EthicsUniverse Privacy Policy

Last updated: October 24, 2026

This policy explains what information EthicsUniverse collects about you, why we collect it, where it goes, and what you can do about it. EthicsUniverse is run by OncUniverse LLC, a Pennsylvania limited liability company doing business as EthicsUniverse ("EthicsUniverse", "we", "us"), and this policy covers ethicsuniverse.com and everything we offer through it (the "Service").

The short version is this. We collect your email address and the information needed to sign you in and manage your access. Your study progress and notebook are stored in your browser, separated by account; they do not sync across devices. We do not sell your information or run advertising. Paid checkout is not available, and we do not collect payment-card details. The rest of this document is the long version.

1. What we collect

Account information. When you sign up we collect your email address and the data needed to authenticate you, such as a hashed password, one-time sign-in codes or links, and session tokens. We also record when your account was created, when you last signed in, and whether your access is free, early-access, or paid. If you were invited by someone or joined through an early-access list, we keep a record of that too.

Invitation access and feedback. When the invitation workflow is enabled, we store invitation and grant identifiers, the issuing or sponsoring account, redemption and access dates, guest-slot use, and a hash of the invitation code. New codes are not assigned to an email address before redemption. Feedback you submit for this arrangement is stored with your account and grant, the message, submission channel, receipt time, and any question identifier you include. We also record manual review decisions, the reviewer, review time, and any approved extension. Feedback sent by email may be recorded by the operator with its original receipt time and a reference to the correspondence. These records are separate from browser-stored study progress.

Optional trial emails. Only eligible accounts registered after the email program launch that explicitly opt in receive the new automatic registration, usage and expiry feedback emails. The optional choice is shown at invitation activation and in Account email preferences. It does not affect learning access. Permission applies only to future scheduled emails; missed stages are not sent later. You can stop these emails in Account preferences. An unregistered invitation follow-up requires separate explicit recipient permission and is suppressed once an account exists. We record delivery status, request references, and the email provider's message identifier to reconcile delivery without blindly sending duplicates.

Study activity stored in your browser. The app saves the latest correctness result and timestamp for questions you attempt, flashcards you mark as known, custom flashcards, notes and SuperNovas in your notebook, and highlights in this browser, separated by account. Unfinished session answers and flags are held in memory and are lost if you reload or leave the session. Interface preferences such as text size and theme are also stored in the browser. This study data is not uploaded to our database or synchronized to another browser or device. Clearing this site's browser data removes it, and we do not have a server backup to restore. Session settings and question identifiers also appear in study-page URLs and may be included in request logs.

Payment information. Paid checkout is not available. We do not currently collect payment-card details or process purchases. If you ask to be notified when paid access opens, we store your email address and, when you are signed in, associate that request with your account. We will describe payment processing here before checkout opens.

Technical information. Like any website, our servers and hosting providers log basic information about requests: your IP address, browser and device type, operating system, the pages you request, referring page, and timestamps. We use this to keep the Service running, diagnose problems, and detect abuse such as scraping or account sharing.

Optional public-page analytics. When enabled, Vercel Web Analytics counts views of our home, About, Features, Pricing, Privacy and Terms pages. We remove query strings and fragments and exclude account, invitation, sign-in, recovery and study pages. We send no account identifiers, invitation codes, questions, answers, correctness, notebook text or other learner content to this analytics service. Vercel derives approximate geographic and device/browser statistics from requests and uses a short-lived request-derived visitor hash, discarded after 24 hours; we do not collect precise location. These are aggregate traffic estimates, not registered-account or study-active-user counts. The current free plan provides one month of reporting and does not reconstruct traffic before collection starts.

Aggregate study-request counts. When enabled, our database keeps daily totals of successful explanation requests. Each new count removes totals older than 31 calendar days; if collection stops, existing totals remain until collection resumes or an operator deletes them. These counters contain only the site, UTC date, fixed event name and count: no user or question identifiers, answers, text, tokens, URLs or IP addresses. Retries may count as additional requests. The totals do not identify unique learners, correctness or study sessions, and do not upload your saved progress.

Communications. If you email us, we keep the correspondence so we can respond and keep a record of what was said.

We do not ask for your name, school, exam date, or scores, though you may choose to tell us these things in a message or a note. We do not collect health information about you, and the Service is not designed to hold patient information. Please do not put identifiable patient details in your notebook.

2. Why we collect it and how we use it

We use your information to:

• create and secure your account and sign you in;
• save your progress, notes, and preferences in your browser;
• manage your access and record your request to hear when paid access opens;
• administer invitations, review the feedback you submit for an invitation extension, and send access reminders;
• protect our content, including by placing a watermark tied to your account on pages that display questions and explanations, and by detecting copying, scraping, or account sharing;
• review corrections and feedback you choose to send us to improve the question bank. We do not currently collect your browser-stored study activity for question-performance analysis;
• send you emails about your account, such as sign-in links, security alerts, and notices about changes to our terms or this policy;
• with your permission, send you occasional news about new content or features. You can opt out at any time using the link in the email or by contacting us;
• respond to your questions and support requests; and
• comply with the law, enforce our Terms of Service, and protect our rights and the rights of others.

If you are in the European Economic Area, the United Kingdom, or another place whose law requires a legal basis for processing, ours are: performing our contract with you (running the Service you signed up for), our legitimate interests (protecting our content, securing the Service, and improving the questions), your consent (for optional emails, which you can withdraw), and compliance with legal obligations (for example keeping transaction records for tax purposes).

3. Who we share it with

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share it only in the following situations.

Service providers who help us run EthicsUniverse. These companies process data on our behalf under contracts that limit what they can do with it.

• Supabase provides our database and authentication system. It holds account and access information and requests to be notified when paid access opens. Your browser-stored study progress, flashcards, highlights, and notebook contents are not stored there.
• Supabase also holds the invitation, feedback, review, and reminder records described above when those features are enabled. Resend receives the recipient email address and reminder message when we send an access reminder; the message does not include your feedback text or invitation code.
• Vercel hosts the website, processes request logs to deliver and secure it, and provides the optional aggregate public-page analytics described above. Supabase also stores the identifier-free daily study-request totals when that measurement is enabled.

We may use additional providers for things like sending email or monitoring errors. If we do, they will be bound by similar contractual limits, and we will update this policy if the change is significant.

Legal requirements. We may disclose information if we believe in good faith that doing so is required by law, subpoena, or court order, or is necessary to protect the safety, rights, or property of EthicsUniverse, our users, or the public, including to investigate suspected fraud or violations of our Terms of Service.

Business changes. If EthicsUniverse is acquired, merged, or sells substantially all of its assets, your information may be transferred to the successor, who will be bound by this policy or will notify you of any changes.

With your consent. We may share information in other ways if you ask us to or agree to it.

4. Cookies and local storage

We use cookies and browser local storage for two purposes.

Keeping you signed in. Our authentication system stores a session token in a cookie or in local storage so you do not have to sign in on every page. These are essential. If you block them, you will not be able to use your account.

Remembering your preferences and progress. Local storage holds your study progress and notebook in this browser, along with interface preferences. Account study data is separated by account within the app. Shared-device users should use their own browser profile and sign out when finished. Browser storage is the saved copy, not a cache of a server backup, and study features still need an internet connection to load questions and explanations.

If you choose Remember email, we save your email address on this device; that option never saves your password. An invitation issuer's browser may also keep a request reference while an uncertain issuance is reconciled. That reference is not an invitation code, email address, or authentication token.

We do not use advertising cookies or third-party tracking cookies. Optional public-page analytics uses no analytics cookie. You can turn it off using the control below; this saves only an opt-out preference in this browser. We also honor Do Not Track and Global Privacy Control signals. This choice does not disable essential hosting/security logs or identifier-free daily study-request totals. If preference storage cannot be read, optional pageview analytics stays off.

You can clear or block cookies and local storage through your browser settings. Clearing them signs you out and removes the study data and preferences stored for this site in that browser. Blocking local storage can prevent study changes from being saved. Signing out alone does not erase saved browser data.

5. How long we keep it

We keep your account information for as long as your account exists. Except for the limited survey record described below, if you delete your account, or ask us to, we delete this information from our active systems within 30 days, though copies may persist in encrypted backups for a short period until those backups are overwritten on their normal schedule. Study data and notebook contents remain in your browser until you remove them in the app or clear the site's browser data. Deleting an account does not remotely clear browser storage on your devices.

Survey records after account deletion. We erase survey contact details and submitted answers and message contents from our active systems by the original 30-day account-deletion deadline. Processing the request again, a delivery timeout, or a late delivery receipt does not restart that deadline. For as long as this survey system operates, we retain a restricted record of your account identifier, survey permission and delivery status, and the minimum evidence needed to prevent duplicate emails and reconcile delayed delivery receipts. Explicit email-permission evidence retains only a domain-separated account digest, the notice and version, source and relevant timestamps, without a raw account ID, email, IP address or user agent. Opt-out and account-removal fences prevent its further use for sending. These retained records are pseudonymous, not anonymous. Email addresses, survey answers, message contents, and support-case references are not part of that lifetime record.

Server logs held by our hosting and infrastructure providers are kept for the short retention periods those providers set.

If your account has been inactive for a long time, we may delete it after giving you notice at the email address on file.

6. Your choices and rights

You can review and change much of your information yourself. Your notes and SuperNovas can be edited or deleted from within your notebook, and preferences can be changed in the app. For anything else, email support@ethicsuniverse.com.

Depending on where you live, you may have some or all of the following rights under laws such as the EU and UK General Data Protection Regulation or United States state privacy laws:

• to know what personal information we hold about you and receive a copy of it in a portable format;
• to correct information that is inaccurate or incomplete;
• to delete your account and the information associated with it;
• to object to or restrict certain processing, including processing based on our legitimate interests;
• to withdraw consent where our processing relies on it, for example for optional emails; and
• to complain to a data-protection authority where you live. We would appreciate the chance to address your concern first, but you do not have to give us one.

To exercise any of these rights, email support@ethicsuniverse.com from the address on your account so we can confirm it is you. We may ask for additional verification if we have reason to, and we respond within the time the applicable law allows, usually much sooner. We will not treat you differently for exercising your rights.

Deleting your account. Deletion is permanent. Contact us to request account deletion. Save any notes you want to keep before your account is deleted, because we do not hold a server copy to export or restore. Clear this site's browser data on each device to remove locally stored notes, SuperNovas, flashcards, and progress.

7. Security

We use HTTPS to encrypt data in transit, rely on providers that encrypt data at rest, restrict who can access production systems, and keep access logs. Browser-stored study data is subject to your device and browser security; it is not protected by our database backups.

No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur. If a security incident affects your personal information, we will notify you and any relevant authorities as the law requires. You can help by using a strong, unique password, keeping sign-in links and codes private, and telling us at once if you suspect someone else has used your account.

8. Children

The Service is intended for adults in medical education and practice. It is not directed at children, and we do not knowingly collect personal information from anyone under 13, or under 16 in the European Economic Area or United Kingdom. If you believe a child has created an account, contact us at support@ethicsuniverse.com and we will delete it.

9. Users outside the United States

EthicsUniverse is operated from the United States, and our providers store and process data primarily in the United States. If you use the Service from another country, including many of our users preparing for the USMLE from abroad, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

Where the law requires safeguards for such transfers, for example for users in the European Economic Area, United Kingdom, or Switzerland, we rely on our providers' standard contractual clauses, their participation in recognized transfer frameworks, or other lawful mechanisms. You can ask us for more detail about these safeguards at support@ethicsuniverse.com.

10. Changes to this policy

We may update this policy as the Service changes or as the law requires, and when we do, we will change the "Last updated" date at the top. If a change materially affects how we handle your information, we will notify you by email or with a notice in the Service before it takes effect, and we will ask for your consent where the law requires it.

11. Contact

Questions, requests, or concerns about your privacy: support@ethicsuniverse.com

OncUniverse LLC (d/b/a EthicsUniverse)

Mailing address: PO Box 203, Camp Hill, PA 17001