The USMLE Drill ("we," "us," or "our") operates theusmledrill.com. This Privacy Policy explains what information we collect, how we use it, who processes it on our behalf, and your rights regarding your data. By using our service, you agree to this policy.
Account information. Your name, email address, a hashed password (we never store your password in plain text), an optional phone number, and, if you give it, the exam you are preparing for and its date. For a free sign-up, nothing is stored on our servers until you click the activation link we email you: the form travels encrypted inside that link and the account is created when it is clicked. A link never clicked leaves no record with us. For a paid sign-up, the same details travel encrypted in the Stripe checkout until payment is confirmed and the account is created.
Payment information. We use Stripe to process payments. We do not store your card number, CVV, or full card details on our servers. Stripe handles all payment data under its own privacy policy and PCI-DSS compliance. We store a Stripe customer ID and subscription ID, your plan, its status and renewal date, and the record of any discount code or offer you used.
Study data. Questions answered and how you rated yourself, answers you type before revealing, drill sessions (including ones you suspend to resume later), missed and saved questions, streaks and daily goals, library articles and pictures you open, audio drills you play, and the study plan built from your exam date. This powers your dashboard, Today's Drill, Smart Drill, the readiness meter and your progress emails.
AI interactions. Your messages to the AI tutor and the answers you type for grading (see section 3).
Referral and social data. Who invited whom through a referral link, the friendships made in the app, friend requests and the messages you exchange with friends.
Communications and feedback. If you contact us by email, answer an in-app prompt, review a question, or dispute a grade, we retain those messages to respond and to improve the service.
Technical data. Your IP address, used to limit repeated sign-in, sign-up and email requests and to prevent abuse; browser and device details attached to error reports; and first-party product events (for example that a drill was started or an email was sent), which we use to understand how the service is used. We run no third-party analytics or advertising trackers.
We do not sell, rent, or share your personal information with third parties for their marketing purposes.
Some features are powered by artificial-intelligence models run by Anthropic and OpenAI. To deliver them, we send those providers the text needed for the response and nothing else about you: your message and the question you are studying for the AI tutor; your typed answer, the question and its key for grading; the question text for a generated explanation; and the question text for the spoken audio drills. Your name, email and account are not sent. The providers process this data to return a response to us under their API terms, which do not allow them to use it to train their models.
Library articles and some explanations are drafted with a model from our own material and reviewed before publication; no user data is involved in that.
We use the following services, which may process your data on our behalf:
Pictures in the drills come from Wikimedia Commons and from our own uploads; displaying them sends none of your data anywhere.
We set three cookies, none of them for advertising or tracking:
auth_token — keeps you signed in. HTTP-only, expires after 30 days.auth_alive — a session cookie that ends when you close the browser, so a fresh browser asks for your password again.referral_code — set only when you arrive through a friend's referral link, so the invite still counts if you sign up later. HTTP-only, expires after 30 days.We also use browser local storage for preferences that live on your device: your theme, drill layout and display choices, and onboarding state. No advertising or third-party tracking cookies are used.
Transactional emails are part of running your account and are sent to everyone: the activation link, the welcome email, password resets, receipts, and billing notices such as the reminder the day before a trial converts or billing starts.
Study and marketing emails include reminders before your free days or plan end, progress reports, the day-three follow-up, private offers, and referral news. Every one carries an unsubscribe link; one click turns them all off for your account. Billing notices are not affected by that choice.
When you share your referral link, the person who opens it sees your first name on the sign-up page and in their activation and welcome emails. When they activate, you are told their first name, and the two accounts become friends in the app, so you can message each other. We record which account referred which, when the friend activated, and how each reward was applied, and keep that record to run the program and to stop it being gamed.
You can remove a friend from your friends page at any time. The referral record stays, since the month of Premium it granted was already given.
To request deletion, email us at contact@theusmledrill.com.
All data is transmitted over HTTPS. Passwords are hashed with bcrypt. Sign-up details in transit inside an activation link or a Stripe checkout are encrypted with a key only our servers hold. Payment data is handled exclusively by Stripe. Signed-in sessions are one per account: signing in on a new device signs out the old one. We implement reasonable technical and organizational measures to protect your data against unauthorized access, alteration, or disclosure.
Depending on your location, you may have the right to:
To exercise any of these rights, contact us at contact@theusmledrill.com.
Our service is intended for medical students and healthcare professionals. We do not knowingly collect personal information from anyone under the age of 18.
We may update this Privacy Policy from time to time; the date at the top tells you when it last changed. We will notify you of significant changes by email or by posting a notice in the app. Continued use of the service after changes constitutes acceptance of the updated policy.
If you have any questions about this Privacy Policy, contact us at:
contact@theusmledrill.com