Privacy

When you use The Bone Room, it keeps a record of your progress in your browser’s local storage: which bones you have met, how far along each one is, your settings, and a history of your examinations. That record stays on your device unless you sign in, at which point the app keeps a copy with your account, as described below.

You can export the whole record as a file at any time from the app’s Records and Privacy screens, and you can clear it from the same place. Clearing your browser’s site data removes it too, and without an account I cannot recover it for you, because I never had it.

An account exists so a copy of your progress can follow you: it lets you carry on after a cleared browser or on a new device, and pick up on your laptop what you started on your phone. Signing in means typing your email address and then a one-time code emailed to you. There is no Bone Room password to create or remember.

When you are signed in, the app keeps one copy of your progress record against your account, together with a revision number and timestamps that let two devices agree on which copy is newer. That is everything the app itself stores against your account: your email address, your progress record, and that revision data. The services underneath it keep their own technical logs, which the next paragraph describes.

Accounts and the cloud copy are hosted for me by Supabase, in a data center in the European Union. Supabase keeps its own authentication logs, which record sign-in events along with the time, your IP address and the browser you used. The sign-in emails go out through Resend, from an address on lab.boneroom.app. I have set Resend to send from its European region, but that setting governs where the mail leaves from, not where the records are kept: Resend stores its data, including a delivery log holding your address, in the United States, normally for 30 days. Beyond that address and the code it delivers, Resend handles nothing of yours. The database’s row-level security rules are written so that a signed-in user can read and write only their own record.

Right now, signing in is the only thing your address is used for. I do not send newsletters or reminders, and I never sell, rent or share your address. If I ever add optional reminder or news emails, you will be asked before receiving any, and this page will say so first.

This site uses Google Analytics 4 to see which pages are read, how people arrive, whether the Start learning button gets clicked and whether the specimen on the home page gets answered, and only after you have agreed on the banner. Until you do, nothing from Google loads, no cookie is set and no visit is sent. If you agree, Google sets cookies whose names begin with _ga, kept for up to 13 months, and records your visit. The service is provided by Google Ireland Limited, and the data may be processed by Google LLC in the United States under the EU-US Data Privacy Framework. Google states that Google Analytics 4 does not log or store IP addresses. I use the reports to see which pages are useful; nothing is sold or shared for advertising, and the site shows none.

You can change your mind at any time with the Cookie settings link at the foot of every page. Saying no removes the analytics cookies from this browser, and the choice itself is kept in your browser for a year so you are not asked again.

The app at /lab follows the same answer, because it is the same site and the same stored choice. If you said yes, it reports five things and no more: that the lab was opened and roughly how many days you have used it, that an examination started and how many specimens were on the bench, that one finished and how many findings it confirmed, that a review was survived, and any error the app hits. They are counts. No bone, no answer, no score and no identifier of mine ever leaves your device, so nothing in the reports can be tied to you or joined up between visits. If you said no, or were never asked because you opened the lab directly, it sends nothing.

When you are signed in to the app, your browser keeps a sign-in token in local storage so you do not have to type a code every time, and signing out removes it.

From the app’s Privacy screen you can export your records as a file, delete the cloud copy while keeping your account (which also signs you out, so the copy is not quietly rebuilt), or delete your account permanently. Deleting the account removes your email address and your cloud record straight away, and the database is on a plan with no automated backups, so there is no separate copy of either left behind. The one thing that outlasts it is Resend’s delivery log for any sign-in email already sent, which ages out after about 30 days. Whatever is on your device stays there until you clear it.

I keep account data for as long as you have an account and no longer. You also have the rights that data protection law gives you, including to see what I hold, to correct it, to have it deleted, to take it with you, and to complain to a supervisory authority. To exercise any of them, or to ask a question, send me a message, or write to the postal and email address on the Impressum page.

The responsible party (Verantwortlicher) under data protection law is Ichor Ventures UG (haftungsbeschränkt), Curienstraße 2, 20095 Hamburg, Germany. Its full details are on the Impressum page.

If you send a correction or a note through the contact page, I receive the reason you chose, the message itself, and your email address if you added one so that I can reply. The slip is delivered to my mailbox by Resend, the same service that sends the sign-in emails, so a copy sits in its delivery log for about 30 days, as described above. I keep the message for as long as it takes to deal with it, and a reply address is used for the reply and nothing else.

To keep the form from being flooded, the server counts submissions per network address for a few minutes and keeps nothing of that count beyond them.

The Bone Room is meant for people aged 16 and over, and I do not knowingly hold an account for anyone younger. If you think I do, tell me and I will remove it.

If this policy changes, the date at the top changes with it and I will describe what is different rather than quietly swapping the text.