Privacy Policy

1. Who We Are

Strudel Academy LLC ("we", "us", or "our"), a Wisconsin limited liability company, operates StrudelMed (the "Service"). This policy explains what information we collect, why we collect it, who we share it with, and the choices you have.

2. Information We Collect

Information you give us.

• Your email address, if you create an account, sign in with a magic link, or join our mailing list.
• Your display name and optional bio, if you set them on your profile.
• Your email address and basic profile details (such as your name) shared by Google, if you choose to sign in with Google.
• Anything you send us when you email us.

Information created when you use the Service.

• An account ID. When you first visit, we create an anonymous account for you so your games can be saved before you sign up.
• Game data, including your guesses, the clue you solved on, timing, scores, and stats.
• Articles you like and your leaderboard setting.
• Quiz answers and results from the specialty and personality quizzes, plus any thumbs up or down you give your result. These are stored without your account ID, name, or email.

Technical information.

• Your IP address, which we use briefly to limit repeated requests and block abuse.
• Error reports when something breaks, which include the page, browser type, and technical details of the error. We configure these reports to remove IP addresses, cookies, email addresses, and login tokens.
• Aggregated page view and performance data (such as page load speed, browser, device type, and country). This analytics does not use cookies and does not identify you.
• Security reports your browser sends when it blocks content on our pages, which include the page address and the blocked address.

3. Cookies and Local Storage

We use a small number of cookies and browser storage entries, all of which the Service needs to work:

• Sign-in cookies that keep you logged in.
• Local storage that saves today's game progress, cached case and diagnosis lists, your text size, and whether you have seen the cookie notice.

We do not use advertising cookies or cross-site tracking. Embedded YouTube videos use YouTube's privacy-enhanced mode, but once you play a video, YouTube may set its own cookies under Google's privacy policy.

4. How We Use Your Information

• To run the daily case, quizzes, leaderboard, and profiles.
• To save your progress, stats, and game history.
• To sign you in and send sign-in emails.
• To send occasional updates if you join our mailing list. Every update will include a way to unsubscribe.
• To fix bugs, measure performance, and improve content.
• To keep the Service secure and prevent cheating and abuse.
• To comply with the law.

5. What Other Users Can See

If you turn on the leaderboard, other users can see your display name, bio, scores, and stats. If you turn it off, your profile is not shown to other users. Your email address is never shown publicly.

6. Service Providers

We share information only with companies that help us run the Service. They process it on our behalf and may not use it for their own purposes.

• Supabase: database, accounts, and sign-in emails.
• Vercel: website hosting, Web Analytics, and Speed Insights.
• Sentry: error reports.
• Upstash: rate limiting, using IP addresses in short-lived counters.
• Cloudflare: hosting for case images.
• Google: sign in with Google, and YouTube for embedded videos.

We may also share information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger, sale, or transfer of our business, in which case this policy will continue to apply to your information.

7. No Sale of Data

We do not sell or rent your personal information, and we do not share it for targeted advertising.

8. Data Retention

We keep account and game data while your account is active. Anonymous accounts that are never linked to an email address may be deleted after a period of inactivity. Quiz responses are kept without identifiers to improve the quizzes. Error reports are kept only as long as we need them to fix problems, and browser security reports are deleted after 90 days. If you ask us to delete your account, we will delete your personal information within 30 days, except where we must keep it to comply with the law.

9. Your Choices and Rights

Wherever you live, you can ask us to:

• Tell you what personal information we hold about you.
• Give you a copy of it.
• Correct information that is wrong.
• Delete your account and personal information.
• Stop sending you mailing list emails.

You can change your display name, bio, and leaderboard setting on your profile at any time. For anything else, email us at support@strudelacademy.com from the address on your account. We will respond within 30 days and will not treat you differently for making a request. Depending on where you live, you may have additional rights under local law, and you may appeal our decision on your request by replying to our response.

10. Do Not Track and Global Privacy Control

We do not track you across other websites and do not let third parties do so on our Service, so we treat every visitor the same whether or not their browser sends a Do Not Track or Global Privacy Control signal.

11. Children

The Service is meant for medical students and other learners. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it.

12. Visitors from the EU and UK

If you are in the European Economic Area or the United Kingdom, we process your information on these legal bases:

• To provide the Service you asked for, such as saving your games and running your account.
• Our legitimate interests in keeping the Service secure, fixing errors, and improving content.
• Your consent, for the mailing list. You can withdraw it at any time.
• Legal obligations, where they apply.

We are based in the United States, and your information is processed there. Where required, we rely on our providers' standard contractual clauses or other approved safeguards for these transfers. You may also object to or restrict our processing, and you have the right to complain to your local data protection authority.

13. Security

We protect your information with encryption in transit and at rest, access controls on our database, and limits on repeated requests. No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires.

14. Changes to This Policy

We may update this policy. We will change the date at the top of this page, and if a change is significant we will post a notice on the Service or email account holders before it takes effect.

15. Contact

For privacy questions or requests, contact Strudel Academy LLC at support@strudelacademy.com.