Privacy Policy

1. The short version

We collect what we need to run your review — your account details and your study activity — and nothing more. We don't sell your data, we don't run ad trackers, and your scores are private unless you opt in to the leaderboard.

2. What we collect

• Account details: your name (or nickname), email address, password (stored as a hash — we never see it), timezone, and an optional Telegram handle if you choose to share one.
• Study activity: your answers, scores, streaks, flags and Vault saves, flashcard reviews, mock board attempts, and study-plan progress. This is the product — it powers your analytics and schedule.
• Payment verification: if you buy paid access, the receipt image or reference number you upload for GCash or bank-transfer verification.
• Support messages: anything you send through Help & Support or question reports.

We don't collect anything in the background beyond what running the site requires — no third-party advertising or analytics scripts run on BoardPal.

3. How we use it

• To run your review: analytics, scheduling, streaks, and the Vault.
• To verify payments and manage your plan.
• To reply to your support tickets and question reports (replies may also be emailed to you).
• To improve the question bank — in aggregate (for example, "what percent of students get this item right"), never as your personal data shown to other students.

4. The leaderboard is opt-in

Your scores and progress are private by default. If you opt in to the leaderboard, your display name and ranked stats become visible to other students; you can opt back out (visibility can change once every 7 days). Nothing else about your account is ever shown to other users.

5. Who we share it with

No one buys or receives your data for marketing. We use a small set of service providers to run BoardPal, and your data passes through them only to make the product work: Supabase (database and authentication), Vercel (hosting), Resend (transactional email, e.g. support replies), and Cloudflare Turnstile (spam protection on login and signup). We'd only disclose data beyond that if the law required it.

6. Cookies

BoardPal uses cookies for one thing: keeping you signed in. There are no advertising or cross-site tracking cookies. Some preferences (like exam-session autosaves) are stored in your browser's local storage so a refresh doesn't lose your place.

7. Retention and deletion

We keep your data while your account exists so your history and analytics keep working. If you want your account and its data deleted, email us from your account's email address and we'll delete it — allowing a short window for payment and legal record-keeping where required.

8. Your rights

Under the Philippine Data Privacy Act of 2012 (RA 10173) you can ask us what data we hold about you, ask us to correct it, or ask us to delete it. Email admin@nleboardpal.com and we'll respond as quickly as we can. You can also complain to the National Privacy Commission if you believe your rights were violated.

9. Security

Data lives in Supabase with row-level security (students can only ever read their own records), passwords are hashed, and connections are encrypted (HTTPS). No system is perfect, but if a breach ever affects your data we'll notify you and the National Privacy Commission as the law requires.

10. Changes

If this policy changes, we'll update the date at the top and note significant changes in the changelog. Questions any time: admin@nleboardpal.com.