Legal
Last updated: September 13, 2026
MedNautica is a longitudinal activity-tracking tool for premed students. This policy describes, specifically and accurately, what personal information the application collects, why, and what you can do about it. It describes the product as it actually works today, not as a template of general promises.
Account information. Your email address and password are collected by Supabase Auth to create and secure your account. Passwords are never stored by MedNautica in plain text; Supabase handles hashing and storage of credentials.
Profile information. First name (required), and optionally last name, university, and expected application year, so the app can greet you and (in a future release) let you filter by cohort. None of this is required beyond first name.
Activity information. Whatever you enter about your own extracurricular activities: titles, organizations, categories, dates, hours, descriptions, responsibilities, accomplishments, and free-text notes. This is the core content of the product and exists because you typed it in.
Skill and CanMEDS role tags. Classifications you personally assign to your own activities from a fixed list; the application does not infer or auto-assign these.
Verifier information. If you choose to record someone who can verify an activity (a supervisor, coordinator, or mentor), you may enter their name, role, organization, relationship to you, email, phone number, and permission status. See the dedicated section below: this is personal information about someone other than you, and you are responsible for having a basis to enter it.
Reminders. Titles, due dates, and optional descriptions you create for yourself. Reminders are in-app only; the application does not send email, push, or SMS notifications.
The application uses one category of cookie: the authentication session cookie set by Supabase Auth, required to keep you signed in and to know which account's data to show you. It is not used for advertising or cross-site tracking. No other cookies or browser local storage are used to store your personal information.
A verifier record is personal information about someone who is not the account holder. MedNautica only asks for what a supervisor or reference relationship reasonably requires: name, role, organization, relationship, and contact details you choose to provide. It is your responsibility to have a reasonable basis to provide another person's contact information, for example, because you have their permission or an existing professional relationship. MedNautica does not contact verifiers on your behalf, does not publish verifier records anywhere public, and does not share verifier information with any third party. Verifier records are visible only to the account that created them and are protected by the same database-level access controls described below.
Application data is durably stored in a Postgres database operated by Supabase, located in the United States (AWS us-east-1). The application itself runs on Cloudflare's network, which processes each request at whichever of its data centres is closest to you, rather than in one fixed location; Cloudflare does not durably store your personal information itself, it runs the application code that reads and writes it to the Supabase database above. Supabase and Cloudflare are the only third parties that process your information, and they do so solely to provide the hosting and database infrastructure the application runs on; neither uses your data for their own purposes.
Access to your data is enforced at the database layer using Postgres Row Level Security: every table that stores your information is configured so that a database query can only return or modify rows belonging to the authenticated user making the request. This is not merely a rule enforced by the application's interface, it is enforced by the database itself, independent of which screen or code path a request comes from.
A small number of operations (permanently deleting an account) require a privileged service key that bypasses these per-user restrictions. That key is never sent to or accessible from any browser; it exists only in server-side code.
No system is perfectly secure, and this policy does not claim otherwise. See the “Changes to this policy” section for how you'll be notified of any material change to these practices.
Your information is retained for as long as your account exists. There is no automatic deletion of inactive accounts at this time. You can delete an individual activity at any time, which removes that activity along with its hour logs, verifier links, skill tags, CanMEDS role tags, and any reminders that reference it (it does not delete a reusable verifier's own record, since that verifier may still be linked to other activities). You can permanently delete your entire account at any time from Settings.
Deleting your account from Settings is a real, permanent deletion, not a deactivation. It removes your authentication record, and every table that stores your data is linked to your account with a cascading delete, so your profile, activities, hour logs, verifiers, skill and CanMEDS role tags, and reminders are all deleted as part of the same operation. This cannot be undone, and the interface asks you to confirm before it happens.
Supabase and Cloudflare may separately retain routine operational logs (for example, server request logs) for a limited period as part of standard infrastructure operation; these are not used by MedNautica to reconstruct a deleted account's activity data.
You can view and edit your profile, activities, verifiers, and reminders directly in the application at any time. The Import/Export page lets you download every recorded activity, including calculated hours, verifiers, and tagged skills, as a CSV file you can keep or move elsewhere.
Creating an account requires agreeing to this Privacy Policy and the Terms of Service. The version you accepted and the date are recorded on your account, so that if these documents change materially in the future, we can identify who accepted an earlier version. You may withdraw your consent to further processing at any time by deleting your account.
CanMEDS is a framework of the Royal College of Physicians and Surgeons of Canada. MedNautica uses the seven CanMEDS role names solely as user-assigned classification labels for your own activities. MedNautica is not affiliated with, endorsed by, or certified by the Royal College of Physicians and Surgeons of Canada.
MedNautica is intended for undergraduate students preparing medical-school applications and is not directed at children under 13. It does not knowingly collect information from children under 13.
If this policy changes in a way that materially affects how your information is collected or used, the “Last updated” date above will change and, where practical, existing account holders will be notified. Continuing to use MedNautica after a material change constitutes acceptance of the updated policy.
If you have a question about this policy, want to access, correct, or delete your information, or have a privacy concern, contact privacy@example.com (placeholder: replace with a real monitored address before launch). There is no dedicated privacy team at this stage; questions are handled personally and promptly.