Privacy Policy

1 Who we are

Code One Recall ("Code One Recall", "we", "us" or "our") is a clinical reference and study platform for paramedicine students and practitioners. The site is operated by a group based in Queensland, Australia. For the purposes of data-protection law, we are the controller responsible for the personal information described in this policy.

If you have any question about this policy or your data, you can reach us at codeonerecall@gmail.com.

2 Information we collect

Information you give us

• Account details, when you sign up, we collect your email address and a password. Your password is encrypted and stored in a hashed form; we never see or store it in plain text.
• Content you create, any flashcards or study material you add to your account.

Information created as you use the site

• Study progress, your answers to daily questions, your streaks, and your flashcard review history (including the scheduling data our spaced-repetition system needs to plan your next review).

Information collected automatically

• Usage and analytics data, if and when we enable analytics, we may collect anonymous or aggregated information about how the site is used, such as which pages are visited and general device and browser type. This is covered in the cookies section below.
• Technical logs, like most websites, our hosting providers automatically record basic technical information such as IP address and request times to keep the service secure and running.

Information stored on your own device

• Local study data, to let the site work offline and feel fast, some of your study data is stored locally in your browser. When you are logged in, this is kept in sync with your account; when you are logged out, it stays on your device only and is not sent to us.
• Daily question progress without an account, you can answer the daily question without signing up. Your streak, the days you have completed and whether you answered correctly first time are saved in your browser's local storage so the site can show them when you come back. While you are logged out this never leaves your device, we do not receive it, and it is not linked to your name, email or any identifier we hold.
• If you later create an account, the first time you log in, any daily question progress saved on that device is transferred into your account so your streak carries over, and the local copy is then deleted. From that point it is account data, covered by the rest of this policy. If you never create an account, it simply stays on your device.

3 How we use your information

We only use your personal information for the following purposes, and each use has a lawful basis under data-protection law:

• To provide your account and sync your progress across devices. Lawful basis: performance of our agreement with you.
• To keep the service secure, prevent abuse, and fix problems. Lawful basis: our legitimate interests in running a safe, reliable service.
• To understand and improve how the site is used through analytics. Lawful basis: your consent, which you can withdraw at any time.
• To contact you about your account, such as confirming your email or resetting your password. Lawful basis: performance of our agreement with you.

We do not use your information to make automated decisions that have a legal or similarly significant effect on you, and we do not sell your personal information.

4 Cookies and analytics

A cookie is a small file stored by your browser. We use a small number of essential cookies and similar local storage that the site needs to function, for example, to keep you logged in and to save your study data on your device. These are always on because the site cannot work without them.

We may also use analytics cookies or a privacy-focused analytics tool to understand how the site is used so we can improve it. Analytics are not essential, so where the law requires it we will ask for your consent before loading them, and you can decline or change your mind at any time without losing access to any feature. You can also block or delete cookies through your browser settings, though essential cookies are needed for the site to work.

5 How and where we store data

Your account and progress data are stored using Supabase, our database and authentication provider, in a data centre located in Sydney, Australia. The website itself is served through Netlify, our static hosting provider.

We protect your information with measures appropriate to its sensitivity, including:

• encryption of data in transit (HTTPS) and of passwords at rest;
• access controls that restrict each account to its own data, so one user can never read another user's records;
• limiting access to information to what is needed to operate and support the service.

No method of storage or transmission is ever completely secure, but we take reasonable steps to protect your information and to keep those protections up to date.

6 Who we share data with

We do not sell, rent or trade your personal information. We share it only with the service providers that help us run Code One Recall, and only so far as they need it to provide their service to us:

• Supabase, database, authentication and account email delivery.
• Netlify, website hosting and delivery.
• An analytics provider, if and when analytics are enabled, to measure site usage.

These providers are bound to protect your information and may only use it to deliver their service to us. We may also disclose information if we are required to do so by law, or to protect the rights, safety or property of our users or others.

7 International data transfers

Your account data is stored in Australia. If you access Code One Recall from outside Australia, including from the European Union, the United Kingdom or the United States, your information will be transferred to and stored in Australia, which may have different data-protection laws to your own country.

Where we transfer personal information internationally, we take steps to ensure it remains protected to a standard consistent with this policy and with applicable law, including relying on appropriate safeguards such as standard contractual clauses where required.

8 How long we keep data

We keep your account information and study progress for as long as your account is active, so that your data is there whenever you return. If you delete your account, your personal data is permanently removed from our systems, and the study data stored locally on your device is cleared. We may retain limited information for longer where the law requires it, for example to meet record-keeping obligations.

Study data saved on your device while you are logged out, such as a daily question streak, is not held by us and so is not ours to delete. It stays in your browser until you clear this site's browsing data in your browser settings, or until it transfers into your account the first time you log in.

9 Your privacy rights

Whoever and wherever you are, you can ask us to:

• Access the personal information we hold about you;
• Correct information that is inaccurate or out of date;
• Delete your account and the data associated with it;
• Export your data in a portable format;
• Opt out of analytics and withdraw any consent you have given.

You can correct your email and delete your account directly from your account menu on the site. For any other request, email us at codeonerecall@gmail.com. We may need to verify your identity before acting on a request, to make sure we are not giving your data to someone else. We will respond within the time required by the law that applies to you.

10 Children's privacy

Code One Recall is intended for paramedicine students and practitioners and is not directed at children. You must be at least 16 years old to create an account. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

11 Data breaches

We take steps to prevent unauthorised access to your information. In the unlikely event of a data breach that is likely to result in serious harm, we will notify affected users and the relevant regulator as required by the Notifiable Data Breaches scheme in Australia and by any other privacy law that applies to you.

12 Email communications

We only send you emails that relate to your account and the service, for example, confirming your email address, resetting your password, or notifying you of an important change to your account. We do not send marketing or promotional emails without your separate consent, and any such emails would always include a way to unsubscribe.

13 Third-party links

Our site may link to other websites that we do not control. This policy does not apply to those sites, and we are not responsible for their privacy practices. We encourage you to read the privacy policy of any website you visit through a link from Code One Recall.

14 Changes to this policy

We may update this Privacy Policy from time to time as the site develops or as the law changes. When we do, we will revise the "Last updated" date at the top of this page, and for significant changes we will take reasonable steps to let you know. Your continued use of the site after an update means you accept the revised policy.

15 Contact and complaints

If you have any question, request or complaint about your privacy or this policy, please contact us at codeonerecall@gmail.com. We will do our best to resolve it promptly. If you are not satisfied with our response, you can also contact the privacy regulator in your country, such as the OAIC in Australia.