Privacy Policy

• Account:your email address or Google identity, and session records — so you can sign in and we know it's you.
• Profile: display name, avatar, school, your target exam and exam date, and app settings.
• Play data: quiz sessions and answers, XP, streaks, league standing, badges and titles, duels, and your projected board rating — this is the service itself.
• Integrity signals: timing and accuracy patterns used to flag implausible sessions, and PII-scrubbed error reports that help us fix bugs.
• Notifications (opt-in only):if you enable push notifications, we store your device's push subscription — never the content of any message.

We never ask for license numbers, government IDs, or birthdates, and we don't collect any other sensitive personal information. If a future feature ever wanted a field like that, we'd treat it as a major decision requiring its own review — the default answer is no.

Account, profile, and play data are processed under contract — they are what makes your account and the service work. Notifications are processed only with your explicit, opt-in consent, and are off by default. Integrity signals are processed under our legitimate interest in keeping leaderboards and competitions fair and the app reliable.

Reviewlution automatically selects which questions to show you, calculates your projected board rating, and flags sessions with implausible timing or accuracy patterns for review. No automated system ever bans or penalizes an account on its own — a flagged session is reviewed by a person before any competitive credit is withheld or any action is taken.

You can request an export of your account and play data as a file, or request deletion of your account at any time. Deleting your account removes your personal data; because rankings are shared with other players, your public leaderboard footprint is anonymized rather than deleted outright, so it doesn't corrupt anyone else's standing. To make either request, contact us at the email below.

We use a small number of first-party cookies and no advertising or cross-site tracking cookies at all. Opening Reviewlution sets none of them: until you sign in or arrive through an invite link, nothing is written to your device.

• Sign-in session:keeps you signed in and proves it's you on every request. Strictly necessary — the app cannot work without it.
• rl_ref and rl_school (30 days):set only if you arrive through someone's invite or recruit link, so their referral reward and your school nudge still work after you play as a guest first. They hold a user or school id, nothing about your browsing.
• sidebar_state: remembers whether a panel was left open. A display preference.
• rl_staff_app_mode: staff accounts only, and only for the current browser session — it lets a staff member use the player app without being redirected to the admin panel.

For traffic and performance measurement we use Vercel Analytics and Speed Insights, which are cookieless — they set nothing on your device and build no profile of you. We run no advertising pixels.

Because none of these are used for advertising or tracking across other sites, Reviewlution does not show a cookie consent banner. You can clear or block cookies in your browser at any time; blocking the sign-in cookie will mean you cannot stay signed in.

• Account and profile data: kept while your account is active, purged within 30 days of a deletion request.
• Play data (attempts, XP): kept while active, anonymized (not deleted outright) when you delete your account.
• Prize payout records (GCash winners): retained as required by tax law, even after account deletion.
• Raw timing telemetry: kept 12–24 months, then deleted (the resulting integrity decisions are kept).
• Notification consent: kept until you withdraw it, then deleted.

We use a small set of service providers to run Reviewlution, each bound to protect your data: Supabase (database and storage), Google (sign-in), Resend (email delivery), DigitalOcean (rate limiting and caching), Sentry (error monitoring), and Vercel (hosting and cookieless analytics). We do not sell your data, and we don't share it with anyone outside this list except where required by law. Reviewlutionis free, so there is no payment processor and no card data anywhere in the product.

Reviewlution is built for licensure exam reviewees, who are typically adults. We do not knowingly allow under-18s to create accounts and do not collect birthdates to check age. If we learn that a user is a minor, we will handle it in line with applicable data-privacy rules for minors.

Reviewlution is built to comply with the Philippine Data Privacy Act (RA 10173). We are completing the remaining compliance steps — including formally registering our Data Protection Officer and data processing systems with the National Privacy Commission — and this policy will be updated once that registration is complete.

If we materially change how we collect or use your data, we'll update this page and its version number above. Continued use of Reviewlution after a change means you accept the updated policy.

Questions about this policy, or a data export/deletion request? Email us at inquiry@chrisbelga.dev.