity: your answers, scores, streaks, flags and Vault saves, flashcard reviews, mock board attempts, and study-plan progress. This is the product — it powers your analytics and schedule.
• Payment verification: if you buy paid access, the receipt image or reference number you upload for GCash or bank-transfer verification.
• Support messages: anything you send through Help & Support or question reports.
• Security-check problems: if the Cloudflare check on login or signup fails, what went wrong, your browser, your rough location, and the start of your network address (enough to tell which internet provider, never your exact address), so we can fix it.
• Your school, if you pick one: the nursing school you choose to represent. Picking one is optional, and a school name you type in is checked by us before anyone else sees it.
• Where you found us: on your first visit we note where you came from (for example a TikTok link or Google), and save it with your account if you sign up.

Some products collect a little more; their own terms page lists exactly what.

Meta Pixel (ad measurement), only if you allow it: BoardPal can run the Meta Pixel, a small piece of code from Meta (Facebook), so we can tell whether our ads lead to signups and purchases. It loads only after you tap Accept on our cookie notice. Once allowed, it tells Meta each page you open here, which buttons you tap, when you create an account, when you view the upgrade page, when you choose a plan, and when a payment goes through (the plan and the amount). It also sends a scrambled (hashed) copy of details you type into our forms, such as your name and email address at signup, which Meta uses to match the visit to a Facebook or Instagram account. Like any website visit, it also sends your internet address and browser details. It does not send your answers, scores, or study history. Meta handles this data under its own privacy policy.

3. How we use it

• To run your review: analytics, scheduling, streaks, and the Vault.
• To verify payments and manage your plan.
• If you give your full name: to recognize you on the PRC list of passers. We only name you publicly if you ticked "BoardPal may recognize me by name", and you can untick it anytime in Settings.
• To reply to your support tickets and question reports (replies may also be emailed to you).
• To improve the question bank — in aggregate (for example, "what percent of students get this item right"), never as your personal data shown to other students.

4. The leaderboard is opt-in

Your scores and progress are private by default. If you opt in to the leaderboard, your display name and ranked stats become visible to other students; you can opt back out (visibility can change once every 7 days). If you add a profile photo, it shows beside your name there too, and other students can report a photo for us to review. Nothing else about your account is shown to other users, except your full name if you passed and allowed us to recognize you.

Schools are opt-in too. If you pick your school, other students who picked the same school and show themselves can see your display name and picture, and the questions you answer count toward your school's weekly total. A school is only ranked, or its student count shown, once at least 5 students show themselves there, so no one's own numbers can be picked out. You can hide yourself or leave your school anytime in Settings. We show school names only, and a school being listed does not mean it endorses or works with BoardPal.

If you post in Community or type in a party's chat in Play, your display name, picture and what you wrote are visible to other signed-in students (Community) or to the players in that party (chat), never to the public web or search engines. Reports, mutes and blocks are private. Moderators see your display name, account age and how many questions you have answered, never your email or payments.

5. Who we share it with

We don't sell your data. We use a small set of service providers to run BoardPal: Supabase (database and sign-in), Vercel (hosting), Resend (emails such as support replies), Cloudflare Turnstile (spam protection on login and signup), and Meta (measuring our Facebook and Instagram ads, only if you allow it, as described in section 2). Some of these companies store data outside the Philippines. Each gets only what it needs for its job. We'd only disclose data beyond that if the law required it.

7. Retention and deletion

We keep your data while your account exists so your history and analytics keep working. If you want your account and its data deleted, email us from your account's email address and we'll delete it — allowing a short window for payment and legal record-keeping where required.

Community posts stay until you delete them or your account. A post our moderators remove is kept for 90 days in case you ask us to look again, then deleted. Chat lines in Play parties are kept for 30 days so a report can be checked, then deleted.

8. Your rights

Under the Philippine Data Privacy Act of 2012 (RA 10173) you can ask us what data we hold about you, ask us to correct it, or ask us to delete it. Email admin@nleboardpal.com and we'll respond as quickly as we can. You can also complain to the National Privacy Commission if you believe your rights were violated.

9. Security

Data lives in Supabase with row-level security (students can only ever read their own records), passwords are hashed, and connections are encrypted (HTTPS). No system is perfect, but if a breach ever affects your data we'll notify you and the National Privacy Commission as the law requires.

10. Changes

If this policy changes, we'll update the date at the top and note significant changes in the changelog. Questions any time: admin@nleboardpal.com.