Privacy policy

Last updated 2026-10-25

This page explains what DermaBoard stores about you, why, who else is involved, and what you can do about it. DermaBoard is run by the DermaBoard team.

What we store

• Your account: your email address, your password (only as a one-way hash we cannot reverse), your time zone, when you joined, your trial and plan dates, founding-member status, and your own invite code.
• Your study: the questions you answer and how, flashcards in your queue and how you graded them, algorithm practice, starred questions, your notes and settings. This is what makes the progress pages and spaced repetition work.
• Payments: your orders (plan, price, reference code, status). If you pay online, the payment provider's transaction reference and status. We never see or store card numbers or wallet PINs.
• Reports you send about a question or flashcard, with the reason and any words you add.
• Where you came from: if you arrive through a campaign or a colleague's invite link, that tag, so referral rewards can be given.
• Security records: failed sign-ins, new sign-ups and password-reset requests, with the email and network address (IP) they came from, deleted after a day. They stop password guessing and mass sign-ups.

The people running DermaBoard can see your email, plan, orders, where you came from and any reports you send, to confirm payments and help you. They do not see your password.

We do not use advertising or analytics trackers, and we do not sell or rent your data to anyone.

Cookies

• db_sid keeps you signed in (30 days).
• db_lang remembers the language you chose for the public pages (1 year).
• db_utm and db_ref remember a campaign or invite link until you sign up (30 days).

All are needed for the site to work as described; none is used for advertising. The app also keeps some things in your browser's own storage: your theme, your question-bank answers and the day's flashcards (so they work offline and sync later), and the app's files. Signing out clears the answers and flashcards.

Who else handles data

• Cloudflare hosts the site and its database, and keeps short-lived technical logs (such as errors and request times).
• Google Fonts serves the site's fonts, so your browser asks Google's servers for them.
• Payment providers (ZainCash, Qi Card) when you choose to pay online. If you pay by WhatsApp, the messages and receipt you send are handled in WhatsApp.
• An email service (Resend), once email is switched on, to send password-reset links.

They process data only to provide their service to us. Cloudflare's servers are in many countries, so your data may be stored outside Iraq. We may also share data if the law requires it.

How long we keep it

For as long as your account exists. When you delete your account, your account, study data, notes, reports and orders are deleted straight away; copies in Cloudflare's database backups disappear within 30 days.

Your choices

• See or correct your data: ask us, and we will send you what we hold or fix it.
• Delete your account and its data yourself from the Account page, or ask us.
• Reset your progress in the question bank from its settings without deleting the account.

Security

Passwords are hashed; sessions and reset links are stored only as hashes; the site is served over HTTPS only. No system is perfectly secure: use a password you don't use anywhere else.

Children

DermaBoard is meant for medical students, residents and doctors. It is not for children under 16.

Changes

If we change what we do with your data, we will update this page and its date first, and tell signed-in users about important changes.

Contact

• WhatsApp: +9647706338900
• Email: support@dermaboard.com