BoardBound Privacy Policy
Effective date: April 10, 2026 · Last updated: April 10, 2026
BoardBound ("the App") is operated by Martin Apps LLC, an Alabama limited liability company ("we," "us," or "our"). This policy describes what data we collect, why we collect it, how we protect it, and the choices you have.
BoardBound is an educational exam preparation tool for Family Nurse Practitioner (FNP) board certification. It is not a medical device and does not provide medical advice. BoardBound is not affiliated with, endorsed by, or connected to AANPCB® or ANCC®.
1. Data We Collect
Account Information
When you create an account, we collect:
- Email address and password (for email signup; the password is stored as a cryptographic hash only, never in plain text), or
- Name and email provided by Apple (for Sign in with Apple — you may choose Apple's private relay email to hide your real address)
- Display name (optional, user-provided)
Study Profile
During onboarding you provide:
- Exam target (AANP, ANCC, or both)
- Expected exam date (optional)
- Expected graduation date (optional)
Study Progress
As you use the App, we record:
- Questions answered, selected answers, and correctness
- Time spent per question
- Study mode (practice, exam simulation, daily quiz)
- Spaced repetition scheduling data (review intervals, ease factors)
- Accuracy statistics by clinical domain
- Study streaks and last study date
AI Tutor Interactions (opt-in only)
Before your first AI Tutor interaction, the App shows a consent screen that lists exactly what will be sent to Anthropic. The AI Tutor is disabled until you accept. You can revoke consent at any time in Settings.
If you consent, we process:
- The question text and answer options
- Your selected answer, the correct answer, and the stored clinical rationale
- Your exam target (AANP/ANCC/both), to personalize explanations
- Your messages to the AI Tutor and its responses (stored as conversation history)
- Daily and monthly interaction counts (for rate limiting)
- Token usage per session (for cost tracking)
- AI responses you flag as clinically inaccurate (logged so we can review and correct them)
Important: Never enter personal health information (PHI) or real patient data into the AI Tutor. The AI Tutor is for educational exam preparation only.
Rate limits. Free accounts are limited to 3 AI Tutor interactions per day. All accounts (free and paid) are capped at 800 interactions per month. These limits protect you and us from runaway usage.
Architecture. Our Anthropic API key is never stored in the mobile app. All AI Tutor requests are proxied through our Supabase Edge Function, which adds authentication, rate limiting, and usage tracking before forwarding the request to Anthropic.
Subscription Information
If you subscribe, Apple processes your payment. We receive from our subscription provider (RevenueCat):
- Subscription status and tier (free, monthly, or sprint)
- Expiration date
- A RevenueCat customer identifier
We do not receive or store your payment method, credit card number, or Apple ID password. Apple handles all billing.
Crash Reports
If the App crashes, our error reporting service (Sentry) automatically collects:
- Error type, stack trace, and breadcrumbs (actions leading to the crash)
- Device model, operating system version, and app version
Crash reports do not include your user ID, email address, IP address, study answers, or AI Tutor messages. Sentry is configured so crash data is not linked to your account.
Data We Do Not Collect
- Location data
- Contacts, photos, or camera access
- Health or fitness data
- Advertising identifiers (IDFA) or cross-app tracking
- Browsing or search history
2. How We Use Your Data
| Data | Purpose |
|---|---|
| Account info | Authenticate you and sync your progress across devices |
| Study profile | Personalize your study plan and daily question targets |
| Study progress | Track performance, power spaced repetition, and show accuracy breakdowns |
| AI Tutor data | Generate personalized explanations via the Anthropic Claude API (proxied through our Edge Function) |
| Flagged AI responses | Review and correct clinically inaccurate AI output |
| Subscription info | Determine your access tier and enforce usage limits |
| Crash reports | Diagnose and fix bugs |
We do not sell your data. We do not use your data for advertising. We do not build marketing profiles. We do not share data with data brokers.
3. Third-Party Services
We share data with the following service providers, solely for the purposes described:
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Supabase | Authentication, database, Edge Functions | Account info, study progress, AI tutor sessions | supabase.com/privacy |
| Anthropic | AI Tutor (Claude Haiku 4.5, Claude Sonnet 4) — opt-in only, proxied via our Edge Function | Question text, your answer, correct answer, expert rationale, conversation messages, exam target | anthropic.com/privacy |
| RevenueCat | Subscription management | User identifier, subscription status | revenuecat.com/privacy |
| Sentry | Crash reporting (not linked to user identity) | Error traces, device info, app version | sentry.io/privacy |
| Apple | Sign in with Apple, app distribution, in-app purchase processing | Apple-managed identity token; billing handled by Apple | apple.com/legal/privacy |
Each provider has its own privacy policy governing how it handles data it receives from BoardBound. Anthropic does not use API inputs to train its models.
4. Data Storage and Security
- Local storage: Study progress and spaced repetition data are stored on your device in a local SQLite database. Authentication tokens are stored securely in the iOS Keychain via Apple's Secure Store.
- Cloud storage: Your account, profile, and progress data are stored in Supabase (hosted on AWS). All data is isolated by user via row-level security (RLS) policies — no user can access another user's data.
- In transit: All data is transmitted over HTTPS/TLS.
- Server-side safeguards: The AI Tutor Edge Function performs authentication, input validation, and rate limiting before forwarding any request to Anthropic.
- No API keys on device: The Anthropic API key exists only as a server-side secret on Supabase. It is not present in the mobile app binary.
No system is perfectly secure. If we discover a breach affecting your data, we will notify you consistent with applicable law.
5. Data Retention
- Your data is retained for as long as your account is active.
- When you delete your account (Settings > Delete Account), all your data is permanently removed from our servers. Profile data, study progress, AI tutor sessions, flagged responses, and usage records are deleted via cascading database deletion from the authentication record.
- Local data (on-device database and Keychain entries) is cleared at the time of account deletion.
- Some data may remain in routine encrypted backups for up to 30 days before being purged on our normal backup rotation.
- Crash reports in Sentry are retained for 90 days.
- Anthropic may retain AI Tutor inputs in accordance with their privacy policy. Anthropic does not use API inputs to train models.
6. Your Rights
You can:
- Access your data at any time within the App (Settings, Progress screens)
- Edit your display name, exam target, and exam date in Settings
- Revoke AI Tutor consent at any time in Settings, which stops all data sharing with Anthropic
- Delete your account in Settings, which permanently removes all your data
- Request a data export by contacting us at the email below
To exercise any of these rights, email privacy@martinapps.dev from the address on your account. We respond within 30 days.
7. International Data Transfers
BoardBound is operated from the United States. Your data is processed and stored in the United States by our service providers (Supabase, Anthropic, RevenueCat, Sentry). If you are located outside the United States, your data will be transferred to the U.S. for processing. By using the App, you consent to this transfer.
For users in the European Economic Area and the United Kingdom, these transfers rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards maintained by our service providers, to protect your data in accordance with EU/UK data protection law.
8. Legal Basis for Processing (EEA/UK Users)
If you are in the European Economic Area or United Kingdom, we process your data under the following legal bases:
- Contractual necessity: Account creation, study progress tracking, and subscription management — required to provide the service
- Consent: AI Tutor data sharing with Anthropic — you explicitly opt in via the in-app consent screen and can revoke at any time
- Legitimate interest: Crash reporting and error diagnosis — necessary to maintain app quality and stability
You may exercise your rights under GDPR (access, rectification, erasure, portability, objection) by contacting us at the email below.
9. California Privacy Rights
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:
- Right to Know: You may request the categories and specific pieces of personal information we have collected
- Right to Delete: You may request deletion of your personal information (available in Settings > Delete Account)
- Right to Correct: You may request correction of inaccurate personal information
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. To exercise these rights, contact us at privacy@martinapps.dev.
10. Children's Privacy
BoardBound is rated 13+ in the App Store and is intended for adult nursing students preparing for board certification. We do not knowingly collect data from children under 13. If you believe a child has created an account, please contact us and we will delete it.
11. Changes to This Policy
We may update this policy from time to time. If we make material changes, we will notify you via the App or email before the changes take effect. The "Last updated" date at the top reflects the most recent revision. Continued use of the App after the effective date of an updated policy constitutes acceptance.
12. Contact
For privacy questions, data requests, or concerns:
- Email: privacy@martinapps.dev
- Martin Apps LLC, Alabama, United States