Privacy policy

1. Who we are

CrunchMD ("we", "us") operates CrunchMD. For anything in this policy, contact privacy@crunchmd.com.

2. What we collect

• Account data: your email address and your plan.
• Content you upload (lecture files and the text extracted from them) and what we generate from it: questions, explanations, flashcards, exam results and your study history.
• AI usage records: token counts and estimated cost per request, used for fair-use limits and billing. These never include your lecture or question text.
• Usage analytics through PostHog: pages viewed, clicks, feature usage, device and browser, and approximate location from your IP address. Where required, only with your consent, we also record session replays in which all form inputs and lecture content are masked. Events about your activity are tied to an internal account id, never to your email, and never include lecture text, question text or your answers.
• Technical logs held by Vercel, our host.
• Cookies. Essential: your sign-in session, the sign-in security (CSRF) cookie, cm_region (which consent rules apply to you) and cm_consent (your analytics choice). Analytics: PostHog's cookie and browser storage, only as described under "Your choices" below.

Your choices

• In the EU/EEA, the UK, Switzerland, Brazil and where we cannot tell where you are, analytics is off until you accept. Until you choose, nothing is stored in your browser and no analytics events are sent. If you reject, no analytics cookies are set and only anonymous, cookieless counts remain.
• Elsewhere, analytics is on by default and you can turn it off at any time with "Do not sell or share my personal information" in the footer.
• A Global Privacy Control signal from your browser is treated as a rejection everywhere, and overrides an earlier acceptance.
• You can change your choice at any time from "Privacy settings" in the footer.

3. How we use it, and why

Nothing is sold, and nothing is shared for advertising.

4. AI processing

The material you upload is sent to our AI provider (currently Anthropic) to read scanned pages, write questions, grade typed answers, answer explain-this follow-ups and write Patient Encounters patients. Our AI provider does not use data we send through its business API to train its models. Do not upload patient-identifiable information. CrunchMD is not for protected health information.

5. Service providers

6. International transfers

Data is processed in the United States. Transfers from the EU, UK, Switzerland and Brazil rely on Standard Contractual Clauses in each provider's data processing agreement and, where a provider is certified, the EU-US Data Privacy Framework (with the UK Extension and the Swiss-US Data Privacy Framework).

7. Retention

• Account data and uploads: until you delete them or your account.
• Analytics events: 1 year.
• Session replays: 30 days.
• Billing records: 7 years.
• Server logs: Vercel's default retention, which is short-lived.

8. Your rights

Depending on where you live, you have these rights. Email us or use Settings to exercise them.

EU, EEA, UK and Switzerland (GDPR / UK GDPR)

Access, rectification, erasure, restriction, portability and objection; withdrawing consent at any time (use "Privacy settings" in the footer); and complaining to your supervisory authority.

Brazil (LGPD)

Confirmation that we process your data, access, correction, anonymization, blocking or deletion, portability, information about who it is shared with, revoking consent, and petitioning the ANPD.

California (CCPA / CPRA)

The right to know and access, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against. We do not sell your personal information or share it for cross-context behavioral advertising. Global Privacy Control signals are honored as an opt-out, and the "Do not sell or share my personal information" link in the footer turns analytics off immediately.

9. Requests and deleting your data

From Settings you can download your account data as a JSON file, or delete your account. Deleting removes your material, your uploaded files, your questions, tutor messages and your whole answer history, and cannot be undone. Individual files can be removed from Import; questions already generated from a file are kept when you do that, so your progress survives a tidy-up.

For any other request, email privacy@crunchmd.com from your account email. We verify you by email. We reply within the time your law requires, and at most 30 days (15 days for Brazil confirmation and access requests). California requests may take up to 45 days. Authorized agents may submit CCPA requests.

10. Security

Data is encrypted in transit, cloud-storage tokens are encrypted before they are stored, access is limited, session replays mask form inputs and lecture content, and analytics carries as little as possible.

11. Children

CrunchMD is not directed to children under 16 and we do not knowingly collect their data.

12. Changes to this policy

If this policy changes in a way that matters, we will tell signed-in users by email or in the app, and update the effective date above.

For schools

If a school is considering adopting CrunchMD: performance data of a named student is likely an education record under FERPA when an institution is the customer, and the school should ask for a written agreement covering retention, redisclosure and deletion before anyone uploads coursework.