Privacy Policy

1. Who we are

BioGrove is a free, independent website for people who love science: plain-language science news and practice questions built around the MCAT and early medical school. It lives at biogrove.org, with an installable app at biogrove.org/app. In this policy, “BioGrove”, “we” and “us” mean the people who run the site, and “you” means anyone who uses it.

This policy covers the website, the app and the community features (accounts, profiles and discussions). It explains what information is involved, why, and what you can do about it. It works together with our Terms of Use.

2. Using BioGrove without an account

Reading Science News, using Practice and earning rewards all work without an account. In that case, BioGrove saves what it needs only in your own browser (in its local storage), and none of it is sent to us:

• the name you type in, if you add one;
• your daily goal and your light or dark theme;
• your practice progress: XP, streaks, scores by topic, badges, rewards and any custom practice questions saved in it;
• if you opened the “Join” screen, whether you passed the age check. Your birth month and year are never saved.

Anyone who uses the same browser on the same device can see this guest progress. “Reset progress” in the profile menu erases it, and so does clearing this site’s data in your browser settings. The app at biogrove.org/app shares the same guest progress on that device.

3. If you join the community

Joining is optional. It lets you comment on stories and keep your practice progress on every device. You sign in with your Google account. BioGrove doesn’t use passwords, so it never sees or stores one.

Before you join, BioGrove asks for your birth month and year to check that you’re 13 or older. The date is checked in your browser and is never saved or sent anywhere. If you pass, BioGrove keeps only the fact that you passed and when.

If you join, this is what BioGrove keeps, who can see it, and why:

Your learning stats (XP, rank, badges and scores) are never shown on your public profile or next to your comments.

4. What reaches our servers automatically

Like every website, BioGrove can’t send you a page without receiving your browser’s request. Each request carries your IP address, your browser and device type, the page asked for, and the time. Our host, Cloudflare, uses this to deliver the site and to block attacks. BioGrove doesn’t use it to identify you, build a profile of you or follow you around the web.

• No analytics. BioGrove doesn’t count or follow visitors today. If we ever start counting visits, we’ll use a cookieless counter that doesn’t identify anyone, and we’ll update this policy and the fine print first.
• No ads and no ad trackers, and no social-media “like” buttons or pixels.
• Latest from Harvard. Your browser asks BioGrove’s own server for the headlines, and our server collects them from Harvard’s public news feeds. Nothing about you is passed to Harvard. If you click a headline, you go to Harvard’s site, and its privacy policy applies there.

5. Other services your browser contacts

A few parts of BioGrove load from other companies’ servers. When that happens, those companies receive your IP address and basic browser information, and their own privacy policies apply:

• Google Fonts supplies the typefaces on every page. Google’s privacy policy
• YouTube plays the videos on some Science News stories. BioGrove uses YouTube’s privacy-enhanced mode (youtube-nocookie.com), but the player still loads from YouTube when you open a story that has a video, and YouTube may store information on your device once you play it. Google’s privacy policy
• Google Sign-In handles signing in. When you choose “Continue with Google”, you leave BioGrove for Google’s own sign-in page, and Google then tells BioGrove the details listed in section 3.
• Supabase runs BioGrove’s community database and sign-in service. Your browser connects to it when you sign in, when your progress syncs, and when a story’s discussion loads. That last one happens even if you don’t have an account. Supabase’s privacy policy

Stories link to the original research and news reports, and the fine print links to photo sources. Other sites have their own privacy practices, so check their policies when you visit them.

6. How we use information

We use the information above only to:

• run BioGrove and its features: sign you in, show your profile and comments, and keep your progress in sync;
• keep the community safe: enforce posting and report limits, handle reports, hide or remove posts that break the rules, and suspend accounts when needed;
• protect the site and its users from spam, abuse, attacks and fraud;
• answer you when you write to us, and handle privacy and copyright requests;
• find and fix problems;
• comply with the law.

We don’t sell your information, show you ads, build advertising profiles, send marketing email, make automated decisions about you that have legal or similar effects, or use what you share with BioGrove to train AI models.

7. Who we share it with

• Everyone, for what you make public: your profile and your comments.
• Moderators, who can see reports and hidden comments so they can enforce the community rules.
• Service providers that run BioGrove for us: Supabase (database and sign-in), Cloudflare (hosting, web address and security) and Google (sign-in). They handle information only to provide their services, under their own terms and privacy commitments.
• When the law requires it, or to protect people. We may share information if a valid legal process requires it, or if we believe in good faith that it’s needed to protect someone from serious harm, or to protect BioGrove and its users from fraud or abuse.
• If BioGrove changes hands. If BioGrove is ever transferred to someone else, its information would go with it. The new owner would have to keep following this policy, or tell you about any change first.

We never sell your personal information or share it for targeted (“cross-context behavioral”) advertising, and we haven’t done so in the past 12 months.

8. Cookies and browser storage

BioGrove doesn’t set cookies. It uses your browser’s local storage, which stays on your device, for the guest progress and settings in section 2, the age-check result, and, if you sign in, what keeps you signed in and your account’s copy of your progress.

Other services may use their own cookies. Google does when you sign in on its page, and YouTube may when you play a video. Our host, Cloudflare, may set a strictly necessary security cookie to protect the site from attacks.

BioGrove doesn’t track you across other websites, so there’s nothing for a browser’s “Do Not Track” or Global Privacy Control signal to turn off. If your browser sends either signal, we treat it as a request to opt out of any sale or sharing, which we don’t do anyway.

9. How long things are kept

• In your browser: until you press “Reset progress”, clear this site’s data, or delete your account (which also removes your account’s copy from that device).
• Your account: for as long as you have it. When you choose “Delete account”, BioGrove immediately erases your account, email address, the details Google shared, your profile, your comments, the replies other people wrote under your comments, the reports you sent, your blocks, your progress, your age-check record and your posting log.
• Comments you or a moderator delete are erased right away, along with the replies under them.
• The posting log clears out entries older than two days whenever you post again, and is erased completely when you delete your account.
• Backups and logs. Our providers may keep backup copies and security logs for a limited time before they’re overwritten. We don’t restore deleted accounts from backups, except to recover from a technical failure.
• Email you send us is kept only as long as we need it to deal with your message and keep a record of requests we’ve handled.

10. Your choices and rights

Things you can do yourself, any time

• Use BioGrove without an account.
• Erase guest progress with “Reset progress”, or clear this site’s data in your browser.
• Edit your profile, and edit or delete your comments.
• Delete your account from the profile menu. It takes effect immediately and can’t be undone.

Things you can ask us to do

Email [email protected] to ask for a copy of the information BioGrove has about you, to correct it, or to delete it. We’ll first confirm that the account is yours, usually by asking you to write from the email address on the account, and we’ll answer within 45 days. If we can’t do something you ask, we’ll explain why.

Depending on where you live, for example in California, Colorado, Connecticut, Virginia or another U.S. state with a privacy law, or in the European Economic Area or the United Kingdom, the law may give you rights to know, access, correct, delete or receive a copy of your personal information. It may also let you opt out of its sale, targeted advertising or profiling, which BioGrove doesn’t do. You can use these rights through the email above, or through someone you’ve authorized to act for you. We won’t treat you differently for using them.

If we turn down a request, you can appeal by replying to our answer with “Appeal” in the subject line. If you’re still not satisfied, you can contact your state attorney general or, outside the U.S., your data protection authority.

11. Children and teens

The BioGrove community isn’t for children under 13, and we don’t knowingly collect personal information from them. Everyone sees the same neutral age question before joining. Anyone who gives a birth date under 13 can’t join, and that answer is remembered in their browser. If we learn that an account belongs to a child under 13, we delete it. A parent or guardian who believes their child has joined can email us, and we’ll delete the account.

Reading and Practice don’t need an account. Used that way, BioGrove itself receives no personal information, only the technical request details in sections 4 and 5. BioGrove is meant for readers 13 and older. Anyone under 18 should use it with a parent’s or guardian’s permission.

For members aged 13 to 17: your profile and comments are public, so use a first name or a nickname, never your full name, and never post your school, address, phone number or other personal details. A parent or guardian can ask us to delete a teen’s account at any time.

12. How information is protected

• Every page is served over an encrypted connection (HTTPS), and browsers are told never to use an unencrypted one.
• The database checks every request against rules that let each person read and change only their own private information. Only moderators can read reports, and the moderator list, suspensions and the posting log can’t be read through the site at all.
• Signing in goes through Google, so BioGrove never handles a password.
• Only BioGrove’s administrators can reach the dashboards that hold the data.

No website can promise perfect security. If a breach affects your information, we’ll tell you and the authorities as the law requires. If you find a security problem, please email us before telling anyone else, so we can fix it.

13. Where information is processed

BioGrove is run from the United States. The community database is stored in the eastern United States (Virginia). Cloudflare delivers pages from data centers around the world, close to whoever is visiting. If you use BioGrove from outside the U.S., your information is transferred to and processed in the U.S., where privacy laws may differ from yours.

If you’re in the European Economic Area or the United Kingdom, we rely on these legal bases:

• contract, to provide the account and community features you ask for;
• legitimate interests, to run, secure and moderate BioGrove;
• consent, where the law requires it. You can withdraw it at any time by deleting your account;
• legal obligation, where the law requires us to keep or disclose something.

14. Changes to this policy

If BioGrove starts doing something new with information, we’ll update this page and its date first. For a significant change, we’ll also put a notice on the site before the change takes effect. If you’d like an earlier version, email us.

15. Contact

For questions about this policy, privacy requests, or to report a privacy or security concern, email [email protected].