BoardBound Privacy Policy

Effective date: April 10, 2026 · Last updated: April 10, 2026

BoardBound ("the App") is operated by Martin Apps LLC, an Alabama limited liability company ("we," "us," or "our"). This policy describes what data we collect, why we collect it, how we protect it, and the choices you have.

BoardBound is an educational exam preparation tool for Family Nurse Practitioner (FNP) board certification. It is not a medical device and does not provide medical advice. BoardBound is not affiliated with, endorsed by, or connected to AANPCB® or ANCC®.

1. Data We Collect

Account Information

When you create an account, we collect:

Email address and password (for email signup; the password is stored as a cryptographic hash only, never in plain text), or
Name and email provided by Apple (for Sign in with Apple — you may choose Apple's private relay email to hide your real address)
Display name (optional, user-provided)

Study Profile

During onboarding you provide:

Exam target (AANP, ANCC, or both)
Expected exam date (optional)
Expected graduation date (optional)

Study Progress

As you use the App, we record:

Questions answered, selected answers, and correctness
Time spent per question
Study mode (practice, exam simulation, daily quiz)
Spaced repetition scheduling data (review intervals, ease factors)
Accuracy statistics by clinical domain
Study streaks and last study date

AI Tutor Interactions (opt-in only)

Before your first AI Tutor interaction, the App shows a consent screen that lists exactly what will be sent to Anthropic. The AI Tutor is disabled until you accept. You can revoke consent at any time in Settings.

If you consent, we process:

The question text and answer options
Your selected answer, the correct answer, and the expert-written clinical rationale
Your exam target (AANP/ANCC/both), to personalize explanations
Your messages to the AI Tutor and its responses (stored as conversation history)
Daily and monthly interaction counts (for rate limiting)
Token usage per session (for cost tracking)
AI responses you flag as clinically inaccurate (logged so we can review and correct them)

Important: Never enter personal health information (PHI) or real patient data into the AI Tutor. The AI Tutor is for educational exam preparation only.

Rate limits. Free accounts are limited to 3 AI Tutor interactions per day. All accounts (free and paid) are capped at 800 interactions per month. These limits protect you and us from runaway usage.

Architecture. Our Anthropic API key is never stored in the mobile app. All AI Tutor requests are proxied through our Supabase Edge Function, which adds authentication, rate limiting, and usage tracking before forwarding the request to Anthropic.

Subscription Information

If you subscribe, Apple processes your payment. We receive from our subscription provider (RevenueCat):

Subscription status and tier (free, monthly, or sprint)
Expiration date
A RevenueCat customer identifier

We do not receive or store your payment method, credit card number, or Apple ID password. Apple handles all billing.

Crash Reports

If the App crashes, our error reporting service (Sentry) automatically collects:

Error type, stack trace, and breadcrumbs (actions leading to the crash)
Device model, operating system version, and app version

Crash reports do not include your user ID, email address, IP address, study answers, or AI Tutor messages. Sentry is configured so crash data is not linked to your account.

Data We Do Not Collect

Location data
Contacts, photos, or camera access
Health or fitness data
Advertising identifiers (IDFA) or cross-app tracking
Browsing or search history

2. How We Use Your Data

Data	Purpose
Account info	Authenticate you and sync your progress across devices
Study profile	Personalize your study plan and daily question targets
Study progress	Track performance, power spaced repetition, and show accuracy breakdowns
AI Tutor data	Generate personalized explanations via the Anthropic Claude API (proxied through our Edge Function)
Flagged AI responses	Review and correct clinically inaccurate AI output
Subscription info	Determine your access tier and enforce usage limits
Crash reports	Diagnose and fix bugs

We do not sell your data. We do not use your data for advertising. We do not build marketing profiles. We do not share data with data brokers.

3. Third-Party Services

We share data with the following service providers, solely for the purposes described:

Service	Purpose	Data Shared	Privacy Policy
Supabase	Authentication, database, Edge Functions	Account info, study progress, AI tutor sessions	supabase.com/privacy
Anthropic	AI Tutor (Claude Haiku 4.5, Claude Sonnet 4) — opt-in only, proxied via our Edge Function	Question text, your answer, correct answer, expert rationale, conversation messages, exam target	anthropic.com/privacy
RevenueCat	Subscription management	User identifier, subscription status	revenuecat.com/privacy
Sentry	Crash reporting (not linked to user identity)	Error traces, device info, app version	sentry.io/privacy
Apple	Sign in with Apple, app distribution, in-app purchase processing	Apple-managed identity token; billing handled by Apple	apple.com/legal/privacy

Each provider has its own privacy policy governing how it handles data it receives from BoardBound. Anthropic does not use API inputs to train its models.

4. Data Storage and Security

Local storage: Study progress and spaced repetition data are stored on your device in a local SQLite database. Authentication tokens are stored securely in the iOS Keychain via Apple's Secure Store.
Cloud storage: Your account, profile, and progress data are stored in Supabase (hosted on AWS). All data is isolated by user via row-level security (RLS) policies — no user can access another user's data.
In transit: All data is transmitted over HTTPS/TLS.
Server-side safeguards: The AI Tutor Edge Function performs authentication, input validation, and rate limiting before forwarding any request to Anthropic.
No API keys on device: The Anthropic API key exists only as a server-side secret on Supabase. It is not present in the mobile app binary.

No system is perfectly secure. If we discover a breach affecting your data, we will notify you consistent with applicable law.

5. Data Retention

Your data is retained for as long as your account is active.
When you delete your account (Settings > Delete Account), all your data is permanently removed from our servers. Profile data, study progress, AI tutor sessions, flagged responses, and usage records are deleted via cascading database deletion from the authentication record.
Local data (on-device database and Keychain entries) is cleared at the time of account deletion.
Some data may remain in routine encrypted backups for up to 30 days before being purged on our normal backup rotation.
Crash reports in Sentry are retained for 90 days.
Anthropic may retain AI Tutor inputs in accordance with their privacy policy. Anthropic does not use API inputs to train models.

6. Your Rights

You can:

Access your data at any time within the App (Settings, Progress screens)
Edit your display name, exam target, and exam date in Settings
Revoke AI Tutor consent at any time in Settings, which stops all data sharing with Anthropic
Delete your account in Settings, which permanently removes all your data
Request a data export by contacting us at the email below

To exercise any of these rights, email privacy@martinapps.dev from the address on your account. We respond within 30 days.

7. International Data Transfers

BoardBound is operated from the United States. Your data is processed and stored in the United States by our service providers (Supabase, Anthropic, RevenueCat, Sentry). If you are located outside the United States, your data will be transferred to the U.S. for processing. By using the App, you consent to this transfer.

For users in the European Economic Area and the United Kingdom, these transfers rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards maintained by our service providers, to protect your data in accordance with EU/UK data protection law.

8. Legal Basis for Processing (EEA/UK Users)

If you are in the European Economic Area or United Kingdom, we process your data under the following legal bases:

Contractual necessity: Account creation, study progress tracking, and subscription management — required to provide the service
Consent: AI Tutor data sharing with Anthropic — you explicitly opt in via the in-app consent screen and can revoke at any time
Legitimate interest: Crash reporting and error diagnosis — necessary to maintain app quality and stability

You may exercise your rights under GDPR (access, rectification, erasure, portability, objection) by contacting us at the email below.

9. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

Right to Know: You may request the categories and specific pieces of personal information we have collected
Right to Delete: You may request deletion of your personal information (available in Settings > Delete Account)
Right to Correct: You may request correction of inaccurate personal information
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. To exercise these rights, contact us at privacy@martinapps.dev.

10. Children's Privacy

BoardBound is rated 13+ in the App Store and is intended for adult nursing students preparing for board certification. We do not knowingly collect data from children under 13. If you believe a child has created an account, please contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you via the App or email before the changes take effect. The "Last updated" date at the top reflects the most recent revision. Continued use of the App after the effective date of an updated policy constitutes acceptance.

12. Contact

For privacy questions, data requests, or concerns:

Email: privacy@martinapps.dev
Martin Apps LLC, Alabama, United States