EthicsUniverse Privacy Policy

Last updated: September 8, 2026

This policy explains what information EthicsUniverse collects about you, why we collect it, where it goes, and what you can do about it. EthicsUniverse is run by OncUniverse LLC, a Pennsylvania limited liability company doing business as EthicsUniverse ("EthicsUniverse", "we", "us"), and this policy covers ethicsuniverse.com and everything we offer through it (the "Service").

The short version is this. We collect your email address, the information needed to sign you in, and a record of your studying so your progress follows you. We use it to run the Service, protect our content, and improve the questions. We do not sell it, we do not run advertising, and card details go to Stripe rather than to us. The rest of this document is the long version.

1. What we collect

Account information. When you sign up we collect your email address and the data needed to authenticate you, such as a hashed password, one-time sign-in codes or links, and session tokens. We also record when your account was created, when you last signed in, and whether your access is free, early-access, or paid. If you were invited by someone or joined through an early-access list, we keep a record of that too.

Study activity. As you use the Service we record which questions you open and attempt, the answer you choose and whether it was correct, the setup of each study session (tutor or test mode, the filters and question count you chose, and a random seed that lets us reproduce the order you saw), the flashcards you mark as known, the notes and SuperNovas you save to your notebook, and interface preferences such as text size, light or dark theme, filters, and any highlights you make. This is the data that lets you pick up where you left off and see how you are doing.

Payment information. If you buy access, your payment is handled by Stripe. You enter your card details on a form controlled by Stripe, and Stripe processes the charge. We receive a record of the transaction: the amount, the date, a Stripe transaction identifier, your billing email and country, and the card brand and last four digits. We never receive or store your full card number, expiration date, or security code.

Technical information. Like any website, our servers and hosting providers log basic information about requests: your IP address, browser and device type, operating system, the pages you request, referring page, and timestamps. We use this to keep the Service running, diagnose problems, and detect abuse such as scraping or account sharing.

Communications. If you email us, we keep the correspondence so we can respond and keep a record of what was said.

We do not ask for your name, school, exam date, or scores, though you may choose to tell us these things in a message or a note. We do not collect health information about you, and the Service is not designed to hold patient information. Please do not put identifiable patient details in your notebook.

2. Why we collect it and how we use it

We use your information to:

create and secure your account and sign you in;
save your progress, notes, and preferences and sync them across your devices;
process purchases, manage your access period, and answer billing questions;
protect our content, including by placing a watermark tied to your account on pages that display questions and explanations, and by detecting copying, scraping, or account sharing;
improve the question bank. We look at how questions perform in aggregate, for example how many people choose each answer option, to find questions that are ambiguous, too easy, or miskeyed. This analysis uses de-identified, aggregated data and is never published in a form that identifies you;
send you emails about your account, such as sign-in links, receipts, security alerts, and notices about changes to our terms or this policy;
with your permission, send you occasional news about new content or features. You can opt out at any time using the link in the email or by contacting us;
respond to your questions and support requests; and
comply with the law, enforce our Terms of Service, and protect our rights and the rights of others.

If you are in the European Economic Area, the United Kingdom, or another place whose law requires a legal basis for processing, ours are: performing our contract with you (running the Service you signed up for), our legitimate interests (protecting our content, securing the Service, and improving the questions), your consent (for optional emails, which you can withdraw), and compliance with legal obligations (for example keeping transaction records for tax purposes).

3. Who we share it with

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share it only in the following situations.

Service providers who help us run EthicsUniverse. These companies process data on our behalf under contracts that limit what they can do with it.

Supabase provides our database and authentication system. Your account information, study activity, and notebook contents live there.
Stripe processes payments. Stripe collects your card details directly and shares limited transaction information with us, as described above, and Stripe's own privacy policy governs what it does with your card data.
Vercel hosts the website and runs the code that serves it, and in doing so processes request logs, including IP addresses, to deliver and secure the site.

We may use additional providers for things like sending email or monitoring errors. If we do, they will be bound by similar contractual limits, and we will update this policy if the change is significant.

Legal requirements. We may disclose information if we believe in good faith that doing so is required by law, subpoena, or court order, or is necessary to protect the safety, rights, or property of EthicsUniverse, our users, or the public, including to investigate suspected fraud or violations of our Terms of Service.

Business changes. If EthicsUniverse is acquired, merged, or sells substantially all of its assets, your information may be transferred to the successor, who will be bound by this policy or will notify you of any changes.

With your consent. We may share information in other ways if you ask us to or agree to it.

4. Cookies and local storage

We use cookies and browser local storage for two purposes.

Keeping you signed in. Our authentication system stores a session token in a cookie or in local storage so you do not have to sign in on every page. These are essential. If you block them, you will not be able to use your account.

Remembering your preferences and progress. We store settings such as your theme, timer preferences, and filters, and we may cache recent progress on your device so the Service feels fast and works through brief connection problems.

We do not use advertising cookies or third-party tracking cookies. If we ever add analytics, we will use a privacy-respecting configuration, describe it here, and give you a way to opt out where the law requires one.

You can clear or block cookies and local storage through your browser settings. Doing so will sign you out and reset preferences stored on that device, though the progress stored on our servers is not affected.

5. How long we keep it

We keep your account information, study activity, and notebook contents for as long as your account exists. If you delete your account, or ask us to, we delete this information from our active systems within 30 days, though copies may persist in encrypted backups for a short period until those backups are overwritten on their normal schedule.

We keep transaction records for as long as tax, accounting, and payment-network rules require, which is typically several years, even after the account is deleted.

Aggregated, de-identified question-performance statistics are kept indefinitely. Once your activity has been folded into those statistics, it can no longer be linked back to you.

Server logs held by our hosting and infrastructure providers are kept for the short retention periods those providers set.

If your account has been inactive for a long time, we may delete it after giving you notice at the email address on file.

6. Your choices and rights

You can review and change much of your information yourself. Your notes and SuperNovas can be edited or deleted from within your notebook, and preferences can be changed in the app. For anything else, email support@ethicsuniverse.com.

Depending on where you live, you may have some or all of the following rights under laws such as the EU and UK General Data Protection Regulation or United States state privacy laws:

to know what personal information we hold about you and receive a copy of it in a portable format;
to correct information that is inaccurate or incomplete;
to delete your account and the information associated with it;
to object to or restrict certain processing, including processing based on our legitimate interests;
to withdraw consent where our processing relies on it, for example for optional emails; and
to complain to a data-protection authority where you live. We would appreciate the chance to address your concern first, but you do not have to give us one.

To exercise any of these rights, email support@ethicsuniverse.com from the address on your account so we can confirm it is you. We may ask for additional verification if we have reason to, and we respond within the time the applicable law allows, usually much sooner. We will not treat you differently for exercising your rights.

Deleting your account. Deletion is permanent. Your notes, SuperNovas, and progress cannot be recovered, and any remaining paid access ends without refund unless our Terms of Service say otherwise. If you want a copy of your notes, ask for it before you ask us to delete.

7. Security

We use HTTPS to encrypt data in transit, rely on providers that encrypt data at rest, restrict who can access production systems, and keep access logs. Stripe holds your card details so that we never have to.

No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur. If a security incident affects your personal information, we will notify you and any relevant authorities as the law requires. You can help by using a strong, unique password, keeping sign-in links and codes private, and telling us at once if you suspect someone else has used your account.

8. Children

The Service is intended for adults in medical education and practice. It is not directed at children, and we do not knowingly collect personal information from anyone under 13, or under 16 in the European Economic Area or United Kingdom. If you believe a child has created an account, contact us at support@ethicsuniverse.com and we will delete it.

9. Users outside the United States

EthicsUniverse is operated from the United States, and our providers store and process data primarily in the United States. If you use the Service from another country, including many of our users preparing for the USMLE from abroad, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

Where the law requires safeguards for such transfers, for example for users in the European Economic Area, United Kingdom, or Switzerland, we rely on our providers' standard contractual clauses, their participation in recognized transfer frameworks, or other lawful mechanisms. You can ask us for more detail about these safeguards at support@ethicsuniverse.com.

10. Changes to this policy

We may update this policy as the Service changes or as the law requires, and when we do, we will change the "Last updated" date at the top. If a change materially affects how we handle your information, we will notify you by email or with a notice in the Service before it takes effect, and we will ask for your consent where the law requires it.

11. Contact

Questions, requests, or concerns about your privacy: support@ethicsuniverse.com

OncUniverse LLC (d/b/a EthicsUniverse) Pennsylvania, USA