Privacy Policy

Last updated: March 4, 2026

1. Overview

Competent ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your information. We believe in simplicity: your data is yours, and we don't do anything weird with it.

2. Data We Collect

Account Information

• Email address — required for account creation and authentication
• Password — stored as a cryptographic hash (we never see your plain-text password)
• Name — optional, provided during onboarding

Study Data (User Content)

• Practice case logs (name, date, source, type, timing)
• Assessment Opportunity entries (description, competency area, score band, comments)
• Technical notes per competency area
• Elective selection and exam date

Payment Information

Payment processing is handled entirely by Stripe. We never see, store, or have access to your full credit card number. We store only your Stripe customer ID to manage your subscription status.

Technical Data

We use standard web infrastructure that may log IP addresses, browser type, and request timestamps for security and debugging purposes. We do not use third-party analytics, advertising pixels, or tracking scripts.

3. How We Use Your Data

We use your data exclusively to:

• Authenticate you and maintain your session
• Store and display your case logs, AO scores, and study notes
• Generate your personal analytics (heatmap, trends, flags)
• Send transactional emails (confirmation, password reset, welcome)
• Process payments through Stripe

We do not:

• Sell, share, or license your data to third parties
• Use your data for advertising or marketing to third parties
• Analyze aggregate user data for research purposes
• Train AI models on your study data

4. Data Storage and Security

Your data is stored in a Supabase database with row-level security (RLS) enabled. This means that every database query is scoped to your user ID — your account can only access your own data. The database is hosted on cloud infrastructure with encryption at rest and in transit.

5. Data Retention

We retain your data for as long as your account exists. When you delete your account (via Settings), all your data — including cases, AOs, notes, and profile — is permanently deleted. There is no recovery after deletion.

6. Third-Party Services

We use the following third-party services:

• Supabase — database hosting, authentication
• Stripe — payment processing
• Resend — transactional email delivery
• Vercel — application hosting

Each of these services has their own privacy policy. We only share the minimum data necessary for each service to function (e.g., email for authentication, customer ID for payments).

7. Cookies

We use essential cookies only — specifically, the Supabase authentication cookie that maintains your login session. We do not use tracking cookies, advertising cookies, or third-party cookies.

8. Your Rights

You have the right to:

• Access — View all your data through the app (cases, notes, settings)
• Update — Edit your profile, cases, and notes at any time
• Delete — Delete all your data or your entire account through Settings
• Export — Request a copy of your data by emailing hello@competent.app

9. Children's Privacy

Competent is not intended for children under 16. We do not knowingly collect information from children under 16.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top reflects the most recent revision.

11. Contact

Privacy questions or data requests? Email hello@competent.app.