Skip to main content
NBMEcalc
Legal

Privacy Policy

Plain-language explanation of what we collect, why, and how to control it.

Last updated: August 10, 2026

1. Who we are

nbmecalc.com ("NBMEcalc", "we", "us", "our") operates a USMLE Step score predictor at https://nbmecalc.com. This Privacy Policy explains what we collect, why, and how to exercise your rights.

For privacy questions or to exercise rights described below, email privacy@nbmecalc.com.

2. Information we collect

2.1 Information you provide

  • Email address — when you create an account, sign in, buy a report, or contact support.
  • Practice exam scores — NBME, UWSA, Free 120, and AMBOSS scores you enter into the predictor.
  • Payment information — handled by Stripe. We never see or store your full card number.

2.2 Information collected automatically

  • Usage data — pages visited, predictions run, features used (via Cloudflare Web Analytics and our first-party product event log).
  • Device data — browser type, OS, screen size, country (city-level only), referrer.
  • Cookies — see Section 7.

3. How we use your data

  • To run the score predictor and return your results.
  • To send prediction PDFs, account confirmations, security messages, and service-related support.
  • To improve the algorithm — only aggregated, anonymized data.
  • To prevent abuse and rate-limit requests.
  • To comply with legal obligations.

We never sell, rent, or trade your personal data. We never share predictor inputs with third parties for advertising.

4. Legal bases (GDPR)

  • Contract — to deliver the service you signed up for.
  • Legitimate interest — basic usage analytics, fraud prevention.
  • Consent — optional outcome feedback and advertising cookies where consent is required. You can withdraw consent through the applicable control.
  • Legal obligation — tax records, lawful requests.

5. Data sharing

We share data only with these processors, under data-processing agreements:

  • Cloudflare — hosting, CDN, security, edge database (D1), and file storage (R2). Processing locations depend on the configured Cloudflare services and applicable provider terms.
  • Stripe — payment processing.
  • Postal — transactional email delivery.
  • Cloudflare Web Analytics — aggregate traffic and performance analytics.
  • Google AdSense — advertising on eligible public pages. Google and its advertising partners may use cookies, IP addresses, or similar identifiers to serve, measure, and prevent fraud in ads. We do not send your practice-exam inputs to Google as advertising targeting parameters.

We may also disclose data when required by law or to protect rights, property, or safety.

6. Data retention

  • Active account data — kept until you delete your account.
  • Account predictions — kept until you delete them or your account. Anonymous calculation snapshots and first-party funnel events are retained for up to 12 months, then deleted or aggregated.
  • Payment records — 7 years (tax law).
  • Magic Link tokens — auto-deleted 1 hour after issue.
  • Analytics events — 12 months, then aggregated.

7. Cookies

We use a minimal cookie set:

  • Session cookie (nb_session) — keeps you logged in. Expires after 30 days. Strictly necessary.
  • Disclaimer acknowledgment (nbmecalc_disclaimer_ack) — remembers for 30 days that you dismissed the educational-use notice. Stored locally in your browser.
  • Analytics — Cloudflare Web Analytics is designed to operate without cross-site tracking cookies. First-party funnel events are stored server-side according to the retention period above.
  • Advertising — Google and third-party advertising vendors may place or read cookies and use web beacons or IP addresses when ads are enabled. Where required, advertising loads only under the choices collected by a Google-certified consent management platform. You can manage personalized advertising in your consent choices or through Google Ads Settings.

You can control cookies through your browser settings and, where displayed, the advertising consent controls.

8. Your rights

You have the right to:

  • Access a copy of your data — request it from privacy@nbmecalc.com.
  • Rectify inaccurate account data — contact us if a field cannot be corrected through the available account controls.
  • Erase your account data — use Settings → Delete account or contact us. Records that must be retained for fraud, tax, or legal purposes follow their stated retention periods.
  • Restrict / object to processing — email privacy@nbmecalc.com.
  • Data portability — request a machine-readable copy of applicable account data by email. A self-service export is not currently available.
  • Lodge a complaint with your local supervisory authority (e.g. ICO in the UK, CNIL in France).

EU residents: this includes all GDPR rights. California residents: this includes CCPA rights.

9. International transfers

Our service providers may process data in multiple countries. Where cross-border safeguards are required, we rely on the provider's applicable data-protection terms and transfer mechanisms. Contact us for the current processor information relevant to your request.

10. Children

The service is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has signed up, email us and we will delete the account.

11. Security

  • HTTPS is used for the public service.
  • Hosting and database safeguards are provided through Cloudflare.
  • Magic Link tokens are single-use, expire in 1 hour.
  • No card data stored on our servers — Stripe handles all payments.
  • Access controls and rate limits protect account and prediction routes.

12. Changes to this policy

We will post material changes on this page and provide additional notice where required. The "Last updated" date above identifies the current published version.

13. Contact

Questions? privacy@nbmecalc.com or our contact page.