In short. Resurface stores your account, your study progress and the questions you make, plus a few records needed to run the service. There are no analytics or advertising trackers, and nothing is sold. Material you upload is sent to Google’s AI to write your questions, so do not upload anything confidential. You can delete your account, and everything in it, from Profile at any time.
Who we are
Resurface is a revision platform for UK medical students, run by a small independent team. For anything in this policy, including requests to see or delete your data, email hello@tryresurface.com.
What we store
Only what the app needs in order to work. Everything below is tied to your account.
| What | Why |
|---|---|
| Email address | To sign you in, confirm your account and reset your password. |
| Display name and profile photo | To show who you are on the leaderboard and on decks you share. The photo is optional and only ever one you upload yourself. |
| Your answers, and whether you got them right | To schedule your reviews and show your progress. |
| Review schedule, streak, daily goal, saved questions and settings | To decide what to show you next and keep the app as you set it. |
| Your decks and the questions you generate, write or edit | So they are there whenever you sign in. |
| Questions you report, and anything you write with the report | So we can fix the question. |
| Reminder settings, if you turn reminders on | The time you chose, your time zone and your browser’s push address, so we can send one reminder a day. |
We do not store your password. Sign-in is handled by Supabase, which keeps only a cryptographic hash of it. If you sign in with Google, we receive your email address and name, never your Google password, and Resurface has no access to your Gmail, Drive, contacts or calendar.
Records we keep to run the service
These never include the content of your questions or answers.
- AI usage: each time Resurface asks the AI to generate questions or explain one, we record that it happened, for which account, and how much of the AI it used. This is how we stay within our limits.
- Deck sharing: when you open someone’s share link, add their deck, or get new questions from it, we record who shared it, who received it, which deck, and when.
- Loading times: how long the app took to load for you, and whether you were on a phone or computer, so we can find what makes it slow.
What we do not collect
- No analytics or advertising trackers, on the website or in the app.
- No location, contacts or device fingerprinting.
- No health information about you. Resurface contains medical study material; it never asks for anything about your own health.
Who can see what
Your answers, scores, schedule and decks can be read only by your own account. This is enforced by the database itself, not just by the app. The exceptions are things you choose to share:
- The leaderboard. Other signed-in users see your display name, your photo if you have one, how many questions you answered this week and your streak. Never your scores or which questions you got wrong. You can leave the leaderboard at any time in Profile.
- Your profile photo. It is stored so that it can be shown on the leaderboard, which means anyone with its direct link could view it. You can remove it in Profile.
- Decks you share. Anyone with the link sees the deck, its questions and your display name, and can add a copy to their account.
- Decks Resurface features. If we feature a deck you made for everyone to use, with your agreement, all users see it with your name on it.
Resurface’s administrators can see account details (names, email addresses, when people joined and how much they use the app) to run the service, deal with reports and remove anything inappropriate. We do not look at individual answers.
The AI, and what you should not upload
When you use Generate, the material you upload or paste (Anki decks, slides, PDFs, notes or images) is sent to Google’s Gemini AI so it can write questions from it. When you use Resurface AI, the question, its options, the answer you picked and the messages you type are sent. Your name, email address and study history are never sent.
Resurface currently uses Google’s free tier, and you should know what that means: Google may use what is sent through it to improve its products, and people at Google may review it. So do not upload or type anything confidential, and never anything that could identify a real patient. Lecture slides and your own notes are fine.
Cookies
Resurface keeps one thing in your browser that works like a cookie: a sign-in token, so you do not have to log in on every visit. It also remembers small preferences on your device, such as night mode. None of this is used to track you, there are no third-party cookies, and that is why there is no cookie banner.
Who else processes your data
We use a small number of providers to run Resurface. They act on our instructions and may not use your data for their own purposes, except Google as described above.
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Accounts, sign-in, the database, and profile photos | Ireland (EU) |
| Vercel | Hosting the website, the app and its server | EU and US |
| Writing questions and explanations from what you send (Gemini), and Google sign-in if you use it | US | |
| Resend | Sending sign-in codes, confirmation emails and, if you opt in, news and study emails | EU and US |
| Your browser’s push service | Delivering reminders, if you turn them on (Google, Apple or Mozilla, depending on your browser) | Varies |
Emails
We send account emails, such as sign-in codes and confirmations, because the service needs them. News, tips and study emails are sent only if you opted in, and you can opt out in Profile or from any of those emails.
How long we keep it
For as long as you have an account. You can delete your account yourself in Profile, which removes your profile, photo, decks, questions and study data straight away. Backups are overwritten on a rolling basis and are fully cleared within 90 days. The operational records above may be kept after that, but with nothing left that links them to you.
Your rights
Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Email hello@tryresurface.com and we will reply within 30 days, free of charge. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.
Legal basis
We use your account, progress and decks because that is needed to provide the service you signed up for. We keep the operational records because we have a legitimate interest in running the service reliably and within its limits. The leaderboard, reminders and marketing emails rely on your choice to use them, which you can change at any time in Profile.
Children
Resurface is for university students and is not meant for anyone under 16. If you think a child has made an account, tell us and we will remove it.
Changes to this policy
If this policy changes in a way that affects you, we will tell you in the app, not just update the date at the top of this page.
Back to Resurface