Privacy Policy

250+ exists to help you study for Step 2 CK and COMLEX Level 2. We store the minimum data needed to sync your progress across devices. We don't sell your data, we don't run ads, and we don't use third-party tracking analytics. If you delete your account, your data is gone.

• •Account info: your email address, optionally your display name and avatar (if you sign in with Google).
• •Study progress: which notes/cases you marked complete, your flashcard review history (ease factor, interval, due date, last grade).
• •Highlights you create: the highlighted text, color, and the section of the note it belongs to.
• •User-created flashcards: front, back, tags, and the highlight (if any) the card was made from.
• •Technical info: standard server logs (IP address, browser type, timestamp) kept by our hosting provider for security and reliability.

We do not collect: physical address, phone number, payment info, health information, exam scores, or location beyond rough region inferred from your IP.

• •Sync your study progress and flashcards across devices.
• •Show you the cards that are due for review today, based on the SM-2 spaced-repetition algorithm.
• •Send you the magic-link email you requested when signing in. We do not send marketing email.
• •Keep the site secure (rate limit, prevent abuse).

• •Authentication and database: Supabase (US region). Their privacy policy: supabase.com/privacy.
• •Hosting + CDN: Vercel. Their privacy policy: vercel.com/legal/privacy-policy.
• •Email delivery (magic links): Supabase’s built-in email service.
• •If you sign in with Google: Google handles the OAuth handshake — we receive only your email, name, and avatar URL.

These vendors are bound by their own privacy commitments and only process the data we send them in service of operating the app.

We use one kind of cookie: the authentication session cookie set by Supabase when you log in. It exists only to keep you signed in. No advertising, analytics, or cross-site tracking cookies are used.

• •View your data: signed-in users can see all their progress on the dashboard.
• •Export your data: email contact@250plus.org and we’ll send you a JSON dump within 14 days.
• •Delete your data: email contact@250plus.org with the address you signed up with and we’ll wipe your account within 7 days. (A self-serve “Delete account” button is coming soon.)
• •Correct your data: profile fields can be edited inside the app.

250+ is intended for medical students and is not directed at children under 13. If we learn that we've collected data from a child under 13, we'll delete it.

We'll update the date at the top of this page when the policy changes. Material changes (anything that changes what data we collect or who we share it with) will trigger an in-app notice.

Questions about your data or this policy: contact@250plus.org.