In short
We hold your email address, your saved searches, your notification preferences and a billing reference from Lemon Squeezy — and essentially nothing else. There is no password, because you sign in by email link or with Google. We never see your card details. There is no advertising on this site. We use Google Analytics to see how the site is used, without your email address or account, and you can switch it off below. If you post a vacancy we also hold your name, role and the posting; if you list on the swap board, your listing, which names nobody. Another resident gets your email address only when you both agree to be introduced. You can delete everything yourself from your dashboard.
This summary is for orientation only. The numbered sections below are the agreement.
1. Who is responsible for your data
ResidencySpot, based in Dhaka, Bangladesh, is the data controller for the personal data described here. Contact: support@residencyspot.com.
2. What we collect
Only what the service needs to work. The complete list of personal data we hold about an account is:
- Your email address. Required to create an account, sign in, and send alerts.
- Sign-in tokens and sessions. A hashed one-time token while a sign-in link is valid, and a session record while you stay signed in.
- Your Google account ID, only if you sign in with Google: the number Google uses for your account, so we recognise you next time. We ask Google for your email address and nothing else — not your name, photo or contacts.
- Your saved searches. The specialty, state, track and institution you chose to follow.
- Your notification preferences, and a record of which positions we have already alerted you about, so you are not told twice.
- A billing customer reference issued by Lemon Squeezy, plus your plan, subscription status and renewal date.
- If you post a vacancy for a program: your name, your role and your work email address, which only we see and use to review the posting and write to you about it; and the posting itself, including any contact name, email address and phone number you give for applicants, which is shown to signed-in subscribers once the posting is listed.
- If you list on the swap board: the specialty, program year, state and optional city of the position you hold, where you would move, and an optional note. These are public and say nothing about who you are. Your program’s name, if you give it, is not public. We also keep the swaps you propose and the answers to them.
- If you build a Program Match profile: whether you are a US or international graduate, your specialty, the visa you need, your graduation year, your Step 2 CK score if you give it, whether you passed each Step first time, and the states you chose. It ranks programs for you and is never shown to anyone; signed out, it stays in your browser only.
- If you practice an interview: the specialty or program you chose, what you write about yourself to make the questions yours, the text of your answers, and the report written from them. A spoken answer is turned into text and the recording is discarded straight away; it is never stored. Your camera picture, if you turn the camera on, never leaves your browser.
3. What we deliberately do not collect
Some of the most sensitive things a site like this could hold are absent by design, not by omission:
- No password. You sign in with a one-time email link or with your Google account, so there is no password for us to store or for anyone to steal.
- No card or bank details. These go directly to Lemon Squeezy LLC, our merchant of record. We receive only a customer reference and the subscription's status.
- No name, postal address, phone number, CV, medical licence number or any application material from a candidate, beyond what you choose to write about yourself in interview practice. The one place a name is asked for is the vacancy form, of the person posting for a program.
- No advertising. There is no advertising pixel on this site, we do not build advertising profiles, and nothing you do here is used to show you ads anywhere.
4. Analytics
We use Google Analytics to see how the site is used: which pages are opened, where visitors arrive from, and which buttons are pressed on the way to creating an account or subscribing. We use it to find the places where the site is confusing or gets in the way.
It is not used for advertising. Google's advertising features (Google signals and ad personalisation) are switched off for this site.
- What it records. The pages you view and the address you came from, presses on a few buttons (opening the pricing page, starting to sign in, starting a checkout), whether a locked section was on your screen, your browser and device type, and an approximate location worked out from your IP address, which Google Analytics does not store.
- What it is never sent. Your email address, your account, your saved searches, or anything you type. Analytics does not run at all on the pages that carry a sign-in or unsubscribe link.
- Where you are asked first. In the European Economic Area, the United Kingdom and Switzerland, analytics runs only if you allow it. You are asked once, at the foot of the page, and until you say yes nothing is loaded from Google Analytics or sent to it. To know whether to ask, the site checks which country your request comes from; the country is not stored.
- Global Privacy Control. A browser that sends this signal is treated as having said no, unless you choose to allow analytics.
- Your choice. Analytics is on for this browser. You can also reopen the question at any time with “Cookie settings” at the foot of every page. Your answer is kept in your browser’s local storage, not in a cookie, and saying no removes the Google Analytics cookies.
6. Why we process it, and on what basis
We do not sell personal data, we do not share it for advertising, and we do not use it to train machine-learning models.
- To provide the service you signed up for — your account, subscription and gated content. Basis: performance of a contract.
- To send position alerts and the daily digest you asked for. Basis: performance of a contract, and consent you can withdraw at any time.
- To write to you about your own account: a welcome when you first choose what to follow, and in its first month at most two short notes: a reminder if you have not chosen a specialty yet, and what Premium would add for the specialties you follow. Basis: legitimate interests; one click on the unsubscribe link in any of them stops all of them.
- To take payment and prevent fraud. Basis: contract and legitimate interests.
- To keep the site secure and working, including rate limiting. Basis: legitimate interests.
- To understand how the site is used and improve it, through analytics. Basis: legitimate interests, and in the European Economic Area, the United Kingdom and Switzerland your consent, which you can withdraw at any time.
- To review and list a vacancy you post, and to tell you where it stands. Basis: performance of a contract, and legitimate interests in listing only real positions.
- To show your swap listing, match it with others and introduce you to a resident you agree to meet. Basis: performance of a contract. Your email address is given to another resident only on your own yes, or theirs to a proposal you sent.
- To run the mock interviews you start: to transcribe your spoken answers, ask the next question and write your report. Basis: performance of a contract.
7. Who else receives it
We use four processors. Each receives only what it needs to do its job.
If you choose to sign in with Google, Google confirms your email address to us under its own privacy policy. Signing in sends Google nothing about you. Google Analytics, a separate Google service described under Analytics above, receives the pages viewed on this site, without your email address or account.
Lemon Squeezy LLC is the merchant of record for your subscription, which means it sells it to you and is responsible for the tax on it. It collects your payment details, and whatever billing country or tax information it needs to invoice you, directly from you and under its own privacy policy. We never see any of it.
Two things reach other users, each because you chose it. The contact details in a vacancy you post are shown to signed-in subscribers, for applying to that position. And on the swap board, when you and another resident agree to be introduced, each of you is sent the other's email address and, if it was given, program name. Nothing else about your account is shown to anyone.
- Cloudflare, Inc. — Hosting, content delivery, the database that stores your account, and the AI models that run interview practice: they transcribe your spoken answers, speak the questions and write your report. Privacy policy
- Lemon Squeezy LLC — Payment processing and subscription billing, as merchant of record. Card details go to Lemon Squeezy and are never sent to, or stored by, us. Privacy policy
- Amazon Web Services, Inc. (Amazon SES) — Delivery of sign-in links, position alerts and the daily digest. Privacy policy
- Google LLC (Google Analytics) — Website analytics: pages viewed and a few button presses, without your email address or account. Privacy policy
8. Where data is held, and for how long
- Account data is stored in Cloudflare D1. Cloudflare operates globally, so data may be processed outside your country under its standard safeguards.
- Sign-in tokens expire after 15 minutes and are deleted once used.
- Sessions expire after 30 days.
- Account data is kept until you delete your account. Deletion removes your email, saved searches, sessions and notification history, your swap listing with every proposal that named it, your mock interviews, and the vacancies you posted, whose listings close. You can also delete any one interview yourself, which erases its answers and report at once.
- A vacancy posted without confirming its email address is deleted after seven days. A swap listing leaves the board after 120 days unless you keep it, and a posted vacancy after 60.
- Records that must be kept for tax or accounting reasons — an invoice, for example — are held by Lemon Squeezy LLC under its own retention rules, not by us.
9. Your rights
You can exercise most of these yourself, immediately, without asking us:
- Delete everything. Your dashboard has a delete-account control that removes your personal data from our database. Step-by-step instructions, and how to ask us to do it if you can’t sign in, are on the data deletion page.
- Stop emails. Every email except a sign-in link you asked for carries a one-click unsubscribe link, and preferences are in your dashboard.
- Access, correct, export or object. Email support@residencyspot.com and we will respond within 30 days.
- Depending on where you live you may also have the right to complain to a data protection authority.
10. Position listings and personal data
Listings are collected from public career pages and society vacancy boards. Some include a program coordinator's work contact details, which the program itself published for applicants to use.
We show those details to subscribers for the purpose the program intended: applying to that position. They may not be used for bulk email or marketing.
If you are named in a listing and want it corrected or removed, we will do so promptly and will not ask you to justify the request.
- Correction and removal: support@residencyspot.com, or use our contact form. We act on these promptly, and you do not need to explain why.
11. Children
The service is for qualified physicians and physicians in training, and is not directed at anyone under 18. We do not knowingly collect data from children.
12. Changes and contact
If we change this policy materially we will email account holders before it takes effect.
Questions, requests or complaints go to support@residencyspot.com.