Privacy Policy

• Account:your email address or Google identity, and session records — so you can sign in and we know it's you.
• Profile: display name, avatar, school, your target exam and exam date, and app settings.
• Play data: quiz sessions and answers, XP, streaks, league standing, badges and titles, duels, and your projected board rating — this is the service itself.
• Integrity signals: timing and accuracy patterns used to flag implausible sessions, and PII-scrubbed error reports that help us fix bugs.
• Notifications (opt-in only):if you enable push notifications, we store your device's push subscription — never the content of any message.

We never ask for license numbers, government IDs, or birthdates, and we don't collect any other sensitive personal information. If a future feature ever wanted a field like that, we'd treat it as a major decision requiring its own review — the default answer is no.

Account, profile, and play data are processed under contract — they are what makes your account and the service work. Notifications are processed only with your explicit, opt-in consent, and are off by default. Integrity signals are processed under our legitimate interest in keeping leaderboards and competitions fair and the app reliable.

Reviewlution automatically selects which questions to show you, calculates your projected board rating, and flags sessions with implausible timing or accuracy patterns for review. No automated system ever bans or penalizes an account on its own — a flagged session is reviewed by a person before any competitive credit is withheld or any action is taken.

You can request an export of your account and play data as a file, or request deletion of your account at any time. Deleting your account removes your personal data; because rankings are shared with other players, your public leaderboard footprint is anonymized rather than deleted outright, so it doesn't corrupt anyone else's standing. To make either request, contact us at the email below.

• Account and profile data: kept while your account is active, purged within 30 days of a deletion request.
• Play data (attempts, XP): kept while active, anonymized (not deleted outright) when you delete your account.
• Payment records (once payments launch): retained as required by tax law, even after account deletion.
• Raw timing telemetry: kept 12–24 months, then deleted (the resulting integrity decisions are kept).
• Notification consent: kept until you withdraw it, then deleted.

We use a small set of service providers to run Reviewlution, each bound to protect your data: Supabase (database and storage), Google (sign-in), Resend (email delivery), Xendit (payments, once launched), Upstash (rate limiting and caching), Sentry (error monitoring), and Vercel (hosting). We do not sell your data, and we don't share it with anyone outside this list except where required by law.

Reviewlution is built for licensure exam reviewees, who are typically adults. We do not knowingly allow under-18s to create accounts and do not collect birthdates to check age. If we learn that a user is a minor, we will handle it in line with applicable data-privacy rules for minors.

Reviewlution is built to comply with the Philippine Data Privacy Act (RA 10173). As a free beta product, we are completing the remaining pre-launch compliance steps — including formally registering our Data Protection Officer and data processing systems with the National Privacy Commission — ahead of public launch, and this policy will be updated once that registration is complete.

If we materially change how we collect or use your data, we'll update this page and its version number above. Continued use of Reviewlution after a change means you accept the updated policy.

Questions about this policy, or a data export/deletion request? Email us at inquiry@chrisbelga.dev.