Privacy Policy

Who we are

Bone Wizardry is an independently operated educational service. In this policy, "Bone Wizardry," "the company," "we," "us," and "our" refer to the operator of bonewizardry.com. For privacy questions, contact support@bonewizardry.com.

What we collect

When you create an account

• Your email address. For email sign-in, we send a one-time code, so there is no Bone Wizardry password for us to store.
• If you sign in with Apple or Google, we receive your name when the provider supplies it, email address, and a provider-specific account ID. We do not receive or store your Apple or Google password.
• Account preferences and settings you choose.

If you choose Google or Apple sign-in, the provider authenticates you and sends us your name when supplied, a stable provider-specific subject identifier, and your email address and its verification status. Apple may supply a private relay address instead of your real email. We associate the provider identifier with your Bone Wizardry account UUID; we do not receive your provider password. We request only the information needed for sign-in and linking, do not use provider identity data for advertising, and do not put provider tokens or one-time codes in analytics or application logs. An email match alone does not link accounts: you must verify your existing account with an emailed code. With Apple private relay, you can choose your existing account email and explicitly confirm the link after its code, preserving that account's membership, or explicitly start a separate free provider-only account if the relay address has no prior account or membership history. Accounts, paid access and sign-in methods are not merged. A provider belonging to a different account is refused. You can review and disconnect a linked provider on Account, except when it would leave no sign-in method; you can also request account deletion. Contact support if paid access belongs to another account.

Account offers an optional, source-email-code-verified study-progress transfer covering supported ClueCards and Miss Deck records and review events, QBank saved tests and history, and QBank preferences, study-plan and pathway-progress documents. Derived game-sync and attempt-shadow state remains with the destination account rather than becoming merged authority. A preview lists record counts, proposed document changes and any blocking conflicts before consent; conflicts require support and cannot be bypassed. A completed transfer can be reversed for 30 days unless its records have since changed. It does not transfer other study records, billing, paid access, or sign-in methods. Review your account and available controls.

When you subscribe or buy a service

• Payment information is collected and processed by our payment processor, not by Bone Wizardry. We never see or store your full card number, security code (CVC), or bank details.
• We receive from the payment processor: subscription or purchase status, billing email, the last four digits of your card, transaction history, and any partner promo or referral code attached to the purchase.

When you use the site

• Your learning activity, including lessons viewed, questions and answers, correctness, confidence or reasoning responses, review history, decks, quizzes, and interactive-tool progress. We use this to save your place and power daily review, Miss Deck, Reasoning Footprint, progress tracking, and personalized study suggestions.
• Operational usage data: the limited page counting and study-tool events described in "How we measure site use." We use them to operate, secure, debug, and improve the service. We do not use your question answers or whether they are correct for learning research. Learning research, if offered, will be a separate optional choice (see "Learning research (optional)").
• Standard server and edge logs: IP address, browser type, pages visited, and timestamps. These are used for security, fraud prevention, and debugging, and are not used to build advertising profiles.

When you submit reviews or other content

• If you submit a review, rating, comment, correction, or topic request, we collect the content you provide and associate it with your account. Reviews you choose to post may be displayed publicly on the site. Do not include sensitive personal or patient information in anything you submit.
• For testimonials, we may also collect your name, contact email, chosen public-name preference, training context, and optional private verification details. Contact email, account email, and private verification details are used for review and verification and are not published; the public name follows the display preference you select.

When you email us

• The contents of your message and your email address, so we can reply.
• Corrections and topic requests you submit may be used to improve site content. We do not publish your email address.

How we use what we collect

• To run your account and deliver Elite subscriptions and paid services, including personal statement review, mock interviews, interview packages, written study plans, mentorship, and tutoring.
• To send you one-time sign-in codes and account notices.
• To process payments through our payment processor.
• To save your study progress so the site remembers where you left off.
• To provide daily review, Miss Deck, Reasoning Footprint, progress tracking, and other personalized study suggestions based on your activity across Bone Wizardry, including lessons, practice questions, ClueCards, and Prescryption. This is part of how the service works. It only shapes what we suggest you study and has no legal or similarly significant effect on you.
• To analyze usage so we can improve content, features, and reliability.
• To display reviews and other content you choose to submit.
• To respond when you email us.
• To detect abuse, prevent fraud, debug errors, and keep the site running.
• To comply with legal obligations when required.

Learning research (optional)

We plan to evaluate how adult medical-board learners use study methods and features, to improve the service. No study is running, and we do not use your study activity for learning research today. If research is offered, it will be prospective only: it will use only study activity from after you opt in, never earlier activity or imported history unless we ask separately and you agree.

Optional learning research is separate from operating your account, saving your progress, securing and debugging the service, and the limited site-use measurement described below. Personalizing your study path is part of the service and doesn't depend on this choice. Participation will be offered with its own consent choice before any study begins, and each study will first receive a written determination from an independent research-ethics board and a public description. Refusing will not change your price, features, account, or access. Accepting the Terms or continuing to use Bone Wizardry does not enroll you in optional learning research and does not create or expand research consent.

We do not sell your personal data

• We do not sell, rent, or trade your personal information to data brokers, advertisers, or anyone else for money or other valuable consideration.
• We do not share your personal information for cross-context behavioral advertising.
• We do not use advertising trackers or cross-site tracking pixels.
• Your study data, such as your progress, answers, and personalization, stays within Bone Wizardry and the service providers that run it for us, listed below. We use it to run and improve your Bone Wizardry experience, and we disclose it otherwise only as described in this policy, for example where the law requires.

Service providers we share data with

We share data only with the service providers needed to run the site. These providers process data on our behalf under their own privacy terms and are not permitted to use it for their own marketing:

• Stripe payments: Stripe handles Elite subscriptions, purchases of tutoring and other services, partner promo codes, fraud prevention, and billing. Card details are entered with and stored by that processor, not by Bone Wizardry.
• Hosting, storage, and edge delivery: our hosting and content-delivery provider runs the infrastructure that serves the site to you, stores account and study data, and helps protect the site from abuse.
• Email delivery: our transactional email provider delivers sign-in codes, receipts, account notices, and support replies.
• Business email: our business email provider (Google Workspace) hosts the Bone Wizardry mailboxes that receive your emails to us. Our transactional email provider also forwards form submissions you send us to those mailboxes, such as Board Recovery and mentorship intake details, tutoring requests, corrections, and question comments, so that we can respond.

We may also disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of the company, our users, or others.

Educators and paid services

For personal statement review, interview coaching, written study plans, mentorship, or tutoring, we collect the intake, drafts, goals, scheduling details, and communications you provide. We share only the information needed with the educator assigned to deliver the service.

Tutoring sessions are delivered by independent physician contractors engaged by the company. To schedule and run a session, the company may share the limited information needed to coordinate it, such as your name, email, and the topics you want to cover. Educators are required to keep this information confidential and to use it only to provide the session you booked. These services are educational only and do not create any clinical or treatment relationship.

Physician educators may receive payouts through Stripe Connect. Stripe collects their name, contact details, date of birth, identity-verification information, tax information, and bank or debit-card payout details. Bone Wizardry receives connected-account status, payout and transaction records, and limited identity or tax status information, but does not receive full bank account or card numbers.

Third-party links and image sources

Some lessons include image credits, source manifests, citations, or links to third-party sites such as Creative Commons or Wikimedia Commons, public chemistry or government databases, journals, or other educational sources. Many lesson images are served by Bone Wizardry from local copies, but about one hundred lessons load some images directly from their original hosts, including Wikimedia Commons, Flickr, Pixabay, the U.S. Centers for Disease Control and Prevention (CDC), the Wellcome Collection, and Adobe Stock (ftcdn.net). When you open one of those lessons, your browser requests the image from that host. If you click an external source, credit, license, or citation link, you leave Bone Wizardry and the destination site's privacy practices apply.

Many pages also load typefaces from Google Fonts, and a few lessons request image summaries from Wikipedia. Each of these requests, like the image requests above, gives that service standard request information, such as your IP address, browser type, and the Bone Wizardry site address. It does not include your account details, study activity, or sign-in codes. These services handle requests under their own privacy terms. The downloadable OMM media deck is delivered from a third-party file host (catbox.moe), which receives the same standard request information.

We do not control third-party websites and are not responsible for their privacy practices, content, or security. We do not send your Bone Wizardry sign-in codes or payment information to image source sites.

Email updates

We may offer optional email updates about new content and site changes. These are always opt-in. We will never add you to a marketing list without your explicit consent, and every update email includes a one-click unsubscribe link. If you unsubscribe, we remove your address from the marketing list within 48 hours and will not email you again unless you re-subscribe. Transactional emails (sign-in codes, receipts, and account notices) are separate and not affected by your marketing preferences.

How we measure site use

This operational site measurement, including the study-tool events and link counts described below, is not learning research. Page-view records do not include an account ID, research code, question answer, or correctness result. Study-tool events and link counts do not include an account ID or research code. Bone Wizardry does not combine any of these records with participant-level research data, and any future learning-research choice will be separate from this measurement.

We measure site use ourselves, on our own servers. We do not use a third-party analytics service or third-party tracking scripts. Page counting happens on our servers, so it does not depend on JavaScript and adds nothing to the pages you load.

For each page view, we record:

• The date, with the day only, not the time.
• The page address without its query string, except for the campaign tags utm_source, utm_medium and utm_campaign.
• The kind of page, such as a lesson, lesson preview, subject hub or pricing page.
• The domain name of the referring site, not the full referring address.
• A broad device type: phone, tablet or desktop.
• Whether the visitor was signed out, signed in without a membership, or a member.

An anonymous daily visitor code lets us count unique visitors per day. We compute it from your IP address and your browser's user-agent string, combined with a random secret. The secret changes every day and is deleted after about two days. We do not store IP addresses for this measurement. The code cannot be linked across days or to an account.

These page-view records contain no names, email addresses, account identifiers, IP addresses or full referring addresses. Automated traffic, such as search-engine crawlers, is not counted.

On lesson previews, we record when the membership prompt is shown and when someone follows it to the membership page. We also count first sign-ins to new accounts. These records carry no account identifier.

Study-tool events. Some study tools and sign-up pages use a small first-party script to record events such as starting or finishing sign-in, starting a practice session, answering a free practice question, finishing a lesson or session, or reaching a sign-up or membership page. Depending on the event, it can include the question identifier and number, whether the answer was correct, and a completed session's score and question count. These events carry a random identifier stored in your browser, a random identifier for the browsing session, the page, campaign tags, and the referring domain. They do not include your name, email address, or account identifier. If you start a membership checkout, the browser and session identifiers are sent with the checkout so we can learn which study steps lead to memberships, and they are kept with the purchase record.

To turn study-tool events off in your browser, open bonewizardry.com/?bw_analytics=off; this stores an opt-out on your device. If you use that opt-out, or your browser sends Do Not Track or Global Privacy Control (GPC), the script sends no study-tool events, creates no browser or session identifier, erases any it stored earlier, and attaches nothing to a checkout. A few pages also count clicks on specific links, recording the link, the page, the referring address, and the browser type. These link counts carry no identifier and are recorded whether or not your browser sends Do Not Track or GPC.

We honor Do Not Track and GPC. If your browser sends either signal, we also do not compute the daily visitor code or set the attribution cookie described below. The page view is still counted without them.

Cookies and session storage

We use cookies and similar storage to keep you signed in and make the site work. We also use limited storage for the usage analytics described above. We do not use advertising cookies or cross-site tracking. We honor Global Privacy Control (GPC) and Do Not Track as described above.

• Attribution cookie: bw_attr is a first-party analytics cookie set by our server on your first visit. It is not set if your browser sends Do Not Track or Global Privacy Control.
• It holds the first page you visited, the campaign tags and referring domain from that visit, and the date of that visit. It also holds the last lesson preview whose membership link you followed.
• It expires 30 days after your first visit. It is not used for advertising or shared with advertisers.
• If you start a membership checkout, these values are sent with the checkout to our payment processor, Stripe, and kept with the purchase record. This helps us learn which pages lead to memberships.
• Study-tool identifiers: the study-tool events script keeps a random browser identifier (bw_funnel_anon_v1) and a note of your first visit's page, campaign tags, and referring domain (bw_funnel_touch_v1) in local storage. In session storage it keeps a random browsing-session identifier (bw_funnel_session_v1), a list of the practice questions answered in that browsing session (bw_funnel_questions_v1), and short-lived markers that stop the same event being counted twice. If you opt out, it stores bw_funnel_excluded_v1. None of these identifiers or first-visit notes is created if you opt out or your browser sends Do Not Track or GPC, and any stored earlier are erased. You can also remove them at any time by clearing this site's data in your browser.

How long we keep your data

• Active accounts: as long as your account exists.
• After account deletion: deleting your account from your account page takes effect immediately and removes the data listed under "Your rights." For a request by email, we delete your personal data within 30 days of receiving it. In both cases we keep payment records, with your email address removed from our membership and tutoring payment records, and a minimal record of the deleted address so that it cannot be used to sign in again. The account-page button does not remove testimonials you submitted, free question bank or Question of the Day sign-up records, the email address on a purchase made through a partner's referral link, or emails and form submissions you sent us. Email support@bonewizardry.com and we will delete those within 30 days, except where we must keep them. Our payment processor keeps its own records of your payments, including your email address. Site-use records that contain no email address or account identifier are deleted on the schedule below. We also keep records where retention is required by law (for example, payment and tax records that our payment processor and tax authorities require us to keep, and auto-renewal consent records retained for at least three years where required by law).
• Server and edge logs: 90 days.
• Individual page-view records: Raw page-view records are deleted automatically once they are more than 13 months old; the cleanup runs as part of normal daily site activity.
• Study-tool events and link counts: deleted automatically once they are more than 13 months old. Our record of a completed purchase is kept, but its browser and session identifiers are removed after 13 months. Browser and session identifiers sent with a checkout also stay in our payment processor's records of that purchase.
• Daily site-use totals: totals that contain no visitor code may be kept longer.
• Support emails: up to 2 years, then deleted.

Your rights

Regardless of where you live, you can:

• Request a copy of the personal data we have about you.
• Correct inaccurate data.
• Delete your account and the study data tied to it from your account page: choose "Delete my account," type DELETE to confirm, and select "Delete account permanently." This deletes your study progress, preferences, comments, scores, highlights, leaderboard entries, and email-list membership, and signs you out everywhere. If you subscribed on the website, your subscription is set to stop renewing; this does not refund past payments. Subscriptions bought in the iOS app are billed by Apple and must be cancelled in your iPhone Settings. Our membership and tutoring payment records are kept with your email address removed, and the deleted email address cannot be used to sign in again. Some records are not removed by the button; see "How long we keep your data." To have those deleted too, or if you need help, email support@bonewizardry.com with "Account Deletion Request" in the subject line; we process email requests within 30 days.
• Export your study progress data.

To exercise any of these rights, other than deleting your account from your account page, email support@bonewizardry.com. We will respond within 30 days. We will not discriminate against you for exercising these rights.

California residents (CCPA and CPRA)

If you live in California, you have specific rights under the California Consumer Privacy Act, as amended:

• Right to know what personal information we collect and how we use it (see above).
• Right to delete personal information.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell or share your personal information for advertising, so there is nothing to opt out of, but you have this right under California law.
• Right to limit the use of sensitive personal information. We do not use sensitive personal information beyond what is necessary to deliver the service.
• Right to non-discrimination for exercising these rights.

To exercise these rights, email support@bonewizardry.com with "California Privacy Request" in the subject line. You may designate an authorized agent to make a request on your behalf.

EU and UK residents (GDPR)

If you live in the EU or UK, the legal bases we rely on are:

• Contract performance: to deliver the service you signed up for, including saving your progress and personalizing your study path automatically.
• Legitimate interests: site security, analytics, debugging, and fraud prevention.
• Consent: for optional marketing emails, which you can withdraw at any time. If we offer optional learning research, we will ask for it separately, with its own consent choice that you can withdraw. Operational account processing, personalization, security, debugging, and the limited site-use measurement rely on the bases above and do not depend on any research choice.
• Legal obligation: tax records and breach notifications.

You have the rights listed above plus the right to lodge a complaint with your local data protection authority. International transfers of EU and UK data to the United States rely on appropriate safeguards, including Standard Contractual Clauses where required.

Children

Bone Wizardry is intended for adult learners and is not directed to children. The service is not directed to anyone under 16, and we do not knowingly collect personal information from anyone under 16. Our Terms require account holders to be at least 18. If you believe a child under 16 has provided personal information, email us and we will delete it.

Security

We use industry-standard security measures including encrypted connections (HTTPS), passwordless one-time-code sign-in, and access controls. No system is perfectly secure. If we discover a breach affecting your personal data, we will notify affected users without unreasonable delay and in accordance with applicable data breach notification laws.

International transfers

The site is hosted in the United States. If you access it from outside the US, your data is transferred to and processed in the US, which may have different data-protection laws than your country of residence.

Changes to this policy

We may update this policy and will post the new effective date at the top. Where required, we will give advance notice of a material change, and we will notify active subscribers of material changes by email. Accepting the Terms or continuing to use Bone Wizardry does not enroll you in optional learning research and does not create or expand research consent. Any learning research will require your separate, active consent. We may correct non-material wording without notice.

Contact

Privacy questions and rights requests: support@bonewizardry.com. General support: support@bonewizardry.com. Postal contact: the operator of bonewizardry.com, P.O. Box 7514, Wilmington, DE 19803, United States.