Privacy Policy

1. Our Approach to Privacy

ClueHawk is an educational study tool built for PA students. We collect only the data necessary to provide the learning experience — to track your progress, identify weak areas, and improve the platform. We do not sell, rent, or share your data with third parties.

2. Data We Collect

When you create an account and use ClueHawk, we may collect:

• Account identity: Email address, Supabase user ID.
• Profile metadata: Terms and Privacy acceptance timestamps, data-use consent version.
• Learning activity data: Your question attempts (question ID, selected answer, correctness, confidence rating, session type, timestamp), bookmarks, saved progress, and review history.
• External score data: Self-reported PACKRAT, End-of-Curriculum (EOC), End-of-Rotation (EOR), and external question-bank percentage scores — all optional.
• Feedback submissions: Free-text feedback, bug reports, and suggestions you submit.
• Derived analytics: Study metrics computed from your activity (accuracy per organ system, confidence calibration, weak/strong area signals, progress trends).

We do not collect tracking cookies, advertising identifiers, or behavioral profiling data. We do not perform automated public certification lookups (e.g., NCCPA PA-C verification) without your explicit separate consent.

3. How We Use Your Data

Your data is used to:

• Provide the learning experience (practice, explanations, review, bookmarks).
• Generate your personal study analytics (accuracy, weak areas, progress trends, readiness guidance).
• Improve question quality and platform reliability.
• Monitor early-access usage for product improvement.
• Troubleshoot bugs and improve safety and reliability.

De-identified and aggregated data use: With your consent (provided at signup), ClueHawk may use de-identified and aggregated learning, score, and outcome data to improve readiness analytics, calibrate platform performance metrics, and enhance product quality. This means:

• Individual scores, email addresses, and directly identifying information are not included in aggregate datasets.
• Aggregate analytics use category-level patterns (e.g., “average Cardiology accuracy across all learners”), not individual records.
• De-identified does not mean perfectly anonymous. Reasonable steps are taken to remove direct identifiers, but de-identified data may carry re-identification risk in rare edge cases.
• ClueHawk does not sell, rent, or share learner data with third parties for any purpose.

We do not use your data for automated decision-making or profiling beyond your own study analytics. ClueHawk readiness analytics are informational study tools — they do not predict exam outcomes, validate readiness, or guarantee results.

4. Who Can See Your Data

During the early-access (alpha) phase:

• You: You can see your own study data through the dashboard, analytics, and account pages.
• Founder/administrator: The founder has administrative access to learner activity data for product monitoring, quality improvement, and platform safety purposes during alpha. This is disclosed to you here.
• No one else: Your data is not shared with other learners, third parties, advertisers, or external organizations.

5. Data Storage and Security

ClueHawk stores learner data in Supabase (PostgreSQL) with Row-Level Security (RLS) policies. All data transport uses HTTPS encryption. Database access is restricted through Supabase service-role authentication.

ClueHawk uses cookies only for session authentication (Supabase-managed). No tracking or advertising cookies are used.

6. Data Retention and Deletion

ClueHawk retains learner data for the duration of the alpha period and beyond as needed to provide and improve the service.

Account deletion: You can request deletion of your account and all associated identifiable data at any time by contacting passpa@themba-pa.com.

What deletion covers:

• Your identifiable account data (email, name, auth user, profile) will be deleted or anonymized.
• Your learning activity data (review history, bookmarks, saved progress, external scores, feedback) will be deleted.
• Automated account deletion with full data purge is planned for a future release.

What may be retained:

• De-identified or aggregated data that can no longer reasonably identify you — such as category-level performance patterns, confidence calibration features, and aggregate analytics — may be retained to improve ClueHawk readiness analytics and product quality, consistent with the data-use consent provided at signup.
• ClueHawk does not retain your identifiable raw data after deletion. If you did not consent to de-identified data use, no data of any form derived from your account will be retained.

Smoke-test and internal data: Internal testing and smoke-test data generated by the ClueHawk team is excluded from aggregate analytics and readiness calibration datasets.

7. Third-Party Services

ClueHawk uses Supabase (a Firebase alternative by Supabase, Inc.) for authentication and database services. Supabase processes your data under its own privacy and security policies. ClueHawk does not share your data with additional third parties.

8. Future Production Hardening

ClueHawk is currently in early access. Before moving to a broader release, we plan to implement:

• Automated account deletion with full data purge.
• Data export functionality for learners.
• Expanded access logging and audit trail.
• Incident response and breach notification process.

This Privacy Policy will be updated as these features are added.

9. Changes to This Policy

This Privacy Policy may be updated as ClueHawk evolves. Significant changes will be communicated through the platform or via email. Continued use after changes are posted constitutes acceptance of the updated policy.

10. Contact

For privacy questions or data deletion requests, contact ClueHawk at passpa@themba-pa.com.