Privacy policy
Effective November 11, 2026
firstpass is a practice tool for the USMLE Step 1 exam. This page says what we collect when you use it, why, and what you can do about it.
What we collect
Your account
Your email address and a password. The password is stored only as a scrambled value (a hash) by our sign-in provider. We cannot read it and nobody can look it up.
We do not check that an email address belongs to the person who registers it. Use an address you control: it is the only way to reset your password, and the address we answer privacy requests at.
Your practice record
When you practice, we store on our servers:
- the study blocks and exam days you start, and when each began and ended;
- which questions were in each block;
- the answer you chose for each question, and whether you marked it;
- where you are in an unfinished exam day, including the time left on its clocks.
What stays in your browser
Your notes, highlights, struck-out answers and display settings, along with a working copy of the block you are in, are kept in your browser’s storage on your own device. They are not sent to us. Clearing your browser’s site data removes them.
Technical records
Like every website, the services that host firstpass keep a log of requests: your IP address, your browser type, the page or file asked for, and the time. Sign-ins are recorded the same way.
What we do not collect
We do not ask for your name, your school, your exam date or any payment details. The site carries no advertising, no analytics trackers and no social media buttons.
How we use it
- To run the service: sign you in, resume a block or exam day you left, and score a study block.
- To send the emails an account needs, such as a password reset link. We do not send marketing email.
- To keep the service working and secure: finding faults, and spotting and stopping abuse.
- To improve the questions. We may study answers across all accounts together to find questions that are flawed, ambiguous, or far easier or harder than intended.
We do not sell your information, and we do not share it with anyone for advertising.
Who else handles it
Two companies process data for us so that firstpass can run. They act on our instructions.
- Supabase runs our sign-in service and database. Your account and practice record are stored there, in the United States. It also sends our account emails.
- Vercel hosts the website and keeps the request logs described above.
Beyond those two, we share personal information only in these cases:
- when the law requires it, for example in response to a valid court order;
- if firstpass is transferred to a new operator, in which case your account moves with it and this policy keeps applying until you are told otherwise.
How long we keep it
We keep your account and your practice record until you ask us to delete your account. Deleting an account deletes its blocks, answers and exam days with it.
Request logs are kept by our hosting and database providers for a limited period that they set, and are then deleted.
Your choices
You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete your account. Write to team@holosbio.co from the email address on your account, so we know the request is yours. We answer within 30 days.
You can change your password at any time from your dashboard, and you can remove what is stored in your browser by clearing the site’s data.
Depending on where you live, the law may give you further rights over your personal information. We honor these requests wherever you live, and we will not treat you differently for making one.
Security
All traffic to firstpass is encrypted in transit. The database enforces that an account can read only its own practice record, and the answer key is never sent to your browser before a block has ended.
No system is perfectly secure. If you find a weakness, please tell us at team@holosbio.co so we can fix it.
Age
firstpass is for adults preparing for a medical licensing exam. You must be at least 18 to have an account, and we do not knowingly collect information from anyone younger. If you believe a child has created an account, write to us and we will delete it.
Where your information is held
firstpass is run from the United States, and your information is stored there. If you use firstpass from another country, your information is transferred to and processed in the United States.
Changes to this policy
When this policy changes, the date at the top changes with it. If a change affects how we use information we already hold about you, we will say so on the site or by email before it takes effect.
Contact
Questions about this policy or about your information: team@holosbio.co. The rules for using firstpass are in the terms of use.