Privacy Policy

MedDuel is operated by TODO: PRODUCT_OWNER_CONFIRM_LEGAL_ENTITY. The product owner must confirm the controller's registered address before public release: TODO: PRODUCT_OWNER_CONFIRM_CONTROLLER_ADDRESS.

Privacy requests can be sent to support@medduel.app.

Account information: email address, password-authentication account identifiers managed by Supabase Auth, sign-in status, and email verification status.

Profile and education information: username, display name, avatar choice, exam track, user type, learning goal, preferred difficulty, target exam date, rank tier, XP, streaks, selected badges, onboarding status, and related profile preferences.

Gameplay and progression information: answers selected, correctness, question identifiers, scores, response times, XP awards, daily challenge results, practice results, quest progress, ward progress, saved questions, mistake or feedback history, achievements, and leaderboard-relevant progress.

Social and duel information: friend connections, invitations, notifications, duel challenge settings, live Arena participation, tournament participation, match attempts, ghost challenge creator identity, results, scores, timings, and related share or room metadata.

Technical and security information: request metadata available to the application and hosting platform, rate-limit counters, server logs, authentication events, and error diagnostics needed to secure and operate the service.

To create and secure user accounts, keep users signed in, verify access to protected routes, and protect against misuse.

To personalise onboarding, practice, quests, progression, leaderboards, duel matching, tournaments, and profile screens.

To calculate results, score answers, award XP, maintain streaks, display recent activity, and support social gameplay.

To process question reports, improve product quality, investigate reliability problems, and enforce fair play and acceptable use.

MedDuel uses Supabase for authentication, database storage, row-level security, and server-side administrative operations.

MedDuel is deployed on Vercel, which processes hosting, routing, serverless function, deployment, and operational log data.

The repository does not currently confirm analytics, advertising SDKs, cookie banners, push notification providers, or additional third-party tracking services. The product owner must update this policy before adding any such services.

We do not sell personal information. We may share information if required by law, to protect the service, or with processors that help us operate MedDuel under appropriate terms.

Account, profile, gameplay, progression, social, and duel records are kept while the account is active so the application can provide saved progress, competitive history, and social features.

Some multiplayer records may be anonymised or cancelled during account deletion where the current schema needs to preserve challenge integrity for other participants or avoid broken references.

Operational logs and hosting records may be retained by Supabase or Vercel according to their service configuration and retention practices. Product owners should confirm production retention settings before launch.

MedDuel is designed to support signed-in account deletion from Profile settings once the hosted database deletion process has been enabled. The deletion flow requires a deliberate confirmation phrase and recent password confirmation.

When the enabled deletion process succeeds, MedDuel removes the Supabase Auth user last, removes or anonymises associated personal records according to the deletion process, signs the user out locally, and returns them to authentication.

Question bank content, approved question status, and active approved question counts are not changed by account deletion.

Depending on the circumstances, UK data protection law may give you rights to access, rectify, erase, restrict, object to processing of, or receive a portable copy of your personal data.

You may also have the right to complain to the UK Information Commissioner's Office. Please contact us first if you want us to review or correct a privacy concern.

MedDuel is intended for users aged 13 or over who can responsibly use an educational medical revision product. It is not directed at young children.

If the product owner chooses a different minimum age, the app onboarding, store listing, and this policy must be updated consistently.

Supabase, Vercel, and their infrastructure may process information outside the United Kingdom. Product owners should confirm production project regions and contractual safeguards before App Store submission.

MedDuel uses authenticated routes, row-level access controls, server-side checks, and service-role operations for sensitive account deletion work.

No online service can guarantee perfect security. Users should use a strong password and keep account credentials private.

This policy is effective from 23 July 2026. We may update it when the product, processors, legal requirements, or App Store configuration changes. Material changes should be reflected in the app and on this page.