Privacy Policy

We collect these groups of data:

• Account data: email address, name, avatar, password hash, sign-in provider, province, board, target exam, target programme, target university, Matric percentage and Inter percentage.
• Study data: answers, scores, time on a question, mock results, flashcard reviews, syllabus ticks, study-plan blocks, weak topics, notes and bookmarks.
• SAGE data: the messages you send, the study context SAGE uses, the conversation history and the facts SAGE remembers when you leave memory on.
• Forum data: posts, replies, reports and votes in the moderated forum.
• Payment data: the plan you bought, the amount, the payment method, the receipt image and the approval status. We do not store card numbers.
• Technical data: IP address, browser, device type, screen size, pages visited, error logs and rate-limit counters.
• Consent data: your cookie choice, stored in your browser.

• Create and secure your account.
• Grade your answers and show the explanation.
• Build your study plan and flashcard schedule.
• Give SAGE the context it needs to answer you.
• Show your progress, weak topics and predicted band.
• Verify a payment and grant the pass you bought.
• Answer a support request and review a refund.
• Stop abuse, scraping and account sharing.
• Measure which pages work, only after you accept optional cookies.
• Meet a legal or tax duty.

We use most data to perform our contract with you: the account, the practice bank, the plan, SAGE and the pass.

We use security logs and rate limits for our legitimate interest in keeping the service safe. We use optional analytics and error replays only with your consent. We keep payment records when the law requires it.

SAGE sends your prompt and the study context needed to answer it to an AI model provider. The current providers are Google (Gemini) and River (DeepSeek). The provider processes the request and returns an answer. We store the conversation so you can continue it.

Do not send sensitive personal data, passwords, another person's private information or a medical record to SAGE. SAGE does not provide medical or clinical advice.

You can turn memory off in Settings. You can delete a remembered fact. You can delete the whole conversation.

We use these providers to run the service:

• Supabase: database, authentication, file storage and backups.
• Vercel: application hosting and server logs.
• Cloudflare: DNS, TLS, bot protection and edge rate limits.
• Upstash: rate-limit counters and short-lived cache entries.
• Resend: transactional email such as sign-in links and receipts.
• Google: Gemini for SAGE answers and YouTube for Study Zone videos.
• River: the DeepSeek model that serves routine SAGE turns.
• PostHog: product analytics after you accept optional cookies.
• Sentry: error reports. With consent, a short replay on error and performance timings.
• Payment providers: the bank or wallet that receives your payment and any card provider that is enabled at checkout.

We do not sell your personal data. We share it with a provider only to run the service, or when the law requires it.

Supabase stores the database in the ap-southeast-1 region in Singapore. Some providers process data in the United States. These include Vercel, PostHog, Sentry, Google and River.

We choose providers that apply contractual and technical safeguards. A transfer to another country can have a different level of legal protection from your country.

• Account data stays until you delete the account.
• Study data stays until you delete the account or the item.
• SAGE history stays until you delete it or delete the account.
• Payment and tax records stay for the period the law requires.
• Error reports and performance traces stay for 30 days.
• Optional analytics stays for the period stated in the Cookie Policy.
• A backup can keep a deleted item for a short period before it rotates out.

You can ask us to do these things:

• show you the personal data we hold about you
• export your data from Settings, then Your data
• correct a profile field in Settings
• delete your account in Settings, then Delete account
• withdraw cookie consent by clearing the site data
• object to a use that relies on our legitimate interest
• complain to the authority that applies in your country

We reply within 30 days. We can ask you to prove that the account is yours before we act. A legal duty can limit a request, for example a tax record we must keep.

Supabase encrypts data in transit and at rest. We use row-level security on the database, role checks on admin routes, rate limits on public endpoints and signed sessions. We keep the service role key on the server only.

No system is perfect. If you find a security problem, email support@mymdcat.comand do not publish it first. We investigate every report.

mymdcat is for users aged 13 and older. If you are under 13, do not create an account. If we learn that an account belongs to a child under 13, we delete the account and its data.

We use necessary cookies to keep you signed in and to remember your theme. We use optional cookies only after you accept them. The Cookie Policy lists each category and how to change your choice.

We can update this policy. The date at the top shows the current version. If a change is material, we tell account holders by email or in the app. The new version applies from the date we publish it.