Last updated: July 2026
This Privacy Policy explains how WhiteCoatRecall.com ("we," "us," or "our") collects, uses, discloses, and protects information when you visit or use WhiteCoatRecall.com (the "Platform"). It is written to comply with the EU/UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
1. Information We Collect
We collect the following categories of information:
- Email address — if you subscribe to the Medical Fact of the Day email or create an account, your email address is collected and stored in our MailerLite mailing list workspace so we can send the emails you sign up for.
- Game scores and play activity — when you play a game, your scores, streaks, category mastery progress, and (if signed in) challenge results are stored in our Supabase database, tied to a guest session or your account.
- Account information — if you create an optional account, we store the account identifier and authentication information needed to sign you in; guest play does not require any account information.
- Advertising cookies and identifiers — Google AdSense, which serves ads on the Platform, may set cookies and use device identifiers on its own behalf and on behalf of its advertising partners to serve and measure ads, including personalized ads where permitted.
- Basic technical data — like most websites, our hosting provider (Cloudflare) logs standard technical information such as IP address, browser type, and request timestamps for security and performance purposes.
We do not collect any health information about you personally. The medical content on the Platform is general historical and scientific trivia content, not information about your health — see our Medical Disclaimer.
2. How We Use Information
- To operate core Platform features: saving your scores, streaks, and Medical Knowledge Score, and powering leaderboards and challenges;
- To send you the emails you opt into, such as the Medical Fact of the Day or daily challenge reminders, through MailerLite;
- To serve advertising through Google AdSense and measure ad performance;
- To maintain the security, integrity, and performance of the Platform, including rate limiting and fraud/abuse prevention on score submissions;
- To comply with legal obligations and enforce our Terms of Service.
3. We Do Not Sell Your Personal Data
We do not sell or rent your personal data to third parties. Google AdSense may be considered a "sale" or "sharing" of data under certain state privacy laws solely because of how cookie-based advertising works; you can opt out of personalized advertising as described in Section 6 below.
4. Legal Basis for Processing (GDPR)
If you are located in the EU, UK, or another jurisdiction covered by the GDPR, we process your information under the following legal bases:
- Consent — for email subscriptions and non-essential advertising cookies, which you can withdraw at any time;
- Legitimate interests — for storing gameplay data needed to provide leaderboards, streaks, and score history, and for maintaining Platform security;
- Legal obligation — where we are required to retain or disclose information by law.
5. Data Retention
We keep information only as long as necessary for the purposes described in this policy:
- Game scores and streak data — retained for as long as your account or guest session is active, and up to 24 months of inactivity, after which inactive guest data may be purged;
- Account information — retained until you delete your account, or up to 12 months after account deletion is requested, to complete deletion across backups;
- Email subscriber records — retained in MailerLite until you unsubscribe or request deletion;
- Advertising cookies — retained according to Google's own cookie retention periods, typically up to 13 months, subject to your cookie preferences.
6. Your Rights
Depending on where you live, you may have the following rights regarding your personal data:
- Right to access — request a copy of the personal data we hold about you;
- Right to deletion — request that we delete your account, email subscription, and associated gameplay data;
- Right to correction — request that we correct inaccurate information;
- Right to opt out — unsubscribe from any email at any time using the link in every email, and opt out of personalized advertising through Google's Ad Settings or a recognized opt-out tool such as the Digital Advertising Alliance opt-out page;
- Right to non-discrimination — we will not deny you service or charge you a different price for exercising any of these rights.
To exercise any of these rights, contact us using the information in Section 9 below. We will respond within the timeframe required by applicable law.
7. Cookies
The Platform uses essential cookies/local storage needed for gameplay (such as remembering a guest session or daily streak) and, where AdSense is active, advertising cookies as described above. You can control cookies through your browser settings, though disabling essential cookies may prevent core features like streak tracking from working correctly.
8. Data Security
We use industry-standard safeguards to protect your information, including Supabase Row Level Security policies restricting access to gameplay and account data, Cloudflare Turnstile and rate limiting on public-facing forms, and server-side score validation so that scores cannot be forged client-side. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
9. Contact Us
For any questions about this Privacy Policy or to exercise your data rights, contact us at privacy@whitecoatrecall.com.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above. We encourage you to review this page periodically.