BoardBound Privacy Policy

Effective date: April 2, 2026 · Last updated: April 2, 2026

BoardBound ("the App") is operated by Martin Apps LLC, an Alabama limited liability company. This policy describes what data we collect, why we collect it, and how we protect it.

BoardBound is an educational exam preparation tool for Family Nurse Practitioner (FNP) board certification. It is not a medical device and does not provide medical advice.

1. Data We Collect

Account Information

When you create an account, we collect:

Email address and password (for email signup), or
Name and email provided by Apple (for Sign in with Apple)
Display name (optional, user-provided)

Study Profile

During onboarding you provide:

Exam target (AANP, ANCC, or both)
Expected exam date

Study Progress

As you use the App, we record:

Questions answered, selected answers, and correctness
Time spent per question
Study mode (practice, exam simulation, daily quiz)
Spaced repetition scheduling data (review intervals, ease factors)
Accuracy statistics by clinical domain
Study streaks and last study date

AI Tutor Interactions

When you use the AI Tutor feature, we process:

The question text, your answer, the correct answer, and the expert explanation
Your identified weak areas (if available), to personalize explanations
Your messages to the AI Tutor and its responses (stored as conversation history)
Daily usage counts (for rate limiting)

You must explicitly consent to AI data sharing before using this feature. You can revoke consent at any time in Settings.

Subscription Information

If you subscribe, Apple processes your payment. We receive from our subscription provider (RevenueCat):

Subscription status and tier (free, monthly, or sprint)
Expiration date
A RevenueCat customer identifier

We do not receive or store your payment method, credit card number, or Apple ID password.

Crash Reports

If the App crashes, our error reporting service (Sentry) automatically collects:

Error type, stack trace, and breadcrumbs (actions leading to the crash)
Device model, operating system version, and app version

Crash reports may include screen names and navigation paths but do not include your study answers, messages, or personal information.

Data We Do Not Collect

Location data
Contacts, photos, or camera access
Health or fitness data
Advertising identifiers or cross-app tracking
Browsing history

2. How We Use Your Data

Data	Purpose
Account info	Authenticate you and sync your progress across devices
Study profile	Personalize your study plan and daily question targets
Study progress	Track your performance, power spaced repetition, and show accuracy breakdowns
AI Tutor data	Generate personalized explanations via the Anthropic Claude API
Subscription info	Determine your access tier and enforce usage limits
Crash reports	Diagnose and fix bugs

We do not sell your data. We do not use your data for advertising. We do not build marketing profiles.

3. Third-Party Services

We share data with the following services, solely for the purposes described:

Service	Purpose	Data Shared	Privacy Policy
Supabase	Authentication, database, API	Account info, study progress, AI tutor sessions	supabase.com/privacy
Anthropic	AI Tutor (Claude)	Question text, your answer, correct answer, explanation, conversation messages	anthropic.com/privacy
RevenueCat	Subscription management	User identifier, subscription status	revenuecat.com/privacy
Sentry	Crash reporting	Error data, device info, app version	sentry.io/privacy
Apple	Sign in with Apple	Name and email (user-authorized)	apple.com/legal/privacy

4. Data Storage and Security

Local storage: Study progress and spaced repetition data are stored on your device in a local SQLite database. Authentication tokens are stored securely in the iOS Keychain.
Cloud storage: Your account, profile, and progress data are stored in Supabase (hosted on AWS). All data is isolated by user via row-level security policies — no user can access another user's data.
In transit: All data is transmitted over HTTPS/TLS.

5. Data Retention

Your data is retained for as long as your account is active.
When you delete your account (Settings > Delete Account), all your data is permanently removed from our servers. Profile data, study progress, AI tutor sessions, and usage records are deleted via cascading database deletion.
Local data (on-device database and Keychain entries) is cleared at the time of account deletion.
Crash reports in Sentry are retained for 90 days.
Anthropic may retain AI Tutor inputs in accordance with their privacy policy. Anthropic does not use API inputs to train models.

6. Your Rights

You can:

Access your data at any time within the App (Settings, Progress screens)
Edit your display name, exam target, and exam date in Settings
Revoke AI consent at any time in Settings, which stops all data sharing with Anthropic
Delete your account in Settings, which permanently removes all your data
Request a data export by contacting us at the email below

7. International Data Transfers

Your data is processed and stored in the United States by our service providers (Supabase, Anthropic, RevenueCat, Sentry). If you are located outside the United States, your data will be transferred to the U.S. for processing. By using the App, you consent to this transfer. Our service providers maintain appropriate safeguards for data protection.

8. Legal Basis for Processing (EEA/UK Users)

If you are in the European Economic Area or United Kingdom, we process your data under the following legal bases:

Contractual necessity: Account creation, study progress tracking, and subscription management — required to provide the service
Consent: AI Tutor data sharing with Anthropic — you explicitly opt in and can revoke at any time
Legitimate interest: Crash reporting and error diagnosis — necessary to maintain app quality and stability

You may exercise your rights under GDPR (access, rectification, erasure, portability, objection) by contacting us at the email below.

9. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

Right to Know: You may request the categories and specific pieces of personal information we have collected
Right to Delete: You may request deletion of your personal information (available in Settings > Delete Account)
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

To exercise these rights, contact us at privacy@martinapps.dev.

10. Children's Privacy

BoardBound is intended for adult nursing students preparing for board certification. We do not knowingly collect data from children under 13. If you believe a child has created an account, please contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you via the App or email. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For privacy questions, data requests, or concerns:

Email: privacy@martinapps.dev
Martin Apps LLC, Alabama, United States