Privacy Policy
How balansd collects, uses, and safeguards your data as a calm, adaptive study instrument.
Last updated: September 10, 2026
Our Core Privacy Commitment
balansd is engineered to relieve academic stress, not to harvest personal data. We will never sell, rent, or trade your personal information, email address, or study records to third-party advertisers or data brokers.
1. Data Controller & Introduction
balansd ("we", "our", or "us") provides an adaptive exam planning platform designed to help students balance study goals around realistic schedules. This Privacy Policy explains how personal data is collected, processed, and protected when you visit our website (balansd.app), join our waitlist, or interact with our services.
Data Controller: The party responsible for your personal data is the balansd project team (contact: [email protected]). Upon completion of formal corporate incorporation, this policy will be updated with the registered corporate entity name and address.
2. Scope: Pre-Launch Waitlist & Future Beta Application
Phase 1: Pre-Launch Waitlist (Current Scope)
Currently, our active website processes only the minimal data required to organize early access cohorts:
- Contact Information: Your voluntarily submitted email address.
- Exam Track Preferences: Your selected exam path (e.g., USMLE Step 1, IELTS Academic, MCAT, CFA Level I, or semester finals) used to organize cohort rollouts.
- Technical Telemetry: Approximate country code (derived from network headers), submission timestamp, user-agent string, and Cloudflare Turnstile bot verification tokens.
Phase 2: Beta & Full Application (Upcoming Scope)
When the interactive study planner launches, the platform will collect more granular academic information to generate adaptive schedules:
- Study Workload Targets: Material volume (such as textbook page counts, lecture series, or question bank modules).
- Availability Constraints: Realistic weekday study hours, lighter weekend sessions, and scheduled days off.
- Session Records & Timers: Completed study durations and timetable recalculation triggers.
All study data will be processed exclusively to calculate your personalized study pacing and will never be shared with exam testing bodies or commercial advertisers.
3. Legal Bases for Processing (GDPR Article 6)
Under the European General Data Protection Regulation (GDPR) and UK GDPR, our current waitlist processing relies on the following lawful bases:
- Consent (Art. 6(1)(a) GDPR): When you submit your email to join the waitlist, agree to receive occasional updates about balansd, or choose to accept optional analytics cookies via our cookie banner. You may withdraw your consent at any time.
- Legitimate Interests (Art. 6(1)(f) GDPR): For maintaining website stability, protecting waitlist forms from automated spam (Cloudflare Turnstile), enforcing rate limits, and troubleshooting server errors.
Upcoming Beta Note: Once beta onboarding begins, processing related to account provisioning and service delivery will also be based on pre-contractual steps and contractual necessity (Art. 6(1)(b) GDPR).
4. Third-Party Service Providers
We work with trusted infrastructure and service providers to support our website, security, and email communications:
Manages waitlist subscriber lists, opt-in consent for devlogs and updates, and delivers automatic confirmation and cohort update emails.
(Google Ireland Limited / Google LLC) Used to store and review waitlist entries in a spreadsheet for cohort planning and organization.
(Cloudflare, Inc.) Provides edge CDN asset delivery, DDoS mitigation, and Cloudflare Turnstile bot verification to protect signup forms from spam without behavioral tracking.
(Google Ireland Limited / Google LLC) Measures aggregated website navigation under Google Consent Mode v2. Analytics cookies are strictly disabled until you explicitly opt in.
Our SvelteKit application is deployed on containerized Node.js runtime infrastructure. Server hosting providers process transient network request logs (IP addresses, request timestamps, and user agents) strictly for server stability and threat prevention.
5. International Data Transfers
Our service providers (including Google and Cloudflare) operate globally and may store or process data in the United States and other countries outside the European Economic Area (EEA) or the United Kingdom.
Where personal data originating in the EEA or UK is transferred to countries that have not received an adequacy decision, our providers rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemental security safeguards, and certifications under the EU-U.S. Data Privacy Framework (DPF) where applicable.
6. Cookies & Tracking Technologies
We use a minimal set of cookies and local storage items, categorized into essential and analytics technologies:
- Essential Storage (Always Active): A local storage entry on your device to remember your cookie consent decision, alongside transient Cloudflare Turnstile tokens used to ensure form submissions originate from human users.
- Analytics Cookies (Google Analytics 4 — Opt-In): If you choose "Accept" on our cookie banner, Google Analytics sets cookies to help us understand aggregated traffic trends. Under Google Consent Mode v2, analytics storage remains disabled by default until you grant consent.
We do not deploy third-party cross-site behavioral advertising cookies, retargeting pixels, or commercial advertising beacons.
7. Data Retention
We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy:
- Waitlist Subscriptions: Retained for the duration of the pre-launch and early access beta period. If you click "unsubscribe" in any email we send, your email address is immediately suppressed from future mailings, and we delete your contact record upon request or once cohort communications conclude.
- Server Request & Security Logs: Transient network logs (containing IP addresses and request timestamps) are kept for a limited period strictly for security diagnostics, rate limiting, and spam prevention, after which they are routinely rotated and overwritten.
- Google Analytics Event Data: Retained in accordance with Google Analytics 4 standard event retention settings (up to 14 months), after which user-level records expire automatically.
8. Your Privacy Rights (GDPR & International Standards)
Under the GDPR, UK GDPR, and similar international privacy frameworks, you have specific rights regarding your personal data:
- Right of Access (Art. 15 GDPR): Request a copy of the personal information we hold about you.
- Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete contact records.
- Right to Erasure / Deletion (Art. 17 GDPR): Request deletion of your email address from our waitlist, spreadsheets, and databases at any time.
- Right to Restriction of Processing (Art. 18 GDPR): Request that we restrict the processing of your data while an issue is evaluated.
- Right to Data Portability (Art. 20 GDPR): Request your data in a structured, commonly used, and machine-readable format.
- Right to Object (Art. 21 GDPR): Object at any time to processing based on legitimate interests.
- Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw marketing consent at any time using the one-click unsubscribe link in any email we send.
- Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a competent supervisory authority in your country or state of residence (such as your national Data Protection Authority in the EU/EEA, or the ICO in the UK).
To exercise any of these rights, contact us at [email protected]. We respond to verified requests promptly and free of charge.
9. California Privacy Rights (CCPA / CPRA Notice)
For California residents, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides specific privacy rights:
- The right to know what personal information has been collected and how it is used.
- The right to request deletion of your personal information.
- The right to correct inaccurate personal information.
- The right to freedom from discrimination for exercising your privacy rights.
Do Not Sell or Share My Personal Information
balansd does not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising.
10. Minimum Age & Children's Privacy
To comply with international child privacy standards (including the U.S. Children's Online Privacy Protection Act "COPPA" and Article 8 of the EU GDPR / GDPR-K):
- Minimum Age Requirement (16+): You must be at least 16 years old to use this website, submit your email address to the waitlist, or use any part of the service.
- Prohibition Under 16: We do not knowingly collect, solicit, or maintain personal data from anyone under 16 years of age. If we discover that personal data from an individual under 16 has been collected, we will delete it promptly upon notification.
11. Data Security & Incident Notification
We implement industry-standard technical and organizational safeguards, including HTTPS encryption for all data in transit, rate limiting, and restricted access controls for organizers.
Incident Notification: In the event of a confirmed security incident or personal data breach that impacts your personal information, we will notify affected individuals and relevant regulatory authorities without undue delay, in accordance with applicable data protection laws.
12. Changes to This Privacy Policy
We may update this Privacy Policy periodically as new features, tracks, or legal requirements develop. Material modifications will be posted on this page alongside an updated revision date.
13. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: