Privacy Policy

The short version

• We collect the least we can get away with: an email address to sign you in, your study records so you don't lose them, and billing status so we know what you've paid for.
• We never see your card number. Stripe handles payments.
• We do not sell your personal data. We run no advertising and no ad trackers.
• Your quiz answers and your own question banks are yours. We store them to give them back to you — we don't mine them and we don't train models on them.
• Usage analytics are on by default and can be switched off in one click. While the switch is off, no analytics script is loaded at all.
• When you use Ask Sentia, the text of your prompt leaves your device and goes to a third-party AI provider through our server. That is unavoidable and we say so plainly below.

What we collect, and why

Identity — your email address

An email address is required to have an account. Sentia is passwordless: you either receive a six-digit code by email and type it in, or you sign in with Google. Either way there is no Sentia password — nothing for us to store and nothing for us to lose.

If you use Google Sign-In, Google gives us your email address and basic profile information (your name and profile picture). We do not receive your Google password, and we do not request or receive access to Gmail, Drive, Calendar, Contacts or any other Google data.

Legal basisPerformance of our contract with you — we cannot run an account without it.

Profile — optional, and yours to leave blank

During sign-up we ask for a display name, your university or medical school, the exam you are preparing for, and (optionally) your target exam date. All of it is optional except the display name shown next to anything you publish. You can change or clear these in Settings → Profile.

Legal basisPerformance of our contract (the display name), and our legitimate interest in tailoring the product to the exam you're actually sitting.

Study records

Quiz attempts, the answers you chose, scores, timing, question flags, paused (suspended) sessions, and your session history. These sync to your account on every tier, including Free, so a lost, stolen or wiped device does not cost you your progress. You can clear your history from inside the app at any time.

Legal basisPerformance of our contract — this is the product.

Your own question banks and media (Pro and Max)

On the Pro and Max tiers, question banks you author or import can be backed up to private cloud storage attached to your account — including the images and audio inside them (500 MB on Pro, 2 GB on Max). These backups are private: the database enforces, row by row, that only your account can read them. Publishing a bank to the Sentia Market is a separate, deliberate act, described below.

On the Free tier your own banks stay on your device and are not uploaded.

Legal basisPerformance of our contract — it is the feature you are paying for.

Payments

Payments are processed by Stripe. Sentia never sees or stores your card number, CVC, or bank details. They go from your browser straight to Stripe. What we store is the minimum needed to know what you are entitled to: your Stripe customer and subscription identifiers, your tier, subscription status, renewal date, and whether you have used a free trial.

Stripe handles your payment details under its own privacy policy and as its own controller for fraud prevention and regulatory purposes.

Legal basisPerformance of our contract, plus our legal obligation to keep accounting records.

Sentia AI — "Ask Sentia"

Said plainly: when you send a prompt to Ask Sentia, that text leaves your device. It travels to a Sentia server function, which attaches our provider key and forwards it to a third-party large-language-model provider, which generates the answer. The prompt normally includes the question, options and explanation on screen, because that is what makes the answer useful.

We route it through our own server so that the daily allowance can be enforced there rather than trusted to the app. To do that we record usage counters against your account — the number of requests, timestamps, the model used and token counts. Daily allowances are 10 prompts on Free, 200 on Pro, and unlimited on Max subject to a fair-use ceiling of 1,000 per day.

We do not use your prompts to train any model, and we do not sell them. Our provider processes them to return an answer.

If you would rather our servers never saw your prompts, Settings → Ask Sentia lets you paste your own AI provider key. In that mode requests go directly from your device to that provider, your key is stored only on your device, and nothing passes through Sentia at all.

Please do not paste patient-identifiable information into Ask Sentia — or anywhere else in Sentia. It is a study tool, not a clinical system.

Legal basisPerformance of our contract.

Usage analytics — the switch is yours

Analytics are controlled by the "Share usage analytics" switch in Sentia — open the profile menu in the top corner of the app and choose "Sentia Market settings". It is on by default and you can turn it off at any time, permanently, in one click.

While it is on we record which screens and features get used, Market activity (downloads, ratings, comments), the app version and the platform you're on. These go to our own database tables and to PostHog, a product-analytics provider in the United States.

Two settings matter more than the list above: autocapture and session recording are deliberately turned off. That means we never capture the text on your screen — no question stems, no explanations, no answers, no notes, no keystrokes, and no video of your session. We record that a feature was used, never what you were studying.

While the switch is off, the PostHog script is not injected into the page at all, and nothing is queued or sent to our own analytics tables either. Turning it off takes effect immediately, in the same session.

Legal basisYour consent where the law requires consent, and otherwise our legitimate interest in understanding which parts of Sentia work. You can withdraw at any time with the switch.

Email we send you

Sign-in codes, receipts and service notices are delivered by Resend and sent from the mysentia.app domain. Resend sees your email address and the contents of those messages in order to deliver them.

Legal basisPerformance of our contract.

Technical and log data

Our hosting providers keep the ordinary server logs any service keeps: IP address, timestamps, request paths and browser user-agent. We use them to keep accounts secure, to investigate abuse, and to debug failures.

Legal basisOur legitimate interest in operating a secure, working service.

Sentia Market

The Market is where Sentia users share question banks. Some things there are public by design, so it is worth being precise about which.

• Downloading a bank is recorded against your account, so it appears in your library and so creators can see how many downloads a listing has.
• Publishing a bank makes that content available to other Sentia users, with your display name shown as the creator. Public listings are reviewed by our moderators before they appear.
• Unlisted listings do not appear in the Market and can only be opened by someone who has the share code. Treat a share code as semi-public: anyone you give it to can pass it on. It is a convenience, not a security control.
• Ratings, comments and reports you write are visible to other users alongside your display name. Reports you file are visible to moderators.

Where your data lives, and who touches it

We use a small number of well-known providers, and only for what they are named for here. They act as our processors — they may use your data to provide their service to us, not for their own purposes.

• Supabase — database, authentication, file storage and our server functions. Hosted in the United States (us-east-1).
• Netlify — hosts the Sentia web app.
• Stripe — payments and subscription billing.
• Resend — email delivery.
• PostHog (United States) — product analytics, and only while your analytics switch is on.
• Our AI model provider — receives Ask Sentia prompts, as described above.

International transfers

Sentia's servers are in the United States. If you use Sentia from anywhere else — including the EEA, the UK or Switzerland — your data is transferred to and stored in the US. Where the law requires a transfer mechanism, our providers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) together with their own technical safeguards.

Cookies and what stays on your device

Sentia does not use advertising cookies, tracking pixels, or any cross-site tracking. There is no ad network in the product.

What the app does use is your browser's own storage — localStorage and IndexedDB — to be an app: your signed-in session, your preferences and theme, the sidebar state, your analytics choice, the "you've seen the tour" flags, and, on the web, the question banks and media you have downloaded. The desktop app keeps the equivalent files in its own folder inside your user profile.

Clearing your browser storage signs you out and removes locally cached banks. Anything that syncs to your account comes back when you sign in again.

PostHog sets its own storage entry to recognise a returning session — but only while your analytics switch is on, since the script is not loaded otherwise.

Who we share your data with

We do not sell personal data, and we do not "share" it for cross-context behavioural advertising as California law defines that term. No data brokers. No advertising networks. No selling of study data to publishers or schools.

We share data only with the processors named above, only what they need, and only to run Sentia. Beyond that, we may disclose data if we are legally required to — a valid court order or legal process — or where it is necessary to protect someone's safety or to investigate fraud or abuse. If Sentia is ever sold or merged, account data would transfer with the business, and we would tell you before that happened.

How long we keep things

• Account and profile — for as long as your account exists.
• Study records — for as long as your account exists, or until you clear your history in the app.
• Your own QBank backups and media — until you delete them, or until your account is deleted.
• Published Market listings — until you unpublish them or a moderator removes them.
• Analytics events — 12 months, then deleted or aggregated.
• Billing records — Stripe retains invoices and payment records for as long as tax and accounting law requires, typically several years, independently of your Sentia account.
• Server and sign-in logs — for the short, rolling window our hosting providers keep by default.
• Encrypted database backups — deleted rows can persist in routine backups for up to 30 days before they rotate out.

Your rights over your data

Wherever you live, we will honour the following. If you are in the EEA or the UK these are your rights under the GDPR; if you are in California they are broadly your rights under the CCPA/CPRA.

• Access — ask what we hold about you and get a copy.
• Export / portability — get your data in a machine-readable form. Question banks already export to Sentia's .st file format from inside the app on Pro and Max.
• Correction — fix anything wrong. Profile fields are editable in Settings → Profile.
• Deletion — have your account and its data erased. See the next section.
• Restriction and objection — tell us to stop a particular use, including anything we do on the basis of legitimate interests.
• Withdraw consent — for analytics, the switch described above does it instantly.
• No retaliation — we will never degrade your account or charge you differently because you exercised a right.
• Complain — to your local data protection authority. We would rather you came to us first, at admin@mysentia.app, but it is your right either way.

To exercise any of these, email admin@mysentia.app from the address on your account. We reply within 30 days. We may ask you to confirm it is really you before we act — that protection works in your favour.

Deleting your account

Being straight with you: there is no one-click delete button in the app yet. Until there is, deletion is a manual request that we action by hand.

Email admin@mysentia.app from the address on the account and ask us to delete it. Once we have confirmed it is you, we permanently remove, within 30 days:

• your authentication record, including your email address;
• your profile — display name, university, exam, target date;
• your study records: attempts, scores, history, flags and suspended sessions;
• your private QBank backups and all their media;
• your analytics events;
• your entitlement record, and the cancellation of any active subscription.

What does not disappear, and why

• Stripe keeps invoices and payment records. We are legally required to keep accounting records and cannot delete them on request.
• Question banks you published to the Market: tell us in the same email if you want them taken down and we will unpublish them. Copies already downloaded to other people's devices cannot be recalled — that is what publishing means.
• Ratings and comments you left may remain, detached from your identity, so the discussions they are part of still make sense.
• Deleted rows can survive in encrypted backups for up to 30 days before those backups rotate out. They are not restored into the live service.

Age

Sentia is built for medical students and other adult learners. You must be at least 16 years old to create an account. Sentia is not directed at children, and we do not knowingly collect data from anyone under 16.

If you believe someone under 16 has an account, email admin@mysentia.app and we will delete it and its data.

How we protect it

• Everything travels over HTTPS/TLS, on both the desktop and web apps.
• Sign-in is passwordless. There is no Sentia password to be stolen, reused, or leaked. Sign-in codes are short-lived and single-use.
• The database enforces row-level security: your rows are readable only by your account, checked on the server, not merely hidden by the app.
• Private QBank backups and their media are stored in per-account storage that is not publicly readable.
• Card data never reaches our servers. Neither does your own AI provider key, if you use one.
• Access to production data is limited to the people who need it to run the service.

No system is perfectly secure, and we will not pretend otherwise. If we discover a breach that affects your personal data, we will notify you and the relevant regulator within the timeframes the law requires, and tell you what actually happened.

Changes to this policy

When this policy changes we post the new version here and update the date at the top. If a change materially affects your rights or what we do with your data, we will tell you in the app or by email before it takes effect. Continuing to use Sentia after that means you accept the updated policy.

Contact us

Samuel Bonne
admin@mysentia.app

Data protection questions, access and deletion requests, and complaints all go to the same address. A real person reads it.