Privacy Policy
Last updated: July 20, 2026
This policy explains what CTICases collects when you use
cticases.com, why, and the choices you have. Data collection
is kept to the minimum needed to run a free educational archive.
What is collected
- Your name and email address — either provided by Google when you sign
in with a Google account, or entered by you when you sign in with an email address. Sign-in
is passwordless in both cases and handled by Clerk; CTICases never sees or stores a
password. Your name and email are stored to run your account.
- Your profile picture, if you sign in with Google — shown in the site's UI
but not stored on CTICases' own servers; it's displayed directly from your Google/Clerk
account each time. Email sign-in has no profile picture.
- Your saved cases (favorites) and any case reports you submit
via the flag button.
- Which cases you view — logged to enforce a daily fair-use viewing limit and
prevent automated scraping. You can see this as a History list in your dashboard: turn it off
at any time to stop future entries being added (an anonymous count is still kept for the limit
and for aggregate statistics), and remove individual entries from the list yourself whenever
you like.
- Your approximate country — estimated by Cloudflare's network from your
connection when you view a case, for aggregate usage statistics only. No precise location or
long-term IP address log is kept.
- Basic technical data — your IP address and request metadata are processed
transiently to deliver pages, prevent abuse, and enforce rate limits. No advertising or
tracking profiles are built.
- Local preferences — your light/dark theme choice is stored in your
browser's local storage, not on any server.
Health information about you is never collected, and your data is never sold or rented.
Cookies
A single essential session cookie, set by Clerk, keeps you signed in. It is
strictly necessary for the account features to work, so it is set only after you sign in. No
advertising or cross-site tracking cookies are used.
Third-party services
CTICases relies on a small number of providers to operate:
- Cloudflare — hosting, database, and bot protection. Requests pass through
Cloudflare's network.
- Clerk — passwordless sign-in, either with your Google account or with
a one-time code sent to your email address, and session management.
- Loops — sends case-report and contact-form emails.
- YouTube (Google) — case videos play in an embedded YouTube player;
YouTube may set its own cookies when a video loads, under Google's privacy policy.
Legal basis (EEA/UK users)
Where the GDPR / UK GDPR applies, email and account data are processed to provide the service
you request (contract), and technical data is processed to keep the service secure and
available (legitimate interests). The site is intended for academic and healthcare
professionals and is not directed at children.
How long data is kept
Account data — including your viewing history, if enabled — is kept until you delete your
account. Rate-limit counters are cleared automatically.
De-identified, aggregate usage statistics (such as view counts and country distribution) may be
kept and used for internal analytics and referenced in academic publication about the project.
No case-level personal data — your name, email, or which specific cases you viewed — is ever
published.
Your rights
- Delete everything, yourself: sign in, open your dashboard, and choose
Delete account. This permanently erases your account, favorites, viewing
history, and reports from CTICases. It does not affect your underlying Google account.
- Access or correct your data, or ask questions about this policy, via the
contact form.
Changes
This policy may be updated as the site evolves. Material changes will be reflected by the
"last updated" date above.
Contact
Questions about privacy? Use the contact form.