Privacy Notice

The honest short version: your study history is saved on your device first, and once it syncs to your account a copy is kept on Nurseal's servers, so it survives a cleared browser, a lost laptop, or a switch to your phone. Work that has not synced yet — for example because you were offline, were signed out, or a sync failed — is only on that device, and work done signed out stays there unless it is moved into an account (section 3c). If you are signed in and your browser will not store an answer at all, Nurseal tries to send it straight to your account instead (section 7), and if that fails too, to the operator’s backup inbox when it is switched on, which keeps it only until it can be added to your account, and deletes it after 30 days if it cannot be. Material you submit for AI features must be transmitted to the AI provider. “Local-first” means your device works without a network — not that nothing ever leaves it. If you buy credits, you type your card number into Stripe's own page, and your full card number never reaches Nurseal (section 7c).

1. Scope and operator

This notice governs Nurseal, a Seal Studios product. Nurseal is operated by Elpidio Samuel Poblano Vallejo, an individual doing business as Seal Studios, in California, United States. He is the person responsible for the information described here — the data controller, in the language of privacy law — and “the operator,” “Nurseal,” and “Seal Studios” all refer to him throughout this notice.

Reaching him about your information — including any request in section 10 — hello@seal-studios.com, or by post to Elpidio Samuel Poblano Vallejo, PO Box 1714, Indio, CA 92202-1714, United States. That mailbox is monitored and serves as both the privacy contact and the support contact; there is one person behind Nurseal and pretending otherwise with two addresses would tell you less, not more. For anything tied to your account, the Feedback button inside the product is faster, because it arrives with your account already attached.

Where Nurseal runs. The operator is in California and the service is offered from the United States. Your information is processed in the United States and, depending on the provider, in other countries where that provider operates. Section 7 names every company Nurseal uses and links each one’s privacy policy, which is where that company says where it operates.

2. Your study history: on your device, and mirrored to your account

Your device is the first place everything is written, so Nurseal works with no network at all — you can take a whole test offline. A copy of five things is then synced to your Nurseal account, each one carrying four tracking details — its own id, which account it belongs to, when it was saved on your device and when it reached your account:

• Practice questions generated for you — the question, its options, the correct answer, the explanations, the hints, the teaching note and any chart, its topic, difficulty, question type, clinical-judgment step and thinking level, which AI model and prompt version made it, which test it belongs to, and the study-aid disclaimer it carries.
• Your answers — which option you chose, whether it was right, how many hints you used, whether you flagged the question as too hard and the reason you picked, when you answered, how long that question took you, and which study session it belonged to.
• Changes you make to your own difficulty level — when you set your level by hand and which level you set, and when you ask for harder questions to start coming back.
• Your flashcards — the front, back, explanation, topic, deck and position, difficulty, model, prompt version, disclaimer and any linked question or test, including whether the card was found in your notes, never the quote.
• Your card marks — which card you marked and whether you chose “Knew it” or “Missed it”.

About that timing, since it is the one item here that can feel like being watched. Nurseal records how many seconds a question was on your screen, and the clock stops whenever the tab is not in front of you — a closed laptop is never counted as thinking. It is used for two things. The first is telling apart a hint ladder you worked through from one you clicked to the bottom in four seconds: those two look identical without it, and they need opposite responses, which is why the operator summary described below includes how many answers took under five seconds and the typical time an answer took. The second is showing you, when you open a question on Your history, about how long you usually take on it. It is never shown to you as a timer while you answer, never used to rank you, and never shared with anyone outside Nurseal. Tests are untimed and stay that way.

Why a copy is kept on our servers at all. Browsers evict stored data: Safari clears script-writable storage after roughly seven days without visiting the site, so a week deep in clinicals could erase a semester of your history — along with the record that makes questions you keep missing come back to you. Keeping nothing would buy privacy by making the product lose your work. Keeping what is listed above, saying so here, and letting you take it out or delete it is the honest trade.

These records are locked to your account by the database itself, not merely by the app: another signed-in user cannot read, change, or delete them. Answers are append-only — Nurseal never edits or quietly removes an answer you gave, because a difficulty estimate built on an edited history would be wrong about you. One narrow exception exists, for the person who operates Nurseal, and the next four paragraphs say exactly what it does and does not include.

What the operator can read, as built (August 11, 2026). The database holds one function that hands your summary to no one but an owner account — an account on a short list in the database, which is how the operator (section 1) reaches it — and what it hands over is counts about studying, never anything you studied. Per account — yours among them — that is: how many practice questions were generated for you and how many of those came from Nurseal’s own test runs rather than real study (told apart by the name of the model recorded on each), how many separate tests they came from, the date and time of the first and the last, how they were spread across the five difficulty levels, across the six clinical-judgment steps, and across the two thinking levels, and which AI model produced them; how many distinct subjects they covered as a number, never the subject names; how many questions you answered or marked too hard, how many you got right, how many you got right only after hints, how many you left without choosing an answer, how many you flagged too hard and which reason you chose, at each difficulty level how many you answered or marked too hard and how many of those you got right, how many separate sittings you spread them over, the typical time an answer took you and how many took under five seconds, and the date and time of the first and the last; how many questions you missed were attempted again in a later sitting and how many you got right that time; and how many times you set your difficulty level by hand or asked for the harder questions back, and where that level now stands. That list is the whole of what it reports about you — the rest of what comes back is the clock time of the read itself and a line naming what the summary is. No question text, no answer options, no correct answer, no explanation, no hint text, and no subject name. The exclusion is enforced by the database rather than by the screen that displays the result: installing the function makes it read back its own deployed code and refuse to install at all if either of the two content-bearing fields appears anywhere inside it. Running it stores nothing new in your account.

And one check about your account rather than your studying, as built (August 12, 2026). The operator can also see, for every account, its email address and internal id, which kind of access it has and whether it can use Nurseal right now, whether it is one of Nurseal’s own test accounts, when it was created, when it last signed in, and how much of the daily allowance it has used today. It exists because of a real failure: an account was set up without access and sat that way for seventeen days, and the only thing that eventually surfaced it was the person telling us. Nothing in the system was watching, because a refusal is turned away before anything is written down — so being unable to use Nurseal left no trace at all. This check reads the settings on your account so that nobody sits locked out unnoticed again. It stores nothing, and it reads none of your study history.

And every other owner read, as built. An owner account can also read: the per-request usage ledger described in section 3, row by row with the account each row belongs to — it shows whether a generated test is being held, never the test itself; an account’s credit balance and every grant of credits to it, with who made the grant and any note written with it (section 7c); the cost summary described in section 9, which totals every request and lists accounts day by day only where the account said yes; a list of every account — not only dormant ones — with its email address and internal id, when it last signed in, whether a dormancy warning was sent, and where it stands on the dormancy schedule (section 10a); a tally of how people answered the question in section 7d, naming no one, though while very few people have answered a count can be one person’s answer — it gives how many chose each answer, the same counts for only the first ten answers to arrive and how many of those ten were a paper planner or in your head (which says something about whoever answered earliest), how many accounts are left out of it (the operator’s own, Nurseal’s test addresses, and accounts made before sign-ups opened on August 22, 2026), and how many answers have no time recorded; and feedback reports, with the email address of the account that sent each one and any note the operator added (section 7a). None of these reads the questions or answers in your study history, or the study material and conversations kept in your browser.

Two limits, stated because both are easy to overclaim. This is not anonymous, and is not described as such: the summary is per account, so while only a handful of people use Nurseal, an average is one person’s number with a plural name on it. What is true is smaller and worth more — the operator knows whose rows these are and does not read what you studied or what the questions said, with two exceptions: anything you paste into a feedback report yourself (section 7a), and the backup inbox in section 7, which holds an answer only for as long as that section says. And this describes the door Nurseal is built with, not a claim about what anyone administering a database is technically unable to do: reading study content directly is not routine, is not what this function does, and is not something Nurseal is built to do. The narrow door exists to answer one question — whether the questions are landing near the 70–85% correct they are calibrated to — which the usage records in section 3 cannot answer, because they count what was spent and not whether it taught you anything.

Not synced, and not stored on our servers: the study material you add or paste (see section 3), and your study-buddy conversations — both what you type and what comes back (see section 3a). Interface settings and theme remain on your device only. One exception, since September 19, 2026: notes you put into a study table’s build step are held on our servers by that table until it deletes them, which section 2a describes case by case.

Built, as of July 26, 2026: you can download your whole study history and you can delete it, both from the account page. The download is one file containing your account record and every question and answer — and it checks your account first, so if it cannot reach the server it tells you the file may be missing answers synced from another device rather than quietly handing you a partial one. Deleting removes the questions and answers from your account and from the device you are using. Two honest limits: deleting your study history does not delete your account (that is a separate control, section 10a), and if you also study on another phone or laptop, that device keeps its own copy until you delete there too. The questions and answers that device saved before your delete are not added back to your account when it next syncs, and neither is an answer it saves afterwards to one of the deleted questions. “Before” is judged by the clocks on your devices, so if one of them is set wrong, work saved around the time of your delete can land on the wrong side of it — added back to your account, or kept only on that device — and “around” is as wide as that clock is wrong, which can be days.

2a. Study tables: the one place your study data is shared on purpose

Everything above is built so that one account’s study data cannot reach another’s. A study table deliberately crosses that line, and this section is the whole of what crosses. Since August 25, 2026 the crossing includes one thing that lasts: anyone at the table who has an account can choose, at the end, to keep the questions they answered. You open a table on a test you already made; up to seven other people join it by typing a five-character table code you read out to them — eight at the table, counting you. They need no account, no email, and no password.

• What everyone at the table sees: the questions from the test the table is on — the one you opened it with, or, once the table has built its own, the questions written from the notes everyone put in, which every screen sees in full even though the notes behind them are shown to nobody — the question, its options, the correct answer and the explanation, revealed together when you choose — plus every person’s chosen first name, whether they are still there, whether they have answered yet, and, at the end, everyone’s score. Behind the screen, every device at the table is also sent, at each reveal, how many people picked each option, and at the end, which option each person picked on every question — the screens show the split, not who picked what.
• What you give it: a first name you type for this table, which option you pick on each question, and — only if the host opens a build step and only if you choose to — notes you type, paste or add a file for, which are described further down this section. Your real name and your email address are never sent to the table, and nobody at the table is shown anything that identifies your account.
• Table talk — a small chat beside the questions. Messages are 280 characters or fewer, carry a first name only, go to that one table and nowhere else, are never saved, and are never sent to any AI provider.

What never reaches a table: your study history (apart from the questions of the test the table is on, and of any next test you pick there as its host), how many hints you have used, your study-buddy conversations, your difficulty level, your exam date, and your email address. Study material is not on this list: a table can be used to build a new test out of notes the people at it put in, which is what the next few paragraphs describe. Nothing you have already studied goes into those notes: only what you type or add there yourself, and only once you press the button.

Building a test inside the room, from notes the room puts in (September 19, 2026). Whoever is hosting can open a build step, and then everyone at the table — guests included — gets a box to type or paste what the next test should be made from. Nobody has to add anything, and a table can run start to finish without anyone opening one. If you are a guest, a line sits above your box before it will take a single character, naming the host, saying that what you add is sent to the AI that writes the questions on that host’s account, and saying that nobody at the table is shown it. The host’s own box carries no such line, because the account the notes go to is hers.

• Your notes go to the room, and out of it only into the host’s one request to the AI provider (section 3, which describes that request and is unchanged by this). They are never shown to anyone at the table, never sent to anyone else’s device, and never shown to the host either: what the host sees beside your table name is a rough size — “a few lines”, “a page”, “several pages” — and never a word of the text. Everyone else is told only that you have added something.
• A file you add still never leaves your device. The room reads it in your browser, the same way the study pages do (section 3), and only the text it pulls out goes into your box, where you can read it before you press anything. If a PDF is longer than your share of the room, you are asked which pages you want; if a text file is, it is refused whole, with the two numbers and a suggestion to trim it or ask the host for more room. Either way nothing is ever cut without you choosing it.
• The room holds your notes while it is collecting, and then deletes them. From the moment you press the button they are stored with the rest of the room’s state, described below. They are deleted when the test is made and reaches the room, when you take them back, when you leave the room by pressing a link on its page (Leave the room, or Study Room at the top), when the person hosting closes the build step, when the table ends, and at the idle limit below. If the test cannot be made, or is made but does not reach the room, they are kept and the room says so, so that nobody has to paste it all in again — and a test that was made has been paid for with the host’s credits either way, and the bullet below says when the host’s own copy is saved.
• Closing the page does not take them back, and this is the one part worth reading twice. Closing the tab, going back, or losing your connection does not delete your notes — the room keeps them until one of the moments listed above, so that a phone that locks mid-test is not treated as a person walking out. A link on the room’s page is different: pressing one while you are connected tells the room you have gone, and your notes are deleted as you leave — once that message reaches the room. The page waits a moment for the room to answer and then goes anyway, so if your connection fails at that instant the message can be lost, and your notes stay until one of the other moments above. If you want them gone before then, press “Take my notes back” while the table is still collecting — once your notes are in, that button is where your box was, and it is what “take them back” means. Whoever is hosting has no such button for her own notes: hers go when she closes the build step with its Back button, which takes everyone’s back at once. And while your page is showing that a test did not work, the button is not on it — leaving the room by a link on its page still takes your notes with you. Once you have closed the page, a new page cannot reach a guest’s seat, so a guest cannot take her notes back from one (section 8 says when a browser can bring the old page back); whoever is hosting gets her own seat back in any of the three ways the paragraph below on your account lists.
• The test is made on the host’s account, with the host’s credits, and the host keeps it. The questions it produces are saved to the host’s study history as an ordinary test by the host’s own page, once the finished test reaches it: if that page is closed or loses its connection before then, or this browser will not store the test, the host’s copy is not saved — the room still gets the test, and the host’s page says so when it can. Making it again would use the host’s credits again. Your own copy of the questions you answered is the offer further down this section, and it works here exactly as it does after any other table.
• Nobody else can spend. Only the host can press the button that makes the test. A guest can suggest a topic and a number of questions; the host decides.

One thing about your account does reach it, and only when you open one. When you open a table, Nurseal sends it the internal id your account carries in our database — not your name, not your email, and nothing you have studied — and the table holds it for as long as the table exists. It is there for two reasons, both about the table being yours: so that one account cannot leave several tables running at once, and so that if you close the table’s page while the table is still running, you get your own seat back instead of being refused, as long as you are signed in to that account — whether you open a table again, press Jump back in where your Study Room says your room is still open, or type that table’s code to join it. It is never shown to anyone at the table and is never sent to any of them, it cannot be worked out from anything a guest is shown, and it is deleted with the table. If you only ever join tables and never open one, nothing identifying your account reaches a table at all.

The room itself does not survive the room. While it is running, the table’s state — who is at it, where everyone is, the questions of the test it is on and of any next test its host has picked but not yet started, the scores so far, and any notes added to a build step that has not finished — is held in one place that exists only for that table. It is deleted when the table ends. A table ends on its own in two cases: when the page of whoever is hosting it closes or loses its connection and does not come back within about five minutes of Nurseal seeing it go (a connection that drops suddenly can take longer to be seen), and after about two hours with no word from any screen at it. But a page left open on a table checks in with it every minute, so a table keeps running for as long as its host’s page stays open and connected, however long that is. Table talk is not part of that state: a message is passed straight to the other screens and is written nowhere, which is why the bullet below can say it is never kept. A table cannot be re-opened; the code stops working, and a code that has finished is answered exactly the same way as a code that never existed. Guests leave almost nothing behind: unless a guest signs in and keeps their own answers (below), Nurseal stores no record that a guest was ever there — with one exception, and it is named rather than rounded down. If the table builds a test, the usage record for that one request carries the same one-way fingerprint section 3 describes, and the notes everyone pooled are part of what was scrambled to make it. It is not readable, it is not linked to any guest, and it cannot be turned back into what anyone wrote; it is kept as accounting, like every other request.

Keeping the questions you answered, if you have an account and you ask for it. When a test at the table finishes, or the table is ended part-way through one, anyone signed in is offered the questions they answered, to keep. That copy is sent to your device at that moment, and sent again if you reload the page or reconnect while the table is still showing that test’s results. Once whoever is hosting moves the table on to another test or ends it, that copy cannot be sent again: what your page is already holding is all there is. A page that is still open keeps that copy even if its connection has dropped, so do not reload or close it until you have kept what you want — either one loses the copy — and a page that lost its connection before the copy arrived never had it. Nothing is saved unless you press that button. If you do, those questions are copied into your own study history as an ordinary test: your copy, under your account, counting towards your difficulty level and included in what you download and in what account deletion removes. Nobody else’s answers come with it, and nothing you keep appears in anyone else’s account.

• A question is kept only if its record is complete. Each one is filed in your study history with the details that history needs — its subject, its difficulty, and the rest. If any of those did not come through with it, that question is left out, and the results screen says how many rather than quietly handing you a smaller number.
• You keep what you were shown, and nothing more. Each question arrives with the wording, the options, the correct answer and the one explanation that was on screen at the table. The hints are not included — a table never shows them to anyone.
• Table talk is never kept. The chat is not part of what you save, is not written anywhere, and goes nowhere when the table ends.
• How long each question took you is not recorded at a table. A table is paced by whoever is hosting, so the time on your screen is not time you spent thinking, and Nurseal records no number rather than a misleading one.
• Guests keep nothing unless they sign in on that device, there and then. Saving works through your own account, so while you are not signed in there is nothing to save into. If you sign in from the results screen — that page opens the sign-in tab beside itself, so the results stay open behind it — you are then offered the questions you answered, exactly as anyone signed in would be. This does not reach back into the table. What you are being offered is the copy your own device was sent, and it is held by that page alone. While the table is still showing that test’s results, reloading the page asks the table for it again; once the table has moved on to another test or ended, it cannot be sent again, so closing or reloading the page loses it. Nothing is saved unless you press the button.

One thing worth knowing before you read a table code out. Anyone who has the code can join while the table is live, so the code is the whole of the door — say it to the people you meant to invite. Nurseal caps a table at eight people and lets you run one at a time.

3. Information sent for AI processing

When you ask Nurseal to build a test, on your own or at a study table, to find the weeks in a course syllabus, or to talk a question through with the study buddy, the relevant prompt and source content must be transmitted to the AI provider. Do not submit sensitive, confidential, patient-identifying, or unauthorized information.

A course syllabus you add on your account page (section 7b) goes the same way: its text — never the file, which is read in your browser — is sent through Nurseal to Google’s AI to find the weeks, their dates and their topics, as soon as you press Find my weeks. Nurseal handles it only long enough to get that answer; if an attempt fails, it sends the same text again, up to four tries in all. Unlike a file you add to build a test, a syllabus PDF’s text is not shown to you before it goes, so if there is anything in it you would rather not send, paste only the schedule part instead. A syllabus usually names its instructors, often with an email address or an office; those go out with the rest of the text, exactly as they would in notes you paste. The AI is told to leave people out of its answer, but that is an instruction, not a filter: the next screen shows you everything it sent back, and your schedule is not saved until you have checked it (section 7b).

3a. The study buddy

Available since August 2026. On the screen you see after a test, and on your history page, each question you have already answered carries a study buddy you can ask about it. It is entirely optional — nothing is sent unless you type a question and press Ask. It does not appear on a question you have not answered yet, and it does not appear when you are signed out.

Sent to be answered, and not kept. Those three things are transmitted every time you press Ask — a conversation has no memory at the AI provider, so the earlier messages have to travel again with each new one. Nurseal’s server holds them only for the length of that one request and stores none of them. The conversation itself is saved in this browser only: it is not synced, it is not readable by the operator, and it is not in the file you download from “Download my records” — that file holds your account record and your study history (section 10), and Nurseal holds no conversation to put in it. Two plain consequences: clearing your browser data clears your conversations, and a conversation you had on your laptop is not on your phone. Deleting your study history and deleting your whole account both clear them from the device you do it on, and both say how many were removed.

What Nurseal does keep is one usage record per message, of the same kind as the one in section 3: which account asked, that the operation was a study-buddy message, the AI model and prompt version, token counts, computed cost, the credits it used, the difficulty of the question you asked about, success or failure with the AI provider’s status and finish codes, how many attempts it took (including any whose cost the provider never reported), timestamps, and a reference code for the request. It never contains your message or the answer you got back.

About that reference code, because it is the one item here that deserves explaining. It is a fixed-length scramble — a one-way hash — computed from your account, which question you asked about, the text of the message, how many earlier messages were sent with it, and which AI model and prompt version the message was sent to, and it exists for one reason: if a tap registers twice while the first message is still being answered, the two requests produce the same code and you are charged once instead of twice. It cannot be turned back into your message. It is deliberately computed from as little as possible — not from the text of the earlier messages, and not from any answer you were given — so that the record kept for billing carries the smallest fingerprint that still does its job.

A message that fails or comes back empty is recorded as a failure, and does not count against your daily allowance or use your credits. The exception is a fault on Nurseal’s own side: if its server cannot record how the request ended at all, the request is closed automatically within about ten minutes, keeping only what section 3 says such a record keeps, and a request closed that way counts against that day’s allowance and uses your credits if you have bought them, though never one of your free study-buddy messages. The screen cannot tell you this happened, because the part that would have said so is the part that failed; if your credits look wrong, ask (section 10).

What the buddy is, and is not. It answers about one question you have already answered, using that question’s own explanations — the same AI-generated ones already on your screen, which no clinician has reviewed. Its own answer is AI-generated too and can be wrong; every answer carries a line telling you to check it against your own notes or your instructor, and that line is not a formality. It is a study aid, not clinical advice. Do not type sensitive, confidential, or patient-identifying information into it — the same rule as section 3, and it applies to a chat box more than anywhere else, because a chat box invites you to write freely.

3b. Study material kept on this device

The copy kept with your test is in this browser only. When you build a test, Nurseal keeps a copy of the text and test settings in this browser so that test can offer Flashcards and New test on Your tests without asking you to paste or add the material again. It is not kept on Nurseal’s servers and is not part of your account. Notes you add inside a study table are a different thing and go somewhere else; section 2a describes where. It can stay in this browser until you delete your study history or account on this device or clear this site’s browser data; the browser can also remove its stored data on its own, and Safari may do that after roughly seven days away as section 2 explains. The quote a flashcard shows from your notes is kept on this device only; it is never synced to your account or included in your data download.

Two plain consequences: clearing your browser data clears this material, and a test built from material on your laptop offers the button on your laptop only, not on your phone.

On a shared device, each account signed in on this device has its own separate copy, and Nurseal never shows one account’s copy to another: a study page you leave open hides what it was showing as soon as its account signs out or a different account signs in, in this browser — except a study table, whose questions, names and scores belong to the table rather than to an account and stay on screen for whoever is at this browser (section 2a). So does anything typed into a table’s notes box and not yet added, and once a test there has finished, its results screen names the email address of the account that was signed in when that seat was taken, asking it to sign back in to keep its questions — though a page reloaded since names it only if that account was still signed in when the page reloaded.

Separate is not locked, though — nothing Nurseal keeps in this browser is encrypted. This material, your questions and answers, your study-buddy conversations and your sign-in session are all stored unencrypted, so someone using this browser’s own developer tools could read any of them. The sign-in session matters most: it is not just a record but the key to your account, so someone who copies it can use your account as you.

What signing out does, and what it does not. Signing out removes the session from this browser whether or not you are online, and asks the account system (section 7) to end it; a copy taken before you signed out can keep working until it expires, which is up to an hour after it was issued, and if that request does not get through — for example because you are offline — the copy is not ended at all, and the sign-in page tells you so. When that request does get through it ends every session on the account, not only this browser’s, so if you left yourself signed in on a shared computer, signing in on your phone and signing out there ends that one too.

• Ended does not mean every copy stops at the same moment. The account system and Nurseal’s own server refuse an ended session at once, so building a test, the study buddy and buying credits stop working with it straight away; but the database that holds your account record and your study history (section 7) can still accept it until it expires — the hour described above — and that is enough to read what your account keeps there, change your account details such as your exam date, add to your study history and send feedback in your name. Deleting your study history or your account is refused as soon as the session ends.
• Signing out on your phone does not reach a page already open on the shared computer. That computer’s browser finds out only when it asks: its account page asks as soon as it is opened, which signs that browser out, but a study page asks only when its copy is about to run out — up to an hour after it was issued — and only when it next checks, as reloading one does. Until then, a study page left open there keeps showing your work, and reloading it shows your work again. And the account page on a shared computer can ask only once it reaches Nurseal: opened there with no connection, it signs nothing out until it can.
• Signing out also leaves the rest of what Nurseal keeps in this browser where it is: your study history, the material kept with your tests and your study-buddy conversations stay here, readable through its developer tools as described above, until you clear this site’s browser data (section 8).
• When a sign-out does not get through, the hour is no limit on a copy taken before it: that copy can keep renewing itself until a sign-out that does get through, from any device, ends it. Nothing else puts a limit on it: the account system is not set to end a session after a fixed time or after a stretch without use, and sessions on it have been measured still renewing more than seven weeks after they began (September 25, 2026).

That material is not included in “Download my records”. That file holds your account record and your study history (section 10), and Nurseal holds no server or account copy of this material to put in it. Deleting your study history or your whole account clears it from the device where you perform the deletion, and the result says how many tests had material removed.

3c. Work you do before signing in

Kept in this browser only, and not in any account. You can take a test without signing in. That work is written to a separate store in this browser. The one exception is a browser where Nurseal was used signed out before September 15, 2026 and no account has signed in since: work done there signed out, then and now, goes to the first account to sign in on this browser, which keeps it without being asked — on a shared computer, that can be someone else’s earlier work. If you do not know a shared computer’s history, clear this site’s browser data before you sign in on it. Close any Nurseal page already open on it as well, because clearing does not blank a page that is already on screen. None of it is synced while you are signed out, except in one case: if someone signs in on this browser in another tab while a page you opened signed out is still open, the questions and answers that page saved are sent to that account the next time that page syncs — for example when a test on it finishes — not at the moment of signing in.

When you sign in on a device whose separate store holds that work, Nurseal offers to move it into your account. If you accept, it is copied into your account’s store in this browser, removed from the signed out store, and then synced to your account like any other work, so until that sync succeeds it is on this device only. If the removal does not finish, the card says a copy may still be on this device, and if the card comes back when you reload, choosing Finish adding tries again to clear it, and the card says so again if it still cannot. Any of that work done before a delete of your study history is moved the same way, but it is not added to your account, and stays on this device only — unless a device’s clock was set wrong around the delete, as section 2 describes. If this browser cannot check when your history was last deleted at the moment it syncs, it may send that older work anyway, and Nurseal’s server refuses it rather than adding it to your account. If you decline, it stays in this browser, and deleting your study history or your account leaves it alone; it goes when you clear this site’s browser data. If more work is saved there after you decline, you are offered all of it again, and deleting your study history or your account before you answer removes all of it.

On a shared device this is worth knowing before you walk away. Until somebody claims it, anyone using Nurseal signed out on this browser can see it on Your tests and Your history, and an account that signs in here is offered it — unless that account has already said no and nothing has been added since, or this browser will not let Nurseal list or read what it has stored, in which case no offer appears even though the work is still here. Before you leave a shared computer you used signed out, clear this site’s browser data. That deletes the work here that no account has claimed, and it does not blank a page that is already on screen, so close any Nurseal page still open too. It also deletes any work an account on this browser has not synced to that account yet, which is then gone for good. Once an account has claimed work from here, that work is locked to that account and anyone else signing in is refused it rather than shown it — but if more than one account signs in on this browser, the work done here can end up split between them, part in each.

4. AI key handling and billing

Nurseal uses a dedicated, revocable Gemini key owned by Seal Studios, stored as a server-side secret. It is never sent to your browser, never placed in URLs or logs, and never committed to source control. You do not create, supply, or pay for an AI key today.

5. Google service distinction

Under Google's Gemini API terms effective March 23, 2026, unpaid-service prompts and responses may be used to provide, improve, and develop Google products, and human reviewers may process them. Google instructs users not to submit sensitive, confidential, or personal information to unpaid services. For Paid Services, Google says prompts and responses are not used to improve its products, though limited safety and security logging applies.

Nurseal's hosted AI requests are made under Seal Studios' actively billed (paid-tier) Google project, and are governed by the Gemini API terms and Google's privacy policy as they stand at the time of the request. Nurseal does not describe Google usage as included or free: the operator pays Google, and what you buy from Nurseal is credits (Terms, section 9).

6. Optional integrations

Stripe is a processor Nurseal uses on every purchase, not an integration you choose to connect, so it is described in section 7c. Nurseal offers no optional integrations today — there is nothing here for you to connect, and section 7 lists the complete set of outside companies your information reaches. If one is ever offered, Nurseal will request only the access that feature needs, and the order is fixed: this notice and a consent screen shown at the moment you would connect it will both name the integration, what it reaches, what it is used for, how long it is kept, and how to disconnect and delete it — before it ships, not after.

7. Technical and transaction information

Running Nurseal means IP address, browser and device information, request timing, sign-in data, usage counts, errors, payment status, and abuse and security signals pass through the companies that host it. Nurseal’s own server handles your study material only long enough to send the one request you asked for (section 3) and does not store it, except for notes put into a study table’s build step, which that table holds until it deletes them, case by case as section 2a describes.

Here is every outside company Nurseal uses, plus the operator’s own backup inbox, and what each one gets. This list is the whole set — it is derived from the addresses Nurseal’s code actually calls, plus the one company the account system is set up to send sign-in email through, not from memory, and nothing else is contacted on your behalf.

• Cloudflare — hosts the site and Nurseal’s server. Sees your IP address, browser information, and the timing and status of every request, as any web host does. It carries the request that contains your study material and does not keep it as a stored record, with one exception: notes put into a study table’s build step, which that table holds. What it does hold for Nurseal is each study table while that table is running — who is at it and the first names they chose, what everyone picked, the questions, the scores so far, the internal id of the account that opened it, and those notes — and all of it is deleted when the table ends, the notes often sooner (section 2a). It also keeps, for about a minute, a count of how many of the checks in section 3 your account has asked for, held against your account’s internal id and nothing else.
• Supabase — the account system and the database. Holds your email address, your password if you have set one, your sign-in sessions, your account record and consent answers, your exam date and any course schedule you save (section 7b), your study history, your credit balance and purchase records, your feedback, the per-request usage ledger described above, the short-term count of your requests (section 3), and whether a dormancy warning was sent to you, and when (section 10a). It also records the IP address and the browser-and-device description (the “user agent”) that your browser sends it, both in each sign-in session and in its own logs of the requests it receives.
• SMTP2GO — delivers Nurseal’s sign-in email, which the account system above sends through it. It gets your email address and the contents of those messages. It is not used for marketing, and Nurseal sends you no marketing email.
• Google (Gemini API) — generates the questions, answers the study buddy, and checks whether your notes are nursing material before anything is made from them. Gets exactly what sections 3 and 3a describe. Nurseal attaches nothing that identifies you — your name, your email address and your account number are not part of that request. What Nurseal cannot control is what is inside the material you paste, which is one of the reasons section 3 asks you not to submit patient-identifying or confidential information.
• Stripe — takes payments. Gets what section 7c describes, which also sets out exactly how your card details are handled: they are entered into Stripe's own form, and section 7c states what Nurseal does and does not see.
• Telegram — used once a day to send the operator a short summary: how many feedback reports arrived in the last 24 hours, how many AI requests expired without giving anything back and from how many accounts, and a link to Nurseal. It does not receive your report, your email address, or anything identifying you, and the database function behind that message is written so that it cannot return a report’s text at all.
• The operator’s backup inbox — a server the operator runs himself, not a company, and switched off unless he turns it on. If you are signed in and an answer you give cannot be saved on your device or to your account, Nurseal’s server can forward that one answer, the question it belongs to, and your account’s internal id to it, so the answer is not lost. While it is switched off, nothing is forwarded. When it is on, Nurseal adds a forwarded answer to your account by itself, usually within a day, and then removes it from the inbox.

What is written into logs. Nurseal does not write your study material, your questions, your answers, your study-buddy messages, or the AI’s replies into any log. Sign-in tokens and the AI key are excluded the same way. Nurseal’s own server writes only two kinds of log line: one when an AI request had to be tried again, fell back to a different AI model, or got back a reply that could not be read, giving which feature it was, how it ended, counts of the tries and, if it fell back, an AI model’s name; and a once-a-day line with the same counts the operator’s daily summary sends (the Telegram entry above). Neither carries your email address, your account, or anything you wrote. Cloudflare’s live view of the server also shows the shape of each request — when, which route, how long, whether it succeeded — and, if the server itself fails, the error that stopped it.

How long each of them keeps it. The records Nurseal itself controls are covered in section 11, and deleting your account removes them, with two exceptions: the ledger of AI requests it paid for, which is kept with your identity removed from it (sections 10a and 11), and whatever a study table that is still running holds from you, which stays with that table until it deletes it (sections 2a and 10a). The operator’s backup inbox keeps a forwarded answer until it has been added to your account, and deletes it after 30 days even if that has not happened. An answer that can no longer be added — because your account has been deleted, or because the answer is from before you deleted your study history — is removed instead. The retention periods of the companies above are set by those companies under their own published policies, linked beside each name, and the operator does not control them and cannot state a period on their behalf — Stripe in particular keeps its own record of a payment for as long as its legal obligations require, which is why section 10a explains that deleting your account does not erase the payment from Stripe.

7c. Paying for credits, and Stripe

Nurseal uses Stripe to take payments. When Stripe handles a payment for Nurseal, it acts for Nurseal, as its processor. For some purposes it decides for itself what to do with your information, as a controller. Stripe’s data processing agreement, updated September 28, 2026, names those purposes: choosing the banks and payment networks that carry a payment; preventing fraud, financial loss and other harm; meeting its own legal duties, such as anti-money-laundering and identity checks; and analysing, improving and developing its own products. Stripe’s privacy policy says that last purpose includes training the AI models behind its services and its fraud protection, and that this applies to people who pay through businesses like Nurseal. Nurseal does not control those uses and cannot switch them off.

What Nurseal tells Stripe. Four things: the email address on your Nurseal account (so the payment can be attached to you and so Stripe can reach you about it), which pack you are buying and what it costs, and an internal reference to your account — the same account identifier the database uses, which means nothing outside Nurseal — and the Nurseal addresses to send you back to when you finish or cancel, which can name the question you had open when you chose to buy. Your study material, your questions, your answers, your difficulty level, and your exam date are not sent to Stripe and never have been.

What Stripe tells Nurseal, and what we keep. Stripe tells us that a payment succeeded, which pack it was for, how much was collected, in which currency, and its own references for the event and the payment — and, if a payment is later refunded, how much was refunded. We keep this as your purchase record: the date, the pack, the number of credits, the amount, the currency, and Stripe’s references for the event and the payment, with Nurseal’s own ids linking it to your account and to the credits it added. Your account page shows you the date, what you bought, and what you paid, under “Purchases”. Stripe’s reference is kept but not displayed — it is an internal identifier rather than something you would use, and we will quote it to you if you ever need it to trace a payment. If a payment is refunded in full, Nurseal takes back the credits that purchase added, and any access it gave you that no other purchase still gives, and records that in your credit history as a refund, with a note naming the pack and Stripe’s reference for the payment. A partial refund is not acted on automatically: your credits, your access and your credit history stay as they were, and any change to them is made by the operator by hand. We do not store your card number, any part of it, its expiry, your billing address, or the name on the card, and we write none of them into a log. Stripe’s messages to our server are Stripe’s own records of the checkout and, after a refund, of the charge, and those records can include the name and billing address you gave Stripe and your card’s brand, last four digits and expiry; our server reads only the details listed above from them and keeps nothing else. If you want those, they are in your Stripe receipt and on your card statement, not here.

Stripe also collects things directly from you that never pass through us — your full card number and security code, and the technical and fraud-prevention information any payment processor gathers about the device paying. Stripe is the controller of that, under its own privacy policy, linked above. We cannot see it and cannot delete it for you.

Your card statement should read NURSEAL. That is the descriptor we submit to Stripe; banks abbreviate and reformat descriptors in their own ways, so yours may show it differently. Said here because an unfamiliar name on a statement is the ordinary reason someone disputes a charge they actually made.

About receipts, stated plainly because it would be easier to leave vague. Your purchase record on your account page is the receipt Nurseal is responsible for, and it is written at the moment the payment lands. Nurseal does not promise you an email receipt, because whether one is sent is a setting inside Stripe rather than something this product controls or can verify. If one arrives, it comes from Stripe. If none arrives, nothing has gone wrong with your purchase — check your account page, which is the record either way.

Refunds. A full refund of your most recent purchase is yours for the asking while both of two things are true: it is within 14 days of that purchase, and fewer than 50 credits have been spent on your account since it, whichever credits they came from. Your account page and the credits page both show whether that is still true for you, computed from the same record, so they cannot tell you different things. Ask through the Feedback button on your account page while signed in — it reaches the person who operates Nurseal, with your account attached, so you do not need an order number. Outside that window your credits do not expire, and you can still ask.

Tax. No tax is added at checkout; the price shown is the amount charged. Nothing here is tax advice about what you may owe.

If you delete your account, your purchase records are deleted with it, along with your credits. They are not kept behind under another name. Stripe keeps its own record of the payment independently, for as long as its obligations require — that record is not ours to delete, and it is the one that matters for a chargeback or a tax question. This is stated in section 10a as well, because that is where someone about to delete an account will actually be reading.

7a. Feedback and bug reports

While you are signed in, the account page and every study page except a study table carry a Feedback button. It is entirely optional — nothing is sent unless you write something and press Send. (Signed out, the button is not shown, because a report has to be attached to an account.)

When you send one, Nurseal stores these: the message you typed, the page you were on when you opened the box (the page address only, without anything after the “?”), the app version, the date and time it was sent, an internal reference number, and your account. Nothing else is collected — no screenshot, no copy of the page, no console or error capture, and none of your study material, questions, or answers. Afterwards the operator can mark a report as addressed, which records when that was done and an optional note he writes.

While you are typing, an unsent draft is kept in this browser so a failed send or an accidental reload does not lose your words. It is deleted as soon as the report sends.

Please note that a bug report contains whatever you choose to type. If you paste part of your notes or a question into it to explain the problem, that text is stored with the report. Send only as much as you need to.

Reports are readable by the operator of Nurseal, together with the email address on your account, so that a reply is possible. They are not shared with anyone else and are not used to train anything. There is a limit of 20 reports per account in any 24 hours.

Reports you have sent are included in the file you download from “Download my records”: the message, the page, the app version and when you sent it (blank space at the very start and end of a message is trimmed before sending). The operator’s addressed mark and note are not in the file. A report is not part of your study history, so deleting your study history does not delete them. Deleting your whole account does. To have one specific report removed sooner, ask the operator directly (section 1) — he can remove it.

7b. Your exam date and your course syllabus

On your account page you can, if you want to, tell Nurseal the date you sit the NCLEX. It is entirely optional — the whole product works without it, and nothing asks you for it anywhere else.

It is used for exactly one thing: scheduling your reviews. With a date, the gaps between reviews get shorter as the date approaches, and nothing is scheduled for after it. Without one, reviews follow a fixed schedule. Once the date has passed, a question you answer again goes back on the fixed schedule, while one you last answered before the date keeps the shorter gap it was given. It is not used for reminders, is not sent to the AI provider with your questions, and is not shared with anyone.

For your exam date, Nurseal stores the date only — not your school, your programme, your state, or your board. It is kept with your account, it is included in the file you download from “Download my records”, and deleting your whole account deletes it. You can change it or remove it at any time from the same place you set it, using Remove it; removing it puts your reviews back on the fixed schedule. Note that it is part of your account rather than your study history, so deleting your study history does not remove it.

Your course schedule. Also on your account page, and also optional, you can add a course syllabus so the Study Room can show what your course covers this week. You choose the PDF or paste the schedule part; the file is read in your browser and never leaves this device, and its text is sent as soon as you press Find my weeks (section 3). Your schedule is not saved until you have checked the weeks on the next screen and pressed Save schedule; until then, the only things kept are what that request leaves: its usage record and a short-term count of your requests (section 3). What Nurseal then keeps is only what you confirmed, and when you first saved it: the name you gave the schedule, and each week’s number, dates and topic names. The file is not kept and its text is not kept. The AI is told to leave out the people a syllabus names, but check that screen: whatever is on it when you press Save schedule is what is kept. The schedule is kept with your account, it is included in the file you download from “Download my records”, and deleting your whole account deletes it. You can edit it, or delete it with Remove, from the same place; like your exam date it is part of your account rather than your study history, so deleting your study history does not remove it. It is not shared with anyone; its topics leave your account only when you use them for a practice test. The Study Room’s Make a test on it opens the test page with that week’s topics in its web address, which, like any page address, goes to Nurseal’s site and stays in this browser’s history; a topic goes on to the AI only if you pick it, and then it is sent with that test’s settings (section 3). If you press No thanks when you are asked whether you have a syllabus, Nurseal stores that you did, on your account, so that you are not asked again on your other devices.

7d. The one question we ask you

After you have answered at least one practice question, a card in the Study Room asks you where your school deadlines live right now, and offers five answers: a phone calendar, a paper planner, Canvas or your school portal, in your head, or somewhere else. There is a No thanks button beside them and it is a real answer, not a way of postponing the question. The card keeps appearing in the Study Room until you press one of its buttons, and then it stops.

What it is for, stated plainly: it is research, and it is for us. We are deciding whether to build a place in Nurseal for your school deadlines, and we would rather ask you than guess. Nothing reads your answer to change what you see — it does not affect your account, your credits, your questions, your difficulty level, or anything else about how Nurseal behaves for you.

Nurseal stores which of the six buttons you pressed and when you first answered, and nothing else. Not the name of your school, not your programme, not any deadline. If you press No thanks, that is what gets stored, so that we know not to ask again on your other devices. If your answer is sent but no reply comes back, it may or may not have reached your account. This device remembers that you answered either way, if your browser lets it store that; another device — or this one, if it could not — will ask you again only if your answer did not arrive.

It is kept with your account. It is included in the file you download from “Download my records”, and deleting your whole account deletes it. Like your exam date it is part of your account rather than your study history, so deleting your study history does not remove it. It is not sent to the AI provider, not sent to Stripe, and not shared with anyone.

8. Cookies, analytics, and tracking

Nurseal does not use advertising cookies or cross-site behavioral tracking, and runs no analytics product at all — no page-view counter, no session recorder, no third-party script that watches what you do. Nothing on any Nurseal page collects information about you across other websites, because nothing on any Nurseal page belongs to a company that operates on other websites.

What is stored in your browser is the product itself, not tracking: your sign-in session, your study history (section 2), your settings, your study-buddy conversations (section 3a), your study material (section 3b), the record of what a test was built from that lets it offer New test, same material (section 3b), any unsent feedback draft (section 7a), the address you asked for a sign-in link at, a marker from a purchase you started so the page can tell you when your credits land (section 7c), and, if you have used Nurseal signed out on this device, the signed out copy of that work until you claim it or delete it (section 3c) and whether you declined to move it; plus the small records that keep the app consistent: which account each copy of your history belongs to, where the last sync left off, the question order and the questions to come back to for each test, the test you are in the middle of, the seat you hold in a study table, so that reloading the page rejoins the room instead of taking a second seat, and which account was signed in when you took it, so that a reload offers that seat’s questions to keep only to that account — kept for as long as that tab is open, and brought back with the tab if your browser reopens it after it was closed — and, kept the same way, which question you locked in an answer for until the room confirms it arrived (the question, never the answer), so that a reload can tell you if it did not; and, kept that way too, an option you picked but had not yet locked in, so a reload gives it back to you still unlocked, and a note that the room did not count the lock you sent for a question, so a reload after that one still tells you; and, kept that way too, the notes you bring from the test-making page when you open a room from it, until they are in your notes box in the room; a marker while a delete of your study history is running, whether you signed in with an emailed code (so the account page can offer to set a password), which stage of nursing school you picked for the sample test, which also goes with each test you build, to Nurseal’s server and into the AI’s instructions, so its questions are written for that stage, and the level change that pick made, so a later pick moves your level only if you have not set it yourself since, whether you have answered the question in section 7d on this device, and whether you have already seen or turned down the short tour of the Study Room, so it is not offered again. It is there so the app works and so a test survives a dropped connection. The operator has no way to see it from outside your browser, but it is not encrypted there, so anyone using this browser could read it with the browser’s own developer tools (section 3b); and it leaves your browser only where this notice says it does: your study history to your account (section 2), your answers to a study table when you join one (section 2a), the notes you add to a study table’s build step when you add them there (section 2a), your study material and your study-buddy messages to the AI provider (sections 3 and 3a), a feedback report when you send one (section 7a), an answer that could not be saved anywhere else to the operator’s backup inbox when it is switched on (section 7), and your sign-in with every request you make to your own account (section 7). Clearing it signs you out in this browser and removes the local copy of your history; it does not ask the account system to end that session, which is what signing out does (section 3b). Your flashcards and card marks are part of your study history here and are cleared by the same local wipe.

Browser privacy signals. Nurseal does not sell your information, and does not share it for advertising or any other cross-context behavioural purpose, so there is nothing for a Global Privacy Control or “Do Not Track” signal to switch off — the behaviour those signals ask for is what Nurseal already does. A study table is the one place your study data is shared on purpose (section 2a); that is a room you open or join, not advertising, and nothing reaches a table unless you join one. If analytics, cookies, or similar technology is ever added, this notice and any required consent controls will be updated before collection begins, and this paragraph will say what changed.

9. Sensitive and health-related information

Clinical-study material and performance history may be sensitive wherever they are held — on your device or in your account. Nurseal does not ask you to enter patient data, and section 3 asks you not to. The consent you are asked for, as built: the account page asks whether Nurseal may count how you use it for its own product telemetry, records your answer as a dated receipt against the version of the wording that is current when you answer, and lets you withdraw it in the same place. Those receipts are append-only — a withdrawal is a new receipt, never an edit to an old one — and they are in the file you download (section 10). What that answer actually controls, stated because it is easy to overclaim: one thing — whether your account appears in the day-by-day usage series in the operator’s cost summary. It does not stop the per-request record in section 3 being written, because that record is what enforces the spending caps and cannot be optional. And it does not put those records out of the operator’s reach: the same narrow owner door described in section 2 can read the ledger itself. Saying no changes what is reported about you, not what is kept or who may read it. Widening what is collected still requires the review described below, before it is built.

Syncing these categories to your account needed a fresh privacy review before it was built. That review — an internal one, not a lawyer’s — is what produced the July 24, 2026 change described in section 2, and it set the limits that change ships under: only what section 2 lists is synced, with the four tracking details it names, never your study material or chat text; the records are locked to your account at the database layer, subject to the owner reads described in section 2; answers are append-only; and export and deletion controls must exist before this product is offered to anyone, which they have since July 26, 2026. Any further widening of what is stored requires the same review again, before it is built.

10. Your choices and requests

Available now: downloading the record Nurseal holds of your studying, deleting your study history, and deleting your whole account — all from the account page, described in sections 2 and 10a. The file holds your account record (your profile, your entitlement, your exam date and any course schedule from section 7b, and the one answer from section 7d), your consent receipts, your feedback and bug reports, and your whole study history. An answer still waiting in the operator’s backup inbox (section 7) is not in the file until it has been added to your account. What is not in it, and why: your study-buddy conversations, because Nurseal does not keep them — they are sent to be answered and not retained, so there is nothing on our side to hand back (section 3a); the study material kept only in this browser, because Nurseal has no server or account copy to put in the file (section 3b); your purchase records and your credit balance, which your account page already shows you and section 7c describes; the per-request usage ledger described in section 3, which is Nurseal’s accounting of what it spent rather than a record of what you studied; and the short-term count of your requests from section 3, which holds a number and when it began and nothing else. The last three are held about you, so the request route below reaches them. Also not in it: whether a dormancy warning was sent to you, and when (section 10a), which is the operator’s record of carrying out the dormant-account policy rather than a record of what you studied. It is held about you like the last three, so the request route reaches it too. Still planned: re-importing a file you downloaded.

Asking for anything the buttons do not cover. Email hello@seal-studios.com, or use the Feedback button while signed in, and say what you want. That covers a request to see what is held about you, to correct something that is wrong, to delete something, to get a copy in a portable form, or to object to a use — whether the information sits with the operator or with one of the companies in section 7. The operator will answer within 30 days. If a request cannot be honoured, you will be told why rather than simply refused. Making a request costs nothing and Nurseal will not treat you differently for having made one.

Depending on where you live, some of the above may be a legal right rather than a courtesy — for example under the California Consumer Privacy Act or the GDPR. This notice does not attempt to list which rights apply to you, because that depends on facts about you that Nurseal does not collect. The practical answer is the same either way: ask, and you will get an answer — honoured where the record is ours, and explained where it is not. The records the companies in section 7 keep on their own account are not ours to delete for you; section 7c sets out the case most likely to matter, which is Stripe’s own record of a payment.

What exists today: from the account page you can download the one file described above, and you can delete your study history. An answer still waiting in the backup inbox from before you deleted your study history is not added back afterwards (section 7), unless a device’s clock was set wrong around the delete, as section 2 describes. Deleting it is a single all-or-nothing action; there is deliberately no control for silently removing one individual answer, because a history you can edit is one your difficulty settings would be wrong about. What is still not built: re-importing a downloaded file — a study history you could edit and upload again would have the same problem as one you could edit in place.

10a. Deleting your whole account

Available since August 2026, from the account page. Deleting your account removes your sign-in, your account record (profile, entitlement and any course schedule), your consent answers, your entire study history — every question, every answer, and every correction you made to your difficulty level — every feedback or bug report you have sent (section 7a), and your credits and your purchase records (section 7c), in one action, and clears the device you did it from — including any study-buddy conversations stored in that browser (section 3a) and the study material kept with your tests (section 3b), the only places Nurseal ever kept those local copies; if clearing this device fails, the page says so: your account is gone, but some study data may still be on this device. It cannot be undone, and a new account starts from nothing. If Nurseal cannot tell whether a delete reached your account — the answer never came back — it leaves this device alone and tells you, so you can check and try again; the same is true of deleting your study history. An answer of yours still waiting in the operator’s backup inbox is not added to anything once your account is gone: it is removed the next time Nurseal checks the inbox successfully, usually within a day, and in any case after 30 days (section 7).

Your purchase records go with it, deliberately, and that decision has a reason worth reading before you delete. Nurseal does not keep a shadow copy of what you bought after you have asked to be erased — keeping personal records of a person who just asked to be forgotten, in order to look thorough, is the opposite of what deletion is for. It is safe to do because Stripe holds the authoritative record of the payment independently of us (section 7c), for as long as its own obligations require. So the money is not being erased from the world; our copy of it is. If you want your own copy of what you paid, save your card statement or your Stripe receipt before you delete — the download described in section 10 does not include your purchase records — afterwards we genuinely cannot produce it, and that is the intended behaviour rather than a limitation.

What can survive account deletion. Study material and Study Buddy conversations saved in a browser on another device are not reached when you delete from here; they can remain on that other device until you remove them there as sections 3a and 3b describe, or until the browser removes its own stored data. On this device, deleting your account also leaves alone any work done here while signed out that you chose not to move into your account (section 3c), and an unsent feedback draft (section 7a), until you clear this site’s browser data. A study table that is still running when you delete your account is not reached either: what it holds from you — the first name you gave it, the options you picked there, any notes you added to its build step, and, if you opened it, your account’s internal id and the questions of the test it is on and of any next test you picked there but have not started — stays with that table until it deletes them at one of the moments section 2a lists, and a table whose host’s page stays open keeps running, however long that is. Nurseal also keeps an internal ledger of the AI requests it paid for — when a test was built, what it cost, how many questions, at what difficulty. When you delete your account, those rows are kept but your identity is removed from them at the database layer, permanently and automatically. They are bookkeeping: they never contain your study material or your answers, a generated test is held in one only for the roughly 20 minutes section 3 describes, and after deletion they no longer say who they belonged to. They are kept because deleting them would falsify the service’s own accounting — the bills it reconciles against its AI provider would stop adding up.

Dormant accounts. Your account is kept for as long as you use it. After 24 months without a sign-in it is deleted, including any credits you have not spent — and with everything else that implies above — and one warning email is sent about 30 days beforehand to the address you sign in with. Signing in at any point keeps the account and resets the clock; that is the only step, and the warning email itself is a sign-in email. This is Nurseal’s policy, and the operator carries it out by hand: nothing deletes an account or sends that warning automatically yet.

11. Security and retention

No service can promise perfect security. Nurseal will minimize collection, restrict access, use encrypted transport, and exclude credentials and submitted study content from logs. If personal information is exposed in a security incident, the operator will tell affected users at the address they sign in with, and will say what was reached and what was done. A study table never learns who a guest is, so it holds no address for anyone who joined one as a guest. Someone who has only ever used Nurseal that way — with no account — gave Nurseal no address, so there is none to write to; if you have an account, including one you signed in to at a table to keep your answers, you are written to at that account’s address like anyone else. Section 2a says how little a table keeps about a guest, and for how long.

Retention, as built: the study history in section 2 is kept for as long as your account exists, because its whole purpose is to still be there next semester. Deleting your account removes it (section 10a), and section 10a also sets out the dormant-account policy, which the operator carries out by hand. The study material you add or paste is never retained on Nurseal’s servers, with one exception since September 19, 2026: notes you add inside a study table are held by that table until it deletes them, case by case as section 2a describes. A file you add is never even received either way, because it is read in your browser (section 3). A copy of its extracted or pasted text is kept in this browser with the test as section 3b describes, while generated tests held for the duplicate-request window (about 20 minutes, section 3) are cleared from the server automatically. Study-buddy messages pass through Nurseal to be answered and are not retained on the server; the conversation itself is kept in your browser for as long as you keep it (section 3a). The per-request usage ledger described in sections 3 and 10a is kept indefinitely as accounting. While your account exists those rows are linked to it; deleting your account removes that link permanently, and what remains is bookkeeping that no longer says whose it was. Your purchase records (section 7c) are kept for as long as your account exists and are deleted with it; Stripe’s own record of the same payment is kept on Stripe’s schedule and is outside our control. Nurseal’s own server keeps no store of passwords or sign-ins: your password, if you have set one, and your sign-in sessions are held by the account system described in section 7, and your current sign-in session is also kept in this browser, as section 3b describes. The per-request usage ledger above is the one record Nurseal keeps of each AI request. The operational logging described in section 7 is not retained: Nurseal’s server has no log retention configured, so that output exists only while someone is watching it live. Cloudflare’s own request records and Supabase’s record of your sign-ins are kept on those companies’ schedules, linked in section 7, and the operator does not control them.

12. Children and age eligibility

Nurseal's AI features are for adults 18 and older. The service is not directed to children and should not knowingly collect personal information from anyone under 18. If you answer “Yes, I’m 18 or older” before your first AI request, we save the time you said yes to your account so we only ask once. A “No” is not saved.

13. Changes and contact

Material changes will be dated and communicated through the product or another reasonable channel before they take effect where required.

Contact. Elpidio Samuel Poblano Vallejo, doing business as Seal Studios — hello@seal-studios.com, or PO Box 1714, Indio, CA 92202-1714, United States. That mailbox is monitored and is the privacy contact named in section 1.