Privacy Policy

1. Our Approach to Privacy

ClueHawk is an educational study tool built for PA students. We collect only the data necessary to provide the learning experience — to track your progress, identify weak areas, and improve the platform. We do not sell, rent, or share your data with third parties.

2. Data We Collect

When you create an account and use ClueHawk, we may collect:

• Account identity: Email address, Supabase user ID.
• Profile metadata: Terms and Privacy acceptance timestamps, data-use consent version.
• Learning activity data: Your question attempts (question ID, selected answer, correctness, confidence rating, session type, timestamp), bookmarks, saved progress, and review history.
• External score data: Self-reported PACKRAT, End-of-Curriculum (EOC), End-of-Rotation (EOR), and external question-bank percentage scores — all optional.
• Feedback submissions: Free-text feedback, bug reports, and suggestions you submit.
• Derived analytics: Study metrics computed from your activity (accuracy per organ system, confidence calibration, weak/strong area signals, progress trends).
• Basic acquisition attribution: When you arrive through a ClueHawk link with an allowlisted source tag, we may retain the source, optional medium/campaign, landing path, and capture time in a first-party cookie for up to 90 days. If you purchase, these bounded fields are copied to the purchase record to understand which launch source produced the purchase.

We do not collect advertising identifiers, browser fingerprints, full arbitrary referrer URLs, or behavioral profiling data. The acquisition cookie contains no email address or other direct identifier; it is used only for bounded first-party source attribution. We do not perform automated public certification lookups (e.g., NCCPA PA-C verification) without your explicit separate consent.

3. How We Use Your Data

Your data is used to:

• Provide the learning experience (practice, explanations, review, bookmarks).
• Generate your personal study analytics (accuracy, weak areas, progress trends, readiness guidance).
• Improve question quality and platform reliability.
• Monitor service usage for product improvement, safety, and reliability.
• Troubleshoot bugs and improve safety and reliability.

De-identified and aggregated data use: With your consent (provided at signup), ClueHawk may use de-identified and aggregated learning, score, and outcome data to improve readiness analytics, calibrate platform performance metrics, and enhance product quality. This means:

• Individual scores, email addresses, and directly identifying information are not included in aggregate datasets.
• Aggregate analytics use category-level patterns (e.g., “average Cardiology accuracy across all learners”), not individual records.
• De-identified does not mean perfectly anonymous. Reasonable steps are taken to remove direct identifiers, but de-identified data may carry re-identification risk in rare edge cases.
• ClueHawk does not sell, rent, or share learner data with third parties for any purpose.

We do not use your data for automated decision-making or profiling beyond your own study analytics. ClueHawk readiness analytics are informational study tools — they do not predict exam outcomes, validate readiness, or guarantee results.

4. Who Can See Your Data

Access to your data is limited to the following:

• You: You can see your own study data through the dashboard, analytics, and account pages.
• Founder/administrator: The founder may access learner activity data for product monitoring, quality improvement, support, and platform safety purposes.
• No one else: Your data is not shared with other learners, third parties, advertisers, or external organizations.

5. Data Storage and Security

ClueHawk stores learner data in Supabase (PostgreSQL) with Row-Level Security (RLS) policies. All data transport uses HTTPS encryption. Database access is restricted through Supabase service-role authentication.

ClueHawk uses Supabase-managed cookies for session authentication and may use the bounded first-party acquisition cookie described above when an allowlisted source tag is present. No advertising cookies or cross-site tracking are used.

6. Data Retention and Deletion

ClueHawk retains learner data for as long as needed to provide the service, support your account, meet legal obligations, resolve disputes, and improve platform safety and quality.

Account deletion: You can request deletion of your account and all associated identifiable data at any time by contacting support@cluehawk.com.

What deletion covers:

• Your identifiable account data (email, name, auth user, profile) will be deleted or anonymized.
• Your learning activity data (review history, bookmarks, saved progress, external scores, feedback) will be deleted.
• Automated account deletion with full data purge is planned for a future release.

What may be retained:

• De-identified or aggregated data that can no longer reasonably identify you — such as category-level performance patterns, confidence calibration features, and aggregate analytics — may be retained to improve ClueHawk readiness analytics and product quality, consistent with the data-use consent provided at signup.
• ClueHawk does not retain your identifiable raw data after deletion. If you did not consent to de-identified data use, no data of any form derived from your account will be retained.

Smoke-test and internal data: Internal testing and smoke-test data generated by the ClueHawk team is excluded from aggregate analytics and readiness calibration datasets.

7. Third-Party Services

ClueHawk uses Supabase (a Firebase alternative by Supabase, Inc.) for authentication and database services. Supabase processes your data under its own privacy and security policies. For paid access, Stripe processes payment information and billing records under Stripe's own privacy and security policies. ClueHawk does not sell, rent, or share learner data with third parties for advertising or profiling.

8. Service Improvements

We continue to improve the service and plan to add:

• Automated account deletion with full data purge.
• Data export functionality for learners.
• Expanded access logging and audit trail.
• Incident response and breach notification process.

This Privacy Policy will be updated as these features are added.

9. Changes to This Policy

This Privacy Policy may be updated as ClueHawk evolves. Significant changes will be communicated through the platform or via email. Continued use after changes are posted constitutes acceptance of the updated policy.

10. Contact

For privacy questions or data deletion requests, contact ClueHawk at support@cluehawk.com.