Privacy Policy

SUMA is a review app for the Philippine Mechanical Engineering board exam, run by Manuel Sumalpong III. This policy covers the SUMA Android app and the website at sumacards.com.

• Your name, as you type it at sign-up. It is shown back to you in the app and nowhere else.
• Your email address, used to sign you in, to send password resets and sign-up confirmations, and to reach you about your access.
• Your password, which we never see or store in readable form. It is hashed by our authentication provider.
• Your access code and the fact that it has been redeemed, so paid access can be granted and a code cannot be used twice.
• A device identifier we generate ourselves, so only one device can be studying on an account at a time. It is a random value we create, not your phone's hardware or advertising ID.
• Your study activity: which deck and mode you were in, how far through you were, and the answers held in that session, so you can pick up where you left off on another device.

If you sign in with Google, we receive your email address and name from Google. We do not receive your Google password, contacts, or anything else in your Google account.

SUMA carries no advertising, no analytics or tracking SDKs, and no crash reporting service. We do not collect your location, contacts, photos, calendar, call or message logs, and the app does not ask for the camera or microphone. Its only Android permissions are internet access and vibration.

To give you an account and keep you signed in, to confirm you have paid access, to sync your saved sessions between your phone and your browser, and to spot sharing of a single paid account across many people. We do not sell your information, and we do not use it for advertising or profiling.

• Supabase, which hosts our database and handles sign-in and authentication email.
• Render, which hosts the website and the app's backend.
• Google, only if you choose to sign in with Google.

These providers process data on our instructions so that SUMA can run. Data may be stored on servers outside the Philippines.

Your account and its saved sessions are kept for as long as your account exists. When you delete your account, they are deleted with it, along with your device records.

One record survives on purpose: the access code you redeemed stays marked as used, with your identity removed from it. That is what stops a paid code from being recycled by deleting an account and registering again. It no longer points to you.

Go to sumacards.com/delete-account, sign in, and delete it there. The same page is linked from Settings on the website and from the Profile tab in the app. Deletion is immediate and cannot be undone, and it does not refund or free up your access code.

You can also ask us for a copy of what we hold about you, or ask us to correct it, by emailing manuelsumalpongiii@gmail.com.

Traffic between your device and our servers is encrypted. Passwords are hashed by our authentication provider. The offline licence the app holds is signed and tied to your device, the question sets bundled with the app are encrypted, and the licence and its key are kept in the device's secure storage and excluded from Android cloud backup.

SUMA is built for engineering graduates preparing for a professional licensure exam. It is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, email us and we will remove it.

If this policy changes in a way that affects what we collect or who processes it, we will update the date at the top of this page, and tell you in the app or by email where the change is significant.