Privacy

Effective 19 October 2026.

Who is responsible

Socramed is run by Erfan Bashar, the data controller for everything described here. Contact: [email protected].

This site (socramed.com)

The site itself sets no cookies and has no accounts or sign-in.

If you use Socra, the Socra app places two small cookies for socramed.com: socra=1, which says only that this browser may show Socra, and socra_view, which says whether you last used Socra’s chat or its canvas (chat or canvas). Neither holds any identity, and signing out of Socra clears both. The Socra button shows for everyone on English notes; on those notes the site reads the two cookies in your browser to decide what opening Socra shows, in which mode and at which width, and whether to show a short hint on the button that Socra also has a canvas. The site never writes them and sends nothing to Socra when a page loads (the one exception, when you leave a note, is the next paragraph). If you choose “Continue with Google”, Socra’s sign-in opens in a new tab, where Cloudflare Access and Google handle the login. When you open Socra on a note, Socra learns which note you are reading and whether you opened its chat or its canvas; when you open the full Socra from that panel, the full app is told the note and the section you were reading.

If your browser has socra=1, an English note that teaches (not a topic overview) notices which of its parts you spent real time on: for each part, the seconds it was in the middle of your screen while you were using the page, its number of words, and whether you came back to it. When you leave the page or switch away from its tab, the site sends these numbers to Socra in one small message (again only if you come back and read more), with the note’s address and the parts’ ids, and nothing else: no name, no text of the note, and nothing is kept in your browser. Socra keeps them for 3 days to ask you whether you studied those parts; reading alone never marks anything as learned, and you can turn this off in Socra. Without socra=1 nothing is measured or sent.

It uses Umami Cloud for aggregate pageview counts only. Umami’s tracker does not use cookies, respects Do Not Track, runs only on socramed.com, and leaves out the URL’s query and fragment. Umami derives an anonymous session hash from your IP address, your user agent and the site ID. There are no custom events, no session replay and no heatmaps.

Your browser keeps your light or dark theme choice in localStorage, and some navigation state (the back link and a cached copy of the library index) in sessionStorage. Both stay on your device.

A video in a post loads from YouTube’s privacy-enhanced youtube-nocookie.com only after you press play. The preview image before that comes from YouTube’s image host. Other images and media come from the site’s own media host.

Socra (app.socramed.com)

Socra is a separate app, in private beta.

You sign in through Cloudflare Access with Google. Socra receives only your email address: no name, no Google password, no contacts and no other Google data. Cloudflare Access sets its own sign-in cookie on app.socramed.com.

For each person, Socra stores:

• your email address;
• an optional note you send with an access request;
• your chats: what you wrote and the tutor’s answers;
• memory files the tutor keeps about your study: what you are studying, your weak spots and your preferences;
• usage records: the number of model calls, tokens and cost;
• which parts of notes you read on socramed.com (see above), for 3 days;
• when a message is refused by the safety check, a short excerpt (up to 300 characters) with the reason, plus any appeal you write.

Who processes it

• Cloudflare hosts the app and its storage, and handles sign-in through Cloudflare Access.
• DeepSeek is the AI model. Each message you send, with the relevant context, goes to DeepSeek’s API to produce an answer.
• Google is used for sign-in only.

Nothing is sold, there is no advertising, and there is no tracking across sites.

Study help, not medical advice

Socra is study help, not medical advice. Do not enter patient information.

Your data

To see or delete your data, or to withdraw from the beta, email [email protected]. There is no self-service deletion yet. Your data is kept while your account exists.

Changes

Changes to this policy are announced on this page.