ABA Clarity — Privacy Policy

Effective October 28, 2026 · Version 2026-10-28-age16-v1

This policy describes the free browser edition and account-enabled ABA Clarity service operated by ABA CLARITY LLC. Features described below collect information only when enabled and used. Contact the operator about privacy at abaclarity@gmail.com.

1. Information we handle

Account information: display name, email, authentication information, certification path, acceptance of policy versions, account status, and profile preferences. Optional fields may include an avatar choice, exam date, time zone, study goals, and preferred domains. Avoid entering sensitive information in free-text fields. Supabase handles passwords and verification; app administrators are not provided a password-viewing feature.

Study activity: answers and revisions, confidence ratings, question and objective identifiers, reasoning selections, attempts, performance patterns, levels, streaks, bookmarks, scheduled review, achievements, and study history. These records help organize your learning; they are not a clinical assessment.

Group sessions: room membership and hosting, submitted responses, scores, session rankings, awards, explanations where supported, and group or personal recaps.

Security and technical information: session identifiers, authentication and security events, timestamps, audit records, and technical request information processed by our hosting providers, which may include IP addresses and browser or device information. Support email includes the address and information you send us. Do not email passwords, payment-card details, or patient records.

Purchases: we retain account-linked access status, billing platform, product and transaction references, renewal or expiration dates, and verification information. Apple handles payments made through the iOS app. Stripe handles website checkout. Clarity verifies purchase and access information; it does not receive your full card number from these purchase flows.

2. Local study and accounts

Guest study stores progress on your device or in your browser, depending on the app you use. Clearing site data, changing browsers, or losing the device can remove access to that local history. Local study does not automatically provide cloud backup. Hosting providers still process technical requests needed to deliver the website.

When account synchronization is enabled and you sign in, applicable study records are associated with your account and stored on our server. If you choose to import existing anonymous progress, that progress becomes associated with your account. A local export or downloaded file is under your control; protect it if it contains information you consider private.

3. Why we use information

We use information to authenticate you, maintain your profile, save and restore progress, recommend practice, schedule review within the app, operate rooms, verify access, answer support requests, investigate errors or abuse, and meet applicable legal obligations. Limited aggregate activity counts help us understand service usage. Saved notification preferences do not mean reminder delivery is currently enabled.

We do not sell personal information or share it for cross-context behavioral advertising. The current app does not include advertising trackers or a third-party behavioral analytics SDK. We do not use your private answers to train a general-purpose AI model. A future material change to these practices requires updated notice and any consent required by law.

4. Who can see information

Your private account and individual study records are not a public profile. Authorized administrators may access information for legitimate support, security, moderation, or operational purposes. Sensitive administrative actions are recorded in audit logs.

In a room, the host and participants may see your display name, app level, session points, streak, placement, awards, and contributions intentionally shared with the room. Group answer distributions and accuracy summaries may also be shown. Participant leaderboards do not identify which incorrect option a named learner selected. The server retains underlying responses needed for scoring and recaps; the leaderboard rule does not mean those responses are never stored or available to authorized operational support. Session history may remain after the room ends. Room codes should be shared only with intended participants.

We use service providers to operate the app: Supabase for account authentication and the database, Render for the account-enabled website and server, and OpenAI Sites for the standalone free website. Email you send to the support address is processed through Gmail. Account-verification, password-reset, and account-security emails are processed through Supabase and Resend. Resend processes recipient email addresses, message contents, and delivery information to send these transactional messages. Stripe processes checkout, billing contact and payment information, fraud-prevention data, invoices and subscription activity for website purchases. Clarity receives subscription status and payment references, not your full card number. Apple processes in-app payments and provides transaction information used to verify access and restores. Existing purchases managed through RevenueCat may involve RevenueCat processing account-linked purchase identifiers and entitlement status. Feedback and question challenges sent through the app are delivered through Resend to the operator’s Gmail support inbox; question challenges are also recorded for editorial review. Providers may process information through their infrastructure and subprocessors under applicable agreements.

We may disclose information when reasonably necessary to comply with law, respond to valid legal process, protect people or the service, or investigate misuse. If the service changes ownership, personal information may transfer subject to applicable law and appropriate notice and safeguards.

Room-safety reports include the room and reported participant, the displayed name, the report reason, and any details you submit. We store block relationships and moderation decisions to enforce room safety. Reports and their details are available to authorized moderators, not other room participants; submitting a report does not send your private study answers to the reported person. Room-safety reports are handled in the private moderation queue rather than automatically emailed.

5. Cookies, storage, and security

The account-enabled web app uses necessary sign-in cookies. Browser storage saves local study data and preferences. These technologies support service functions rather than advertising. Blocking cookies can prevent sign-in; clearing browser storage can remove local progress. Sign out on shared devices.

The account system uses HTTPS in production, restricted server access, authorization checks, and protected session storage. No system is completely secure. Contact support promptly if you suspect unauthorized access. Do not send credentials in an email report.

6. Retention and account deletion

You can request permanent deletion from your account controls in ABA Clarity. We require recent authentication and explicit confirmation to protect your account. Your request applies to the shared Clarity account on the website and iOS app. We complete account and study-data deletion within 30 calendar days of accepting a verified request and email you when processing is complete. A request acknowledgment is not a completion notice. Contact abaclarity@gmail.com with your request reference for help or a status update.

We remove your private account and study records and revoke access to the account. In shared rooms, we remove answers and explanation text associated with you. If you hosted a room, explanations you entered about participants are also removed and the room ends. Other learners’ unrelated work and the room’s basic structure may remain, with an inactive, unlinked “Deleted learner” placeholder. These removals can change historical room summaries.

Resolved room-safety reports, earlier details and associated moderation history become eligible for automatic removal once their most recent resolution or update is more than 90 days old. Cleanup runs hourly in bounded batches. Open or reopened reports remain until resolved. Records concerning a person with an active room restriction are held until that restriction is lifted, after which older resolved records become eligible for cleanup. Active block relationships remain until unblocked or the related account is deleted; active restrictions remain until lifted or the account is deleted. Related room deletion can remove reports earlier. Operational cleanup logs contain counts and timestamps, not report details, and are removed after 90 days.

When an account is deleted, we remove its block relationships and room restrictions. Reports made by or about that account, their earlier details, and linked moderation decisions are removed with the account. Deleting a moderator account removes its identity from remaining moderation records; reports about other people may remain. These room-safety records are separate from billing records and deletion-processing logs.

We retain only the billing and transaction records needed for accounting, tax, refunds and disputes for seven years from the relevant tax return’s filing date or due date, whichever is later. Longer retention is limited to an applicable legal obligation or documented unresolved matter. Financial records are restricted to business accounting purposes and do not include your study answers, mastery history or practice activity.

We retain limited deletion-processing and related security evidence for 90 days after cleanup and delivery of the completion notice are both complete, then remove it through our daily deletion review. Minimum records needed to finish an unresolved request remain restricted until it is resolved. A documented legal obligation or active security dispute may require limited records to be held longer; this does not permit retaining your study history for routine operations.

Backup copies expire under the applicable provider’s backup schedule. They are restricted to recovery and are not used to reactivate deleted accounts. Before restored data can serve users, we enforce deletion safeguards; a recovery point that could restore deleted personal data is not returned to service without completing those safeguards. Financial retention is separate from backup retention. Files you previously exported to your own device remain under your control.

Deleting your Clarity account does not cancel an Apple subscription or request a refund from Apple. Manage Apple subscriptions in your Apple account settings. During account deletion, we cancel website subscriptions immediately without proration or an automatic refund, reconcile outstanding billing, and remove the website billing customer. Mandatory consumer rights remain unaffected. Deactivation or clearing local app data alone is not permanent server-side account deletion.

7. Your choices and rights

You can edit available profile and preference fields, omit optional information, sign out, and request assistance with stored data. Depending on your location and applicable law, you may have rights to access, correct, delete, or obtain a copy of personal information, restrict or object to certain processing, withdraw consent where consent is the basis, or complain to a privacy regulator. We do not reduce legally protected rights because you contact us. If we cannot fulfill a request, we will explain why and any available review process.

8. Location and international use

The selected Supabase database and Render server are in Oregon, United States. Providers may process support, security, or delivery information elsewhere. Using the app does not waive privacy rights or by itself supply a legal mechanism for international data transfers. Before expanding into jurisdictions with additional requirements, the operator must establish applicable notices, legal bases, contracts, and transfer safeguards.

9. Age eligibility and clinical information

ABA Clarity is intended for people aged 16 or older. Users under 18 must have a parent or legal guardian review and agree to the Terms and this Privacy Policy before creating an account or using the service. We do not knowingly collect personal information from people under 16. Contact us at abaclarity@gmail.com if you believe someone under 16 has submitted personal information so we can investigate and remove it as appropriate.

This is a study app, not a patient-record system. Do not submit identifiable client information or health records. We do not represent the app as a HIPAA-compliant clinical service. Use fictional or fully de-identified examples in discussions and support requests.

10. Policy updates and contact

Published updates will carry an effective date and version. We will give appropriate notice of material changes and request consent when legally required. For privacy questions or requests, email abaclarity@gmail.com.