Privacy Policy

1. Who we are

Finito Nursing ("Finito", "we", "us") is a study app for nursing students, available on iOS, Android and the web at finitonursing.com. It is operated by Forvibe LLC, a company registered in the United States, which is the data controller for the personal data described in this policy.

• Postal address: 30 N Gould St, Sheridan, WY 82801, United States
• Email: support@finitonursing.com
• Data subjects in Türkiye can also read our KVKK Privacy Notice and write to support@finitonursing.com.

This policy explains what we collect, why, who processes it for us, how long we keep it and what you can do about it. It applies to the mobile apps, the website and the API behind them.

2. What we collect

2.1 Data you give us

• Account: your email address, or the identifier Apple or Google gives us when you sign in with them. You can also use the app as a guest; a guest account has no email until you link one. We never ask for or store a password.
• Study profile: the name you choose to show, language, region, program year, study goal, school, exam date, daily study minutes and the courses you pick.
• Study content: sets and cards, quizzes and your answers, NGN case attempts, med-math exams and attempts, care plans, skills checklist runs, spaced-repetition review history and daily study counts.
• AI conversations: your messages to Finito AI and its answers, custom instructions you write for the tutor, and the documents you attach to a chat.
• Files: PDFs, images (JPEG, PNG, WebP), and Word and PowerPoint files you upload (up to 20 MB each).
• Community content: sets you share, reviews and comments you write, the author name you choose when you share, glossary drafts you publish, reports you file and users you block.
• Support messages: what you send us by email. The app's contact link pre-fills your app version, operating system, account identifier, account type and language so we can help you.

2.2 Data collected automatically

• Product analytics (mobile app): a fixed list of app events, such as opening the app, signing in, finishing onboarding, viewing the paywall, completing a purchase, sending a tutor message or finishing a quiz, linked to your account identifier. Automatic event collection is turned off.
• Analytics and advertising measurement (website): only after you accept them in the cookie banner: the same kind of product events as in the app (such as signing in, finishing onboarding, viewing the paywall, sending a tutor message or finishing a quiz), the pages you visit (the path, without what follows it), and, for Google Ads, sign-up and web purchase conversions. If you came from an ad, the ad's click identifier (gclid, gbraid or wbraid) and campaign tags (UTM source, medium and campaign) go with those events and conversions. We never send Google your account identifier or email. See section 9.
• Error reports: crash and error reports with technical context (app version, device model, operating system, the code location of the error). They are configured not to include your name, email, IP address, cookies, request bodies or AI inputs and outputs.
• Free question on the website: if you ask Finito AI one question on our home page without signing in, see section 4.
• Country: on the website, the country our hosting provider derives from your IP address is used once to show prices in Turkish lira or US dollars. We do not store it.
• Purchase data: the store or Stripe sends us the product, status and renewal date of your subscription.

We do not use advertising identifiers (IDFA or Android Advertising ID) in the apps, we do not track you across other companies' apps, and we do not collect precise location, contacts or photos from your library unless you choose a file to upload.

3. How we use your data

• To run the service: your account, syncing your sets and progress across devices, spaced repetition, quizzes, NGN cases and clinical tools.
• To run the AI features you ask for: answering your questions, turning your files into sets and quizzes, coaching care plans, explaining med-math answers and drafting glossary entries. See section 4.
• To keep the community safe: checking shared content before it goes public, handling reports and blocks. See section 6.
• To manage subscriptions and limits: granting Premium, counting free-tier usage and redeeming premium codes.
• To support you and improve the app: answering emails, fixing errors and understanding which features are used.
• To meet legal obligations: keeping billing records and responding to lawful requests.

We do not sell your personal data and we do not use your study content to advertise to you.

4. Finito AI and the permission it asks for

The AI features are provided through OpenAI's API. Before any AI feature runs, the app asks for your permission and shows exactly what is shared. Our servers check that permission before every AI request.

When you allow it, the following is sent to OpenAI (USA) to generate answers and study material: your messages, uploaded documents, photos, pasted text, the glossary terms you ask AI drafts for, and your study profile (year, goal, courses). Word and PowerPoint files are first converted to PDF by CloudConvert.

• We send our requests with OpenAI's storage option turned off where the API offers it, and OpenAI does not use API data to train its models. Under OpenAI's API terms, it may keep request data for a limited period (generally up to 30 days) to detect abuse.
• With each request we send a one-way hash of your account identifier, which helps OpenAI detect abuse without knowing who you are.
• Before a care plan is sent for coaching, the app removes names, numbers and other identifiers it can detect.
• Chats stay in your account until you delete them.
• Never type or upload patient names, ID numbers, record numbers or files that contain them. Finito is a study tool, not a clinical record.

You can withdraw this permission at any time in Settings ("AI data sharing"). Until you allow it again, the AI features stay off; your chats, notes and sets stay in your account.

One free question without an account (website). On our home page you can ask Finito AI one question without signing in. Your question is sent to OpenAI (USA) to write a single answer, with no tools, no files and OpenAI's storage option turned off. To allow one free answer per visitor, your IP address is turned into a one-way hash (SHA-256); only that hash is kept, in Upstash, for 24 hours as a rate-limit key, and the same hash is sent to OpenAI as a safety identifier. Your IP address itself, your question and the answer are not stored by Finito. The answer is kept only in your browser tab (session storage) so the page can show it, and a guest_chat_used cookie marks that the free answer was used. Nothing else about you is collected.

Separately from this permission, content you choose to publish to the community (shared sets, reviews and glossary drafts) is checked by OpenAI's moderation service before it goes public.

AI answers can be wrong. They are study aids and are not medical advice; see our Terms of Use.

5. Legal bases (EEA, UK and similar laws)

• Contract: to provide the account, study features and subscriptions you signed up for.
• Consent: for the AI features (section 4) and for website analytics and advertising cookies (section 9). You can withdraw consent at any time without affecting earlier processing.
• Legitimate interests: to keep the service secure, moderate community content, fix errors and understand feature use in the apps, balanced against your rights.
• Legal obligation: to keep billing records and answer lawful requests.

6. Community features

You can share a set with other students, review shared sets and publish glossary drafts. Shared content shows the author name you choose at share time, or no name. Your profile name and email are never shown.

• Before a set or review is published, it is checked for personal data such as names and numbers and sent to OpenAI's moderation service. Content that fails is not published.
• Anyone using the app can report content. Reports are reviewed by us; content can also be hidden automatically once enough accounts report it. Report details are scrubbed of personal data before they are stored, together with a redacted snapshot of the reported content.
• You can block the author of a set or review; their content is then hidden from you.

See the Community Guidelines for the rules.

7. Who processes your data

We use the following service providers. Each processes data only to provide its service to us.

We may also disclose data when the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of the business, in which case this policy continues to apply to your data.

8. International transfers

Our main database and storage are in the European Union. Some providers (such as OpenAI, RevenueCat, Stripe, Google and Sentry) process data in the United States or other countries. Where the law requires it, these transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under the EU–US Data Privacy Framework. For transfers from Türkiye, see the KVKK Privacy Notice.

9. Cookies and similar technologies

The website uses:

• Strictly necessary cookies: sign-in session cookies and a language cookie (NEXT_LOCALE, one year) for the signed-in app.
• Functional cookie: guest_chat_used (one year) remembers that this browser used its free question on the home page. It is not used for tracking.
• Local and session storage: your theme choice, panel sizes, your cookie choice and the answer to a free guest question, which never leave your browser.
• Analytics and advertising cookies: Mixpanel (a random browser identifier in local storage), Google Analytics and Google Ads conversion tags (the _ga and _gcl cookies), which load only after you accept them in the cookie banner. Nothing is sent to them before you answer, and declining is as easy as accepting. You can change your choice at any time: Cookie settings at the bottom of our pages, or Privacy in Settings in the app. If you withdraw consent, they stop, and we delete the browser identifier and the Google cookies the page can reach.
• Ad attribution cookie: if you arrive from an ad, its click identifier and campaign tags are kept in your browser tab (session storage). Only after you accept analytics are they saved in a first-party finito_attribution cookie (90 days), so a sign-up or purchase on a later visit can be credited to the ad. Declining or withdrawing consent deletes it.

The mobile apps do not use cookies. They store your session and an offline copy of your study data on your device.

10. How long we keep data

• Your account and study content are kept while your account exists. Deleting your account deletes them at once; see Delete your account.
• Items you delete (a set, a chat, a document) are deleted when you delete them, including their stored files.
• Documents stay until you delete them or your account.
• Free guest question: the hashed IP address is kept for 24 hours; the question and answer are not stored by us.
• Guest accounts are kept until you delete them, so you can still link an email later.
• Converted files at CloudConvert are deleted right after conversion, and automatically within 24 hours at the latest.
• Reports: closed reports are deleted or redacted after 180 days, and deleted once the reported content is gone.
• Share and demand counters used against spam are deleted after 7 days; glossary search counters after 90 days of inactivity.
• Billing records (purchase and renewal events) are kept after account deletion, as tax and accounting rules require.
• Shared content: sets you shared are removed from the community when you delete them or your account. Students who imported a copy keep their copy. Glossary drafts you published stay public without your name.
• Analytics and error data are kept under the retention settings of Mixpanel and Sentry.

11. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, KVKK or US state laws such as the CCPA), you may have the right to:

• access your data and get a copy of it;
• correct inaccurate data (you can edit your profile in the app);
• delete your data (you can delete your account in the app);
• object to or restrict certain processing;
• withdraw consent (AI data sharing in Settings; cookies through Cookie settings at the bottom of our pages or Privacy in Settings);
• receive your data in a portable format;
• complain to your local data protection authority.

We do not sell or "share" personal data for cross-context behavioral advertising as defined in California law, other than website advertising measurement you consent to.

To use a right, email support@finitonursing.com from the address on your account, or include your account identifier from the app's contact link. We answer within 30 days and may ask you to confirm your identity.

12. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting providers. Files are kept in private storage that only your account can access. Our staff access personal data only when needed to run the service or answer a request. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

13. Children

Finito Nursing is made for nursing students and is not directed at children. You must be at least 16 years old to use it. If we learn that a child under 16 has given us personal data, we will delete it. If you believe this has happened, contact support@finitonursing.com.

14. Changes to this policy

We may update this policy as the app changes. The date at the top shows the latest version. If a change is significant, we will tell you in the app or by email before it takes effect.

15. Contact

Forvibe LLC, 30 N Gould St, Sheridan, WY 82801, United States

Email: support@finitonursing.com. For KVKK applications: support@finitonursing.com.