Skip to main content
NBMEcalc
Legal

Privacy Policy

Plain-language explanation of what we collect, why, and how to control it.

Last updated: November 1, 2026

1. Who we are

nbmecalc.com ("NBMEcalc", "we", "us", "our") operates a USMLE Step score predictor at https://nbmecalc.com. This Privacy Policy explains what we collect, why, and how to exercise your rights.

For privacy questions or to exercise rights described below, email privacy@nbmecalc.com.

2. Information we collect

2.1 Information you provide

  • Email address — when you create an account, sign in, buy a report, or contact support.
  • Practice exam scores — NBME, UWSA, Free 120, and AMBOSS scores you enter into the predictor.
  • Optional outcome feedback — if you opt in to a score-release reminder, we store your reminder email, exam date, the practice input you saved (for example, an NBME form number and percent correct), and the real result you choose to report. These pairs are used only in aggregate to evaluate and recalibrate our estimates; individual records are never published.
  • Optional CCMSA research submissions — if you use the "Share your CCMSA score for research" form on the Step 3 predictor page and check the consent box, we store your CCMSA form number, your Assessment Score (10-800), and, if you add them, your Step 3 exam date and email address, along with the time of your consent, your IP address, and browser user agent for abuse prevention. With an email and exam date, we send one reminder after Step 3 scores are usually released asking for your real Step 3 result, and we store the result you choose to report. We use these pairs only in aggregate to study whether CCMSA results relate to Step 3 scores. We do not publish individual records, do not use your email for marketing, and do not offer a CCMSA-to-Step 3 conversion based on this data unless enough paired results exist to measure its error.
  • Payment information — handled by Stripe. We never see or store your full card number.

2.2 Information collected automatically

  • Usage data — pages visited, predictions run, features used (via Cloudflare Web Analytics and our first-party product event log).
  • Device data — browser type, OS, screen size, country (city-level only), referrer.
  • Cookies — see Section 7.

3. How we use your data

  • To run the score predictor and return your results.
  • To send prediction PDFs, account confirmations, security messages, and service-related support.
  • To improve the algorithm — only aggregated, anonymized data.
  • To study, in aggregate, how optional CCMSA research submissions compare with the real Step 3 results that participants report.
  • To prevent abuse and rate-limit requests.
  • To comply with legal obligations.

We never sell, rent, or trade your personal data. We never share predictor inputs with third parties for advertising.

4. Legal bases (GDPR)

  • Contract — to deliver the service you signed up for.
  • Legitimate interest — basic usage analytics, fraud prevention.
  • Consent — optional outcome feedback, optional CCMSA research submissions, and advertising cookies where consent is required. You can withdraw consent through the applicable control.
  • Legal obligation — tax records, lawful requests.

5. Data sharing

We share data only with these processors, under data-processing agreements:

  • Cloudflare — hosting, CDN, security, edge database (D1), and file storage (R2). Processing locations depend on the configured Cloudflare services and applicable provider terms.
  • Stripe — payment processing.
  • Resend — transactional email delivery.
  • Cloudflare Web Analytics — aggregate traffic and performance analytics.
  • Google AdSense — advertising on eligible public pages. Google and its advertising partners may use cookies, IP addresses, or similar identifiers to serve, measure, and prevent fraud in ads. We do not send your practice-exam inputs to Google as advertising targeting parameters.

We may also disclose data when required by law or to protect rights, property, or safety.

6. Data retention

  • Active account data — kept until you delete your account.
  • Account predictions — kept until you delete them or your account. Anonymous calculation snapshots and first-party funnel events are retained for up to 12 months, then deleted or aggregated.
  • CCMSA research submissions — kept for up to 36 months after submission, then deleted or reduced to aggregate statistics with the email removed. You can ask us to delete your submission at any time by emailing privacy@nbmecalc.com from the address you used, or by replying to the reminder email.
  • Payment records — 7 years (tax law).
  • Magic Link tokens — auto-deleted 1 hour after issue.
  • Analytics events — 12 months, then aggregated.

7. Cookies

We use a minimal cookie set:

  • Session cookie (nb_session) — keeps you logged in. Expires after 30 days. Strictly necessary.
  • Ad-free preference (nb_adfree) — set only for signed-in Lifetime members so pages skip ad requests. It contains no personal data, is cleared when you sign out, and expires after 30 days.
  • Analytics — Cloudflare Web Analytics is designed to operate without cross-site tracking cookies. First-party funnel events are stored server-side according to the retention period above.
  • Advertising — Google and third-party advertising vendors may place or read cookies and use web beacons or IP addresses when ads are enabled. Where required, advertising loads only under the choices collected by a Google-certified consent management platform. You can manage personalized advertising in your consent choices or through Google Ads Settings.

You can control cookies through your browser settings and, where displayed, the advertising consent controls.

8. Your rights

You have the right to:

  • Access a copy of your data — request it from privacy@nbmecalc.com.
  • Rectify inaccurate account data — contact us if a field cannot be corrected through the available account controls.
  • Erase your account data — use Settings → Delete account or contact us. Records that must be retained for fraud, tax, or legal purposes follow their stated retention periods.
  • Restrict / object to processing — email privacy@nbmecalc.com.
  • Data portability — request a machine-readable copy of applicable account data by email. A self-service export is not currently available.
  • Lodge a complaint with your local supervisory authority (e.g. ICO in the UK, CNIL in France).

EU residents: this includes all GDPR rights. California residents: this includes CCPA rights.

9. International transfers

Our service providers may process data in multiple countries. Where cross-border safeguards are required, we rely on the provider's applicable data-protection terms and transfer mechanisms. Contact us for the current processor information relevant to your request.

10. Children

The service is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has signed up, email us and we will delete the account.

11. Security

  • HTTPS is used for the public service.
  • Hosting and database safeguards are provided through Cloudflare.
  • Magic Link tokens are single-use, expire in 1 hour.
  • No card data stored on our servers — Stripe handles all payments.
  • Access controls and rate limits protect account and prediction routes.

12. Changes to this policy

We will post material changes on this page and provide additional notice where required. The "Last updated" date above identifies the current published version.

13. Contact

Questions? privacy@nbmecalc.com or our contact page.